Cookie Policy

Overview

LumenLingo uses essential browser storage for language and consent choices, and essential Sentry error diagnostics for reliability. If you allow optional Analytics or Session Replay, Vercel, PostHog, and Sentry use the additional cookie, localStorage, and sessionStorage mechanisms described below.

You can manage your preferences at any time using the Cookie Settings button in the footer, or by clearing your browser's site data.

Cookie Consent

You can reject all optional storage by clicking “Reject All”. The site remains available; only essential consent/language storage and core Sentry error diagnostics remain active.

You can change or withdraw optional consent at any time through “Cookie Settings”. Withdrawal immediately stops new analytics capture and active Sentry and PostHog replay recording. Your essential local preference and a pseudonymous server-side consent record remain so we can honour and demonstrate your choice; previously collected data follows our Privacy Policy.

Optional Analytics and Session Replay are off until you take an affirmative action. Essential storage and limited technical error diagnostics do not depend on optional consent.

Cookie Category Controls

You can control cookies by category. Each category can be independently enabled or disabled through the cookie settings panel:

• Strictly Necessary — consent and language preferences plus limited Sentry error diagnostics. Always active; session replay is not included.
• Analytics — consent-gated Vercel Analytics, Speed Insights, PostHog events, and campaign attribution. PostHog may use first-party cookie/localStorage persistence.
• Session Replay — separately consent-gated masked replay through Sentry and PostHog. It can be disabled without affecting core website functionality.

Your category preferences are stored in the ll_cookie_consent key in localStorage and respected on every subsequent visit.

Local Storage

localStorage persists data on your device until explicitly cleared. We use the following keys:

ll_cookie_consent

• Category: Essential
• Purpose: Stores your cookie consent preferences — which categories you've accepted or rejected, the consent version, and a timestamp.
• Duration: 13 months from the date of your last consent decision, per GDPR guidance.
• Data: JSON containing analytics and sessionReplay choices, an always-true essential diagnostics flag, timestamp, consent version, and expiry. No name or email.

NEXT_LOCALE

• Category: Essential
• Purpose: Remembers your preferred display language so the site loads in the right locale on your next visit.
• Duration: Persistent until cleared.
• Data: A two-letter locale code (e.g. "en", "fr", "de"). No personal data.

Session Storage

sessionStorage persists only for the current browser tab. When you close the tab, this data is automatically deleted.

ll_utm

• Category: Analytics
• Purpose: Preserves UTM campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) across page navigations within a single session. This helps us understand which marketing channels bring visitors to the site.
• Duration: Current browser session only — deleted when the tab is closed.
• Data: JSON object with up to five string fields representing campaign parameters. No personal data.

Sentry Session Replay

• Category: Session Replay (consent required)
• Purpose: If you consent to Session Replay, Sentry stores internal session state in sessionStorage to manage the replay recording lifecycle.
• Duration: Current browser session only.
• Data: Internal Sentry session identifiers and replay state. All captured interactions are anonymised — text is masked and media is blocked.

Sentry Session Replay Keys

When you consent to Session Replay, the Sentry SDK (@sentry/nextjs v10.x) stores the following keys in sessionStorage:

sentryReplaySession

• Category: Session Replay (consent required)
• Purpose: Stores the replay session identifier, segment count, start timestamp, and last-activity timestamp. Used to correlate replay segments within the same browser tab.
• Duration: Current browser session only — deleted when the tab is closed.
• Data: JSON object containing a session ID (UUID), started and last-activity ISO timestamps, and a segment counter. No personal data.

__sentry_user

• Category: Essential Error Diagnostics
• Purpose: Sentry may keep limited anonymous technical session context to correlate errors. Session replay uses separate storage and requires explicit Replay consent.
• Duration: Current browser session only.
• Data: Random anonymous identifier. No personal data such as name, email, or IP address is stored.

Service Worker Cache

We use a Service Worker to improve performance and enable offline access.

Cache name: lumenlingo-v1

Caching Strategies

• Static assets (JS, CSS, fonts, images) — Cache-first. Assets are served from the local cache for speed, and updated in the background when a new version is available.
• HTML pages — Network-first. The latest version is always fetched from the server. If you're offline, a previously cached version is served.
• Offline fallback — If the network is unavailable and no cached version exists, a dedicated offline page is displayed.

The Service Worker cache is entirely device-local. No cached data is sent to our servers. You can clear it at any time via your browser's DevTools (Application → Storage → Clear site data).

The cache stores no personal data — only public website assets and page content.

Cookies

LumenLingo sets an essential locale preference. After Analytics consent, PostHog may also use first-party cookies and localStorage for an anonymous identifier, attribution, feature flags, and consented analytics.

Locale preference

• Category: Essential
• Purpose: The next-intl internationalisation library sets a locale preference cookie (NEXT_LOCALE) to remember your chosen language across visits.
• Duration: Persistent until cleared.
• Data: Two-letter locale code. First-party, not shared with any third party.

We do not use advertising cookies, social-media pixels, or cross-site behavioural tracking. PostHog persistence is first-party and used only for consented product analytics and replay.

Third-Party Services

The following third-party services may process data from your visit. Each service's storage behaviour is governed by their own privacy policy:

Vercel Analytics

Vercel Analytics and Speed Insights measure page use and performance without persistent identifiers. Their scripts load only after you consent to Analytics.

Vercel Privacy Policy

Sentry

Sentry receives limited technical error reports as an essential reliability service. Session Replay is separate and starts only with explicit Replay consent: text is masked, media is blocked, 0.1% of consented sessions are sampled, and an error may trigger a consented replay.

Sentry Privacy Policy

PostHog

After Analytics consent, PostHog processes product events and may store a first-party cookie/localStorage identifier. PostHog replay also requires Session Replay consent, records up to 10% of eligible sessions, and masks inputs. Revocation opts out of capture and stops recording immediately.

PostHog Privacy Policy

Vercel Speed Insights

Real-user performance monitoring that measures Core Web Vitals (LCP, FID, CLS, TTFB, INP) from actual visitor sessions. Cookie-free — no cookies or persistent identifiers are stored on your device. Speed Insights data is collected only when you consent to the Analytics category. Data is aggregated and anonymised; individual page loads cannot be traced to a specific user.

Vercel Privacy Policy

Managing Your Preferences

You can change your consent choices at any time by clicking the "Cookie Settings" button in the footer of any page. This will re-open the consent banner where you can update your preferences.

To remove all stored data, you can clear your browser's site data through your browser settings or DevTools. This will reset your consent preferences and you'll see the consent banner again on your next visit.

The local preference is the source of truth for this browser. Each decision is also sent to our server-side consent endpoint with category choices, policy version, timestamp, and a one-way-hashed request identifier for accountability.

Managing Cookies in Your Browser

In addition to our cookie settings panel, you can manage or delete cookies directly through your browser settings. Below are links to cookie management instructions for major browsers:

• Google Chrome: Clear, enable, and manage cookies in Chrome
• Safari: Manage cookies and website data in Safari
• Firefox: Clear cookies and site data in Firefox
• Microsoft Edge: Delete cookies in Microsoft Edge

Safari users should note that Safari's Intelligent Tracking Prevention (ITP) automatically restricts the lifespan of most cookies and limits cross-site tracking. ITP may delete some cookies sooner than the durations listed in our cookie table above. This is a Safari browser feature and is not controlled by LumenLingo.

How We Demonstrate Consent (GDPR Art. 7(1))

Your current choice is stored in ll_cookie_consent. The site also sends each decision to a server-side endpoint that records the categories, policy version and timestamp with a one-way-hashed request identifier.

The local record controls this browser. The server record supports GDPR accountability and does not contain your name, email, raw IP address, browsing history, or replay contents.

Vercel/PostHog analytics and both replay systems remain disabled unless the relevant optional flag is active. Essential Sentry error reports are limited to technical diagnostics and are explicitly separate from replay.

Global Privacy Control & Do Not Track

We honour the Global Privacy Control (GPC) browser signal as required by the California Privacy Rights Act (CPRA), Colorado Privacy Act (CPA), and Connecticut Data Privacy Act (CTDPA). When your browser sends a GPC signal, we automatically disable all non-essential tracking — including analytics and session replay — regardless of any prior cookie consent preferences.

We also honour the Do Not Track (DNT) browser signal. Although DNT is no longer maintained as a web standard by the W3C, we treat it identically to GPC as a matter of good practice.

If you disable GPC or DNT in your browser, you can update your cookie preferences using the “Cookie Settings” button in the footer of any page.

UK PECR Compliance

In addition to the UK GDPR, our use of cookies and similar storage technologies complies with the Privacy and Electronic Communications Regulations 2003 (PECR), specifically Regulation 6.

Under PECR, we are required to obtain your consent before placing non-essential cookies or accessing non-essential information on your device. This is why we show a cookie banner on your first visit.

Strictly necessary items — consent and language preferences, public asset caching, and limited Sentry error diagnostics — support the service and are not used for advertising. Session replay is never treated as necessary.

Optional items — analytics, attribution, PostHog persistence, and Sentry/PostHog replay — activate only after affirmative consent and stop when it is withdrawn.

Our consent mechanism is designed to meet ICO guidance: no pre-ticked boxes, no “cookie walls,” easy withdrawal at any time, and clear information about each category.

Policy Updates

We may update this Cookie Policy when we add new storage mechanisms or change our data practices. If we make significant changes to the categories of data we collect, we'll increment the consent version number, which will automatically prompt you to review and update your preferences.

Current consent version: 1.3

Version History

• v1.3 (30 July 2026) — documented server-side consent accountability, consent-gated PostHog cookie/localStorage and replay, always-on essential Sentry error diagnostics, separate consent-gated Sentry replay, immediate replay revocation, and corrected replay sampling.
• v1.2 (27 March 2026) — Phase 3 legal fortification: added cookie consent mechanism section (rejection, withdrawal, affirmative consent), added cookie granularity controls (essential, functional, analytics), added browser storage management instructions (Chrome, Safari, Firefox, Edge), added accessibility statement, added data retention cross-reference to Privacy Policy, standardised contact emails to Checking secure contact.
• v1.1 (26 March 2026) — Phase 2 legal hardening: added ICO complaint right and contact details (GDPR Art. 77); added consent accountability mechanism (GDPR Art. 7(1)); separately disclosed Vercel Speed Insights; enumerated all Sentry sessionStorage keys by name; removed hedging language (“may set” → “sets”) from locale cookie; standardised company name to Lumenshore Limited.
• v1.0 (24 March 2026) — Initial Cookie Policy published.

Data Retention

For full details on data retention periods, including how long personal data is retained and our deletion schedule, please refer to our Privacy Policy.

Your Right to Complain

If you believe our use of cookies or similar technologies infringes your rights, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s independent supervisory authority for data protection.

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom

We would appreciate the opportunity to review your concern before you contact the ICO. Please email us at Checking secure contact.

Cookie Settings Accessibility

The cookie banner and settings panel are designed to be fully accessible. All controls support keyboard navigation (Tab, Enter, Space) and are compatible with screen readers through appropriate ARIA labels. Colour contrast meets WCAG 2.1 Level AA requirements. If you experience difficulty interacting with the cookie banner or settings, please contact us at Checking secure contact and describe what happened.

Contact Us

If you have questions about this Cookie Policy or how we use data on your device:

• Email: Checking secure contact
• Company: Lumenshore Limited (Company No. 09607326)

Messages are reviewed as capacity allows.