Legal

Privacy Policy

Luzran takes your privacy seriously. This policy explains how we collect, use, protect, and share your information in compliance with GDPR, CCPA, and other applicable regulations.

Information We Collect

We collect information that you provide directly to us, information collected automatically through your use of our Site and services, and information obtained from third-party sources.

Information You Provide

Personal identifiers: full name, email address, phone number, business name, billing address, and job title
Project data: intake call recordings, notes, project specifications, briefs, brand assets, and deliverables you provide
Financial information: payment details processed through third-party providers (Stripe, PayPal, Venmo) — we do not store full credit card numbers on our servers
Communications: emails, messages, feedback, and correspondence related to our services
Job application data: resumes, cover letters, portfolio links, and related professional information submitted through our careers portal

Information Collected Automatically

Device and browser information: browser type and version, operating system, device type, screen resolution
Usage data: pages viewed, time spent on pages, click patterns, navigation paths, referring URLs
Network information: IP address, approximate geographic location derived from IP
Cookies and tracking technologies: see our Cookie Policy at luzran.com/terms#cookie-policy for full details

Information from Third Parties

Analytics data from Google Analytics (via Google Tag Manager)
Advertising data from Meta (Facebook) Pixel for conversion tracking
Payment confirmation data from payment processors

Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under one or more of the following legal bases:

Legal Bases

Contract Performance: Processing necessary to perform our contract with you (e.g., delivering services you have purchased)
Legitimate Interest: Processing necessary for our legitimate business interests, such as improving our services, fraud prevention, and direct marketing to existing clients — balanced against your rights and freedoms
Consent: Where you have given explicit consent (e.g., marketing communications, cookie consent for non-essential cookies). You may withdraw consent at any time
Legal Obligation: Processing required to comply with applicable laws and regulations

How We Use Your Information

We use the information we collect for the following purposes:

Service Delivery

To communicate with you about projects and deliver contracted services
To assign tasks to contractors and coordinate project workflows
To process payments, send invoices, and manage billing
To provide customer support and respond to inquiries

Business Operations

For internal analysis, project documentation, and quality assurance
To improve our website, services, and user experience
To detect, prevent, and address technical issues and security threats
To comply with legal obligations and enforce our Terms of Service

Marketing (with consent)

To send promotional communications about our services (you can opt out at any time)
To deliver targeted advertising through Meta Pixel and similar technologies
To measure the effectiveness of our marketing campaigns

Call Recording Disclosure

Phone consultations may be recorded and stored securely for internal reference. These recordings are used solely to ensure accuracy of project understanding and communication with relevant team members.

Recordings are shared only with Luzran staff and contractors who are directly involved in your project and who are bound by confidentiality obligations. You will be informed at the beginning of any call that may be recorded.

You may request that a call not be recorded, and we will accommodate that request. Existing recordings can be deleted upon written request.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements.

Retention Periods

Client project data and deliverables: Retained for the duration of the business relationship and 3 years thereafter, unless deletion is requested
Financial records: Retained for 7 years as required by applicable tax and accounting laws
Call recordings: Retained for the duration of the project and deleted within 90 days of project completion, unless otherwise requested
Analytics data: Aggregated analytics data retained for up to 26 months; individual-level data retained for up to 14 months
Job application data: Retained for 1 year from the date of application, then deleted unless you request earlier deletion
Marketing consent records: Retained for 3 years from the date consent was given or withdrawn

Deletion

When personal data is no longer needed, we securely delete or anonymize it. You may request deletion of your personal data at any time (see "Your Rights" below). Certain data may need to be retained for legal compliance even after a deletion request.

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Rights Under GDPR (EEA/UK Residents)

Right of Access: Request a copy of the personal data we hold about you
Right to Rectification: Request correction of inaccurate or incomplete data
Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where there is no compelling reason for its continued processing
Right to Restriction: Request that we restrict processing of your data in certain circumstances
Right to Data Portability: Receive your data in a structured, machine-readable format and transmit it to another controller
Right to Object: Object to processing based on legitimate interests or for direct marketing purposes
Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent
Right to Lodge a Complaint: File a complaint with your local supervisory authority if you believe your rights have been violated

Rights Under CCPA (California Residents)

Right to Know: Request disclosure of the categories and specific pieces of personal information collected, the purposes of collection, and the categories of third parties with whom we share it
Right to Delete: Request deletion of your personal information, subject to certain exceptions
Right to Opt-Out: Opt out of the "sale" or "sharing" of personal information (note: Luzran does not sell personal information in the traditional sense, but ad-tech sharing may qualify under CCPA)
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights

How to Exercise Your Rights

To exercise any of these rights, you may: (1) use our on-site cookie consent banner to control non-essential tracking, (2) enable Global Privacy Control (GPC) in your browser to automatically opt out, or (3) contact us at [email protected] with the subject line "Data Subject Request." We will respond within 30 days (GDPR) or 45 days (CCPA) of receiving your verified request. We may need to verify your identity before processing your request.

CCPA Notice at Collection

This section provides additional disclosures required under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

Categories of Personal Information Collected

Identifiers: name, email, phone number, IP address
Commercial information: services purchased, payment history
Internet or electronic network activity: browsing history, search history, interaction with the Site
Professional or employment-related information: job title, company name, resume data
Audio information: call recordings (with notice)

Do Not Sell or Share

Luzran does not sell personal information for monetary consideration. However, our use of certain advertising technologies (Meta Pixel, Google Analytics) may constitute "sharing" under the CCPA. You may opt out by: (1) declining non-essential cookies via our on-site cookie consent banner, (2) enabling Global Privacy Control (GPC) in your browser — we automatically honor GPC signals and treat them as a request to opt out of non-essential tracking, or (3) contacting us at [email protected].

International Data Transfers

Luzran is based in the United States. If you are accessing our Site or services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States where our servers are located.

For EEA/UK residents: We rely on Standard Contractual Clauses (SCCs) approved by the European Commission and/or the UK Information Commissioner's Office as the legal mechanism for transferring personal data outside the EEA/UK. You may request a copy of the applicable SCCs by contacting us at [email protected].

Security Measures

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

Technical Controls

Encryption of data in transit (TLS/HTTPS) and at rest
Access controls and role-based permissions for systems containing personal data
Regular security assessments and code reviews
Secure development practices following OWASP guidelines
Rate limiting and input validation on all public endpoints
Security headers (HSTS, CSP, X-Content-Type-Options) on all responses

Organizational Controls

Restricted access permissions — only authorized personnel and contractors access client data
Contractor confidentiality agreements and security requirements
AI-powered monitoring to flag suspicious activity
Incident response procedures for potential data breaches

Children's Privacy

Our Site and services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us at [email protected] and we will take steps to delete such information promptly.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR. If the breach is likely to result in a high risk to your rights, we will also notify you directly without undue delay.

We maintain documented incident response procedures and conduct regular reviews to ensure preparedness.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date and, where practicable, notify you by email or through a prominent notice on the Site.

We encourage you to review this Privacy Policy periodically. Your continued use of the Site after any changes constitutes acceptance of the updated policy.

Contact Us

For privacy inquiries, data subject requests, or questions about this policy:

Privacy Contact

Email: [email protected]

General Inquiries