Privacy Policy

1. Scope

This Privacy Policy explains how personal data is processed when someone visits cto.berlin, contacts CTO Berlin, or books a call. Personal data means information relating to an identified or identifiable person.

2. Controller

Lucido LLC
7901 4th St N, Suite 300
St. Petersburg, FL 33702
United States

Authorized Member: Sebastian Galonska
Email: contact@lucido.dev
Phone: +1 (315) 898-1130

3. Hosting and security logs

The website is delivered through Cloudflare, Inc. Cloudflare processes technical request data such as IP address, requested URL, date and time, browser and device information, referring page, and security signals. This is necessary to deliver the site, maintain availability, and detect abuse.

The legal basis is our legitimate interest in providing a secure and reliable website (Art. 6(1)(f) GDPR). Log data is retained only for as long as required for operation, security, troubleshooting, and legal obligations. See the Cloudflare Privacy Policy.

4. Contact enquiries

When someone uses the contact form or contacts us directly, we process the information provided, including name, company, email address, message content, and related communication. The form sends the enquiry through the Lucido mail service at lucido.dev.

The legal basis is taking steps at the visitor’s request before entering into a contract or performing a contract (Art. 6(1)(b) GDPR), and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Required form fields are needed so we can receive and answer the enquiry. Data is retained until the enquiry is resolved and thereafter only where necessary for contractual, legal, accounting, or dispute-resolution purposes.

5. Booking a call

We use Cal.com, Inc. to display appointment availability and manage bookings. Opening a page containing the embedded calendar establishes a connection to Cal.com and may transmit technical request data. If someone books a call, Cal.com also processes the submitted contact details, selected time, time zone, and any booking information.

The legal basis for submitted booking data is Art. 6(1)(b) GDPR. The embedded calendar is provided on the basis of our legitimate interest in offering convenient appointment scheduling (Art. 6(1)(f) GDPR). Booking data is retained for as long as needed to arrange the meeting and manage the resulting business relationship. See the Cal.com Privacy Policy.

6. Consent choice and necessary storage

The site stores the visitor’s analytics choice in the browser under cb-consent. This local-storage entry is necessary to remember whether optional analytics were accepted or declined. Optional analytics remain disabled until consent is granted.

The choice can be changed at any time through “Cookie settings” in the footer. Withdrawing consent does not affect processing that occurred before withdrawal.

7. Analytics

Plausible Analytics. We use a self-hosted Plausible instance at t.lucido.dev for aggregate, cookieless statistics. It does not set analytics cookies or retain full IP addresses. We use these statistics on the basis of our legitimate interest in understanding aggregate website use and improving the site (Art. 6(1)(f) GDPR).

Google Analytics 4. If a visitor consents, Google Analytics is loaded and processes usage information such as visited pages, approximate location, browser and device information, and interaction events. Google may set or access identifiers in cookies or similar storage. The legal basis is consent (Art. 6(1)(a) GDPR).

PostHog EU Cloud. If a visitor consents, PostHog processes product-analytics events and heatmap information such as clicks and scrolling. PostHog is configured to use its EU infrastructure and to create person profiles only for identified users; this website does not intentionally identify ordinary visitors. The legal basis is consent (Art. 6(1)(a) GDPR). See the PostHog Privacy Policy.

Analytics data is retained according to the configured retention periods of the respective services and is deleted or aggregated when it is no longer needed for website analysis.

8. Google Fonts

The site uses Google Web Fonts to display the Plus Jakarta Sans typeface. The browser connects to Google servers to obtain the font files and may transmit the IP address, browser information, and the requested resource. The legal basis is our legitimate interest in consistent, efficient presentation of the website (Art. 6(1)(f) GDPR). Google services may involve processing in the United States.

9. Embedded media and external links

Some blog posts may contain embedded YouTube videos. Loading such a post can establish a connection to YouTube/Google and transmit technical request data. The site also links to third-party services such as LinkedIn and WhatsApp. Simply displaying an ordinary external link does not transmit form data to that provider; the provider receives data when the visitor follows the link or otherwise uses its service. The provider’s own privacy terms then apply.

10. Recipients and international transfers

Personal data is disclosed only where necessary to the service providers described above, professional advisers bound by confidentiality, or public authorities where required by law. We do not sell personal data.

Lucido LLC and several service providers are located in the United States or may process data there. Where the GDPR requires transfer safeguards, transfers rely on an applicable adequacy decision, including the EU–US Data Privacy Framework for certified recipients, or on Standard Contractual Clauses and supplementary safeguards as appropriate.

11. Rights

Subject to the applicable conditions, individuals have the right to request access, correction, deletion, restriction, and portability of their personal data; to object to processing based on legitimate interests; and to withdraw consent at any time. They may also lodge a complaint with a competent data-protection supervisory authority.

Requests can be sent to contact@lucido.dev. We may need to verify the requester’s identity before acting on a request.

12. California privacy information

The categories of personal information we may collect are identifiers and contact details, internet or other electronic-network activity, booking details, and the content of communications. We collect this information from visitors, their browsers or devices, and the service providers described above. We use it to operate and secure the website, respond to enquiries, arrange calls, understand website use, and meet legal obligations.

We may disclose these categories of information to hosting, communications, scheduling, and analytics providers for the purposes described in this policy. We do not sell personal information or share it for cross-context behavioural advertising.

Browser privacy signals. Optional Google Analytics and PostHog analytics are disabled unless the visitor actively consents. Because of this consent-based control, the site does not use a browser’s Do Not Track setting as a separate instruction. Visitors can decline or withdraw optional analytics at any time through “Cookie settings” in the footer. The site does not sell or share personal information in a way that requires a separate opt-out through Global Privacy Control.

13. Canadian privacy information

Sebastian Galonska is the privacy contact responsible for enquiries about Lucido LLC’s handling of personal information. Canadian residents may request access to, or correction of, their personal information and may ask questions or raise a complaint by emailing contact@lucido.dev. Please describe the request and the information concerned. We may need to verify the requester’s identity before responding.

If a concern is not resolved, the individual may contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator.

14. Automated decisions

We do not use personal data collected through this website for automated decision-making that produces legal or similarly significant effects.