Cookie notice
Last updated 1 November 2026
1. What this notice covers
This notice explains what Lumela stores on your device when you use our website at www.lumela.co.uk or our application, and why. Read it alongside our privacy notice.
We use “cookie” loosely here to mean cookies and anything else that stores information on your device, such as local storage and session storage. The law treats them the same.
2. Our website
We set no cookies on this website ourselves. We don’t use analytics, advertising networks, social media pixels or any other tracking here.
The “Book a walkthrough” calendar is provided by Cal.com. Its booking script loads in the background so the calendar opens quickly when you click, and when it loads, Cal.com’s network provider, Cloudflare, may set one security cookie:
| Name | Set by | Purpose | How long |
|---|---|---|---|
| __cf_bm | Cloudflare, for Cal.com | Tells people from automated bots, to protect the booking service | 30 minutes |
If you open the calendar and book, Cal.com may set further cookies needed to run the booking. Cal.com’s own cookie policy explains those.
3. Our application
Our application is available only to people whose organisation has an account with us. It uses the following, all strictly necessary to provide a service you asked for by signing in:
| What | Set by | Purpose | How long |
|---|---|---|---|
| Session and authentication cookies | Clerk, our sign-in provider | Keeps you signed in, and stops anyone else using your session | Until you sign out or the session expires |
| Cross-site request forgery token | Clerk | Stops another website sending requests as you | The session |
| Workspace preference | Us | Remembers which workspace you last viewed, if you have more than one | The session |
Because these are strictly necessary, we don’t ask for consent to set them. You can block them in your browser, but you won’t be able to sign in.
4. What the application stores in your browser
When you connect one of your own systems, some values are kept in your browser rather than on our servers. That is deliberate: it keeps credentials off our infrastructure.
| What | Where | Why | How long |
|---|---|---|---|
| Google OAuth client identifier | Local storage | So you don’t have to paste it in each time you connect a mailbox. It is an identifier, not a secret | Until you clear it or your browser data |
| Google access token | Session storage | To read email metadata directly from Google in your browser. It never reaches our servers | About an hour, or until you close the tab or disconnect |
| HubSpot or Jira credential, where entered in the browser | Session storage | To authenticate requests relayed through our server to those services | Until you close the tab |
These are stored at your request, as part of a connection you chose to make. Disconnect in the application clears them, and disconnecting a Google account also revokes the token with Google. Where your administrator sets these credentials up on the server instead, nothing is stored in your browser.
5. If we add analytics
We don’t use analytics today. If we start, we will:
- ask for your consent before setting any non-essential cookie, with rejecting as easy as accepting;
- set nothing before you choose;
- update this notice with what is set, by whom and for how long; and
- let you change your mind at any time.
We will not use advertising cookies or share data with advertising networks.
6. Managing cookies
Every major browser lets you see what is stored, delete it and block it in future. Your browser’s help pages explain how. Blocking cookies won’t stop you reading this website, though the booking calendar may not work.
7. Questions
Email info@lumela.co.uk.