Privacy Policy
Effective date: 2 September 2026. Last updated: 7 September 2026.
1. Who we are and how to contact us
Lucidx Limited is a digital marketing and technology services company. In this policy, Lucidx, we, us and our mean Lucidx Limited. We are the controller of personal data when we decide why and how it is processed. We may act as a processor or joint controller when we process personal data for a client; where that applies, the relevant client's privacy information will explain the arrangement.
For privacy questions or to exercise your rights, contact us at:
| Contact method | Details |
|---|---|
| Privacy contact | Deon Bryan |
| [email protected] | |
| Telephone | 07830 129686 |
| Post | Flat 4 79 Southwood Road, London, SE9 3QF, United Kingdom |
You can also complain to the UK Information Commissioner's Office at ico.org.uk if you are unhappy with how we use your information. We would appreciate the opportunity to address your concern first.
2. Scope of this policy
This is Lucidx Limited's general privacy and cookie policy. It applies to all websites, subdomains, landing pages and online services that we operate, including lucidx.co.uk, Star In Your Car at star.lucidx.co.uk, and our other branded websites. It explains how we handle personal data when you browse our sites, contact us, receive or respond to our marketing, use our services, or take part in a demonstration or pilot.
The information we collect and the tools we use depend on the website and service you choose. Details expressly labelled for Star In Your Car, including its photograph and personalised film processing, apply to that service only. They do not mean that every Lucidx website collects photographs or creates films. Any additional notice shown with a particular service supplements this general policy.
This policy covers processing for which Lucidx is responsible. Where we build or host a website for an independent client that controls its own use of personal data, that client's privacy notice explains its processing. Independent websites and platforms have their own privacy notices.
3. The personal data we collect
The categories we use depend on how you interact with us.
| Category | Typical information | Source |
|---|---|---|
| Website and usage data | Device and browser information, IP address, pages viewed, referral source, session events and cookie identifiers; with the relevant permission, clicks, scrolling and masked session replay information. See Section 14 for cookies and optional tracking across our websites, including details of the tools used on particular sites. | Your device and our website analytics tools |
| Business, account and service data | Name, work contact details, employer, role, company details, service correspondence and account information | You, your employer or a business contact |
| Enquiry and communication data | Name, email address, telephone number, message content, call notes and communication metadata | You or a person acting for you |
| Public source prospect data | Professional contact details and business information available from public sources, where used for our B2B marketing services | Public sources and vetted data suppliers |
| Star In Your Car data | Your selected vehicle and scene, name, mobile number, consent records, an adult head, shoulders and chest photograph, request and security records, and the private generated film | You, when you choose to submit a request |
| Preference and suppression data | Marketing preferences, withdrawal or objection records, and a limited record needed to respect your request | You and our communications systems |
| Pseudonymous request limit data | A keyed, non reversible fingerprint derived from a normalised mobile number, expiry date and request limit record | Created by the service to enforce the request limit |
4. How we use personal data and our lawful bases
We use personal data only where we have a lawful basis. The exact basis depends on the purpose.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Operate and secure our websites and deliver the service you request | Necessary technical, service and security information | Performance of the service you request and our legitimate interests in running secure, reliable services, balanced against your rights |
| Measure website use and improve the public website through optional analytics, heatmaps and session replay | Consented website usage, cookie and interaction data described in Section 14 | Consent, which you can withdraw through Cookie settings |
| Provide services, respond to enquiries and take steps at your request | Account, service, enquiry and communication data | Performance of a contract, steps at your request before entering into a contract, and where appropriate our legitimate interests in administering our business |
| Deliver B2B marketing and prospecting services | Public source prospect data and business contact information | Our legitimate interests in promoting and developing our business and our clients' businesses, or consent where required by law |
| Send direct marketing by email, text, WhatsApp or telephone | Contact and preference data | Consent where we rely on it, and otherwise only where permitted by applicable law. You can withdraw consent or opt out at any time. |
| Measure, improve and target Facebook and Instagram advertising | Consented Meta Pixel events, browser/cookie identifiers and related technical information described in Section 14 | Consent through the advertising category in Cookie settings |
| Create your Star In Your Car film | Your photograph, vehicle and scene selection | Your explicit consent to use your photograph for this purpose |
| Send you your film and pass your vehicle enquiry to the dealer | Name, mobile number, private link delivery record, consent records | Performance of the service you requested |
| Enforce the limit of three requests per mobile number in any rolling 30 day period | Pseudonymous request limit data only | Our legitimate interests in preventing abuse, controlling generation costs and keeping the service available fairly |
| Comply with legal obligations, protect rights and manage disputes | Any relevant data | Legal obligation or our legitimate interests in establishing, exercising or defending legal claims |
If we rely on consent, you may withdraw it at any time by contacting us using the details in Section 1 or by using the opt out route in a marketing message. Withdrawal does not affect processing carried out before it is withdrawn.
5. Star In Your Car personalised film
This section and the photograph and film-provider details in Sections 6 and 7 apply only if you use Star In Your Car.
Star In Your Car is operated by Lucidx Limited (referred to as we, us and our). We provide it on behalf of the motor dealer whose brand appears on the page you used. For the creation of your film we are the controller. For the sales follow up to your vehicle enquiry, the dealer is a separate controller and uses your details under its own privacy notice. We tell you the dealer's identity on the page where you make your request.
When you submit a request, we create a single film request. Once the film is ready we create a private viewing link and pass that link to our customer system, which sends it to you by WhatsApp. The film is never shown on a public page. We also limit each mobile number to three film requests in a rolling 30 day period. We do not keep the mobile number in the limit record; we use a keyed, non reversible fingerprint that cannot be used to retrieve a telephone number.
6. Star In Your Car: the photograph you upload
To make your film we ask for a recent photograph of your head, shoulders and chest. Our film provider uses specific technical processing to place your likeness into the scene you choose. We do not use your photograph to identify you, to match your face against any database, or for facial recognition, and we do not use it to make any decision about you. We rely on your explicit consent to use your photograph for this purpose. You can withdraw that consent at any time and we will stop using it, although this does not affect use that has already taken place. We have completed a data protection impact assessment for this processing and you can ask us for a summary.
7. Star In Your Car: our film provider and where your data goes
We use an independent artificial intelligence film provider to create your film. That provider is Kie AI, operated by NexusAI Services LLC, based in Denver, Colorado, United States. The film itself is generated by the Seedance 2.5 model, which Kie AI accesses on our behalf. Under Kie AI's published rules, uploaded input files are deleted automatically within three days, generated films are held for 14 days and then permanently deleted, and log records are kept for two months. Kie AI's terms permit it to use content it receives to operate and improve its services, and we have not obtained any commitment from Kie AI that goes beyond those terms. The Seedance 2.5 model is developed by ByteDance, and generation may involve processing on servers outside the United States. If you ask us, we will request earlier deletion of your photograph and film from Kie AI, although we cannot guarantee deletion ahead of its published rules. Because this processing takes place outside the United Kingdom, we rely on the UK International Data Transfer Agreement, supported by a transfer risk assessment that covers the United States and any onward processing by the model provider. You can ask us for more detail about this transfer. If you are not comfortable with your photograph being processed in this way, please do not use Star In Your Car.
Before your film is sent to you, still images taken from it are checked automatically by a second artificial intelligence service, so that a film with an obvious mistake, such as a second person in the car or you shown in the wrong seat, is made again rather than sent. Only images of the finished film are checked, never your photograph, and the check does not identify or recognise you. That service is OpenAI, L.L.C., based in the United States. Under its API terms the images are not used to train its models and are deleted within 30 days. If a film still cannot be made correctly after several attempts, we tell you rather than send it.
8. Marketing
Across our websites and services, we use contact and preference information for marketing as described in Section 4. You can object to direct marketing or withdraw consent at any time using the opt-out in a message or by contacting us. Cookie consent does not itself sign you up for marketing messages.
Sending you your film and dealing with your vehicle enquiry are part of the service you asked for, and we contact you for those reasons because you requested the film. Marketing is separate and always optional. We only send you marketing by WhatsApp, SMS or telephone if you have given us separate consent, and you can withdraw that consent at any time using the opt out in any message or by contacting us. Choosing not to receive marketing will never stop you receiving your film.
Marketing by phone, SMS, WhatsApp and other electronic messages is subject to UK privacy and electronic marketing rules. Consent, where required and relied on, is clear, specific, recorded and as easy to withdraw as it was to give.
9. Star In Your Car: your film is AI generated
Your film is an artificial visualisation created by computer software. It is not real footage. We label it as an AI generated film.
10. Age and permission
Star In Your Car is for adults aged 18 or over. Please do not upload a photograph of anyone under 18, a group photograph, or a photograph of someone who has not agreed to take part. You must confirm that the photograph is of you, or that the person shown has given you permission to use it.
11. Who we share information with
We do not sell personal data. We may share it with the following recipients only where necessary for the stated purpose:
| Recipient or category | Why we share |
|---|---|
| The dealer named on the page you used | To handle your vehicle enquiry or test drive discussion. The dealer is a separate controller. |
| Kie AI (NexusAI Services LLC, United States) | To create your film from your photograph and the scene you chose. See Section 7. |
| Cloudflare (R2 storage) | To store your photograph until your film is made, and your finished film for 30 days |
| GoHighLevel and WhatsApp (Meta) | To hold your contact record and the private film link, send you the link, and send any marketing you have separately consented to |
| Cloud hosting and managed application providers | To host, secure and operate the service and its private result pages |
| Google (Google Analytics), Microsoft (Microsoft Clarity) and Meta (Meta Pixel) | With the relevant cookie permission, to measure website use and improve the public website. Clarity provides heatmaps and masked session replay. Meta Pixel measures website activity for Facebook and Instagram advertising; on Star In Your Car this includes public-page visits, vehicle selections and successful film requests. See Section 14 and the linked provider privacy information. |
| Professional advisers, insurers, regulators and authorities | To obtain advice, protect our rights or comply with a legal obligation |
| Group companies and vetted suppliers | To provide our services under appropriate contractual and organisational safeguards |
Where a third party processes information for us, we require appropriate contractual and organisational safeguards. A third party may also process information under its own privacy notice where it independently determines the purpose and means of processing.
12. How long we keep personal data
Across our websites and services, we keep personal data for as long as needed for the purpose for which it was collected, including providing the service, maintaining business records, respecting preferences, complying with legal obligations and resolving disputes. The appropriate period depends on the information and our relationship with you. The service-specific periods below apply to Star In Your Car.
Star In Your Car
We store your finished film on our own cloud storage, provided by Cloudflare, and your private watch link works for 30 days after your film is ready, after which we delete the film. If you download the film during that time, the copy you keep is yours. We remove our stored copy of your photograph as soon as your film is completed or fails, and in any case within 7 days. A film that does not pass our check is made again from the same photograph first, so "completed or fails" means the end of your request, not the first attempt. Your name and telephone number are kept in our request record for the same 30 days as your film. We keep your marketing preferences and a short consent record for longer so we can respect your choices and show that consent was given. Our customer system provider, GoHighLevel, holds your contact record and the private film link; the link stops working after 30 days. Our film provider deletes your photograph and film under its published rules described in Section 7. The WhatsApp message we send you contains only the link to your film, not the film itself.
Other retention periods:
| Data | Retention |
|---|---|
| Mobile number request limit fingerprint | 30 days, then removed automatically |
| Consent and operational audit records | As long as reasonably necessary to evidence consent, security, compliance and any applicable limitation period. These records do not retain the photograph, film or private viewing link. |
| Public source prospect, client and general business records | The period necessary for the relevant service, relationship, legal obligation, objection or suppression requirement, then securely deleted or anonymised |
13. International transfers
For Star In Your Car, your photograph and film are processed by Kie AI in the United States, and generation may involve onward processing by the model provider outside the United States. Section 7 explains the safeguard we rely on for that transfer: the UK International Data Transfer Agreement supported by a transfer risk assessment. Our storage provider, Cloudflare, is certified under the Data Privacy Framework, and we rely on the UK Extension to that framework for storage of your data. Where any other provider, group company or client processes personal data outside the United Kingdom, we use an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another valid safeguard. You can contact us for more information about the safeguards relevant to a particular transfer.
14. Cookies and similar technologies across our websites
Cookies are small files stored on your device. Similar technologies, such as local storage, can also remember information in your browser. This section is Lucidx Limited's general cookie policy for all the websites we operate.
The cookies and tools used vary by website. Necessary storage supports features you request, such as remembering privacy choices, signing in or completing a transaction where those features are available. Optional tools may measure visits, record website interactions or measure and improve advertising. On sites using these optional tools, the site's consent settings identify the providers and purposes available for you to choose. The presence of a provider in this policy does not mean it runs on every site.
These tools include Google Analytics for visit and interaction statistics, Microsoft Clarity for heatmaps and masked session replay, and Meta Pixel for Facebook and Instagram advertising measurement and audience matching. Their processing and privacy information are described below. Optional tracking described here requires your permission; browsing, scrolling, closing a notice or submitting an enquiry does not give that permission.
Use the consent controls on the website you visit to accept or reject optional tracking, choose individual categories, or change your preferences later. You can also contact us using Section 1. Rejecting optional tracking does not sign you out of a service or withdraw an enquiry you have submitted. A choice on one website or domain does not automatically apply to another. Consent storage names, durations and the location of preference controls depend on the site's implementation; details for Star In Your Car follow.
Star In Your Car: current cookies and tracking settings
The following configuration, storage table and event details apply specifically to star.lucidx.co.uk. They supplement the general cookie policy above.
Your choices
Use Accept all to allow the optional tools described in Settings and this policy, Reject all to keep optional tools off, or Settings to choose usage analytics, website insights and advertising separately. The Cookie settings link remains available in the footer of Star In Your Car so you can change or withdraw permission. Rejecting optional tracking does not prevent you from requesting or watching your film. Cookie permission is separate from consent to use your photograph, contact you about your enquiry, or send marketing messages.
We remember your choice in that browser for up to 180 days. We ask again after it expires, if you clear browser storage, or when a material change introduces a new purpose or provider requiring permission. Previous Google Analytics or Clarity permission does not authorise Meta Pixel. Adding Meta Pixel introduces a new advertising category, so we ask for a fresh choice. On withdrawal we stop the relevant tools, remove their accessible first-party cookies and, when needed, reload the page. Withdrawal does not undo processing already carried out. You can also delete cookies through your browser; we cannot directly remove cookies owned by another domain.
Usage analytics: Google Analytics
With your analytics permission, we use Google Analytics 4 to measure visits, selected actions and referral results. It processes browser and device information, cookie identifiers and usage events. Our Star In Your Car event configuration substitutes generic page labels for private film links and excludes names, contact details, uploaded photographs and private film identifiers from the events we send. Google advertising signals and advertising personalisation are disabled. We also use consented first-party interaction events to understand vehicle and scene selection. See Google's Privacy Policy and how Google uses information from sites that use its services.
Website insights: Microsoft Clarity
With your separate website insights permission, we use Microsoft Clarity to understand how visitors interact with the public Star In Your Car landing page and improve its usability. Clarity provides heatmaps and session replays using clicks, scrolling, page layout, browser/device information and pseudonymous identifiers. A session replay reconstructs interactions with the website; it is not a webcam or microphone recording. Microsoft receives and processes this usage information as explained in the Microsoft Privacy Statement.
We use strict content masking and additional masking on sensitive parts of the page. Recording stops before photo selection or contact entry. We do not load Clarity on private film, completion, shared-film, administration or dealer demonstration pages, or landing-page URLs containing query parameters or fragments when the tool would start. We do not pass photographs, contact details or private film identifiers as Clarity custom data. Microsoft advertising consent remains denied, and Microsoft Ads integration is not enabled.
Clarity normally retains playback data for 30 days. Heatmaps and click data, and certain sampled, labelled or favourite recordings, may be retained for up to nine months under Microsoft's retention rules. Cookie expiry and provider-held data retention are different: deleting a cookie does not itself delete previously collected reports. The Star In Your Car Google Analytics property retains event data for two months and user data for 14 months, with the user retention period reset by new activity. Most aggregated reports are not governed by those retention limits and may remain available longer. Contact us to exercise your rights.
Storage used on Star In Your Car
| Name / provider | Purpose and category | Lifetime |
|---|---|---|
siyc-cookie-consent-v3 — Lucidx local storage | Essential: remembers your selected categories, notice version and choice date | Valid for 180 days; replaced when you change your choice |
star-in-your-car-session — Lucidx local storage | Supports the film request journey; also associates optional first-party usage events only when analytics is permitted | Until you clear this site's browser storage |
siyc-referral-v1 — Lucidx local storage | Optional analytics: remembers a referral for attribution | 30 days; removed on analytics withdrawal. Without analytics permission, a referral may be held only in temporary page memory to handle the current journey. |
_ga and _ga_* — Google Analytics cookies | Optional analytics: distinguish browsers and sessions | Configured on Star In Your Car to expire after 30 days; may renew on a consented visit |
_clck — Microsoft Clarity cookie | Optional website insights: remembers the site's Clarity browser identifier and preferences | Normally up to one year; may renew on a consented visit |
_clsk — Microsoft Clarity cookie | Optional website insights: links activity within a session | Normally one day |
_fbp and, where an advertising-click identifier is available, _fbc — Meta Pixel cookies | Optional advertising: recognise a browser and associate a visit with a Facebook or Instagram ad click | Normally up to 90 days; may renew during consented use |
Meta may also use its own third-party cookies, such as fr (normally 90 days), depending on your browser and Meta account choices. See the Meta Cookies Policy.
Browser controls can shorten these lifetimes. Microsoft's cookie documentation also describes its third-party identifiers, including CLID, MUID, MR, SM and ANONCHK, whose use depends on browser behaviour and consent configuration. Star In Your Car sends Microsoft an analytics-only permission when website insights are enabled, with advertising storage denied. Necessary authentication storage may also be used when authorised staff sign in to the administration area; that area is excluded from our optional tracking.
Advertising: Meta Pixel
With your advertising permission, we use Meta Pixel to measure and improve Facebook and Instagram advertising and understand which visits result in a vehicle selection or successful film request. Our configured events are PageView (public landing-page visit), ViewContent (vehicle selection) and Lead (a film request accepted by our service). A Lead event does not mean a vehicle purchase or a completed film. Meta may associate the events with a Facebook or Instagram account and use the information for advertising measurement, personalisation and audience matching, as explained in the Meta Privacy Policy.
Information received by Meta can include your IP address, browser/device information, public page URL and referrer, cookie and advertising-click identifiers, event name and time, and the public vehicle model or general event category we supply. We disable automatic event configuration and do not supply contact information for advanced matching. We do not include your name, telephone number, photograph or private film link in event parameters. Meta Pixel is restricted to the public Star In Your Car landing page and recognised campaign URLs; it is excluded from administration, dealer demonstration, private film, completion and shared-film pages.
The advertising category is off until you choose it or select Accept all. You can withdraw permission through Cookie settings, which stops the Pixel and removes its accessible first-party cookies. Cookie acceptance does not sign you up for WhatsApp, SMS or other marketing messages, and is separate from the WhatsApp service used to deliver your requested film.
Meta uses the information under its Privacy Policy and Business Tools Terms, including applicable controller arrangements for collecting and transmitting event information. These documents explain Meta's own processing, retention criteria and your rights. Browser-cookie lifetimes listed above are separate from retention of previously received event information and advertising reports. You can contact us using Section 1 about the data we control, and use Meta's privacy controls for its own processing.
Google, Microsoft and Meta may process data outside the United Kingdom, including in the United States. The transfer arrangements described in Section 13 apply; you can ask us about the safeguards relevant to your data. Contact us using Section 1 if you have questions about cookies or wish to exercise your data protection rights.
15. Automated processing
We use technical automation to operate the service, create a requested visualisation, manage private result access, prevent duplicate or excessive requests, and maintain security. We do not use it for facial recognition, identity verification, behavioural scoring, profiling for eligibility, or solely automated decisions that have legal or similarly significant effects on you.
16. Your rights
Depending on the circumstances, you may have the right to:
| Right | What it means |
|---|---|
| Be informed | Know how and why we use personal data |
| Access | Request a copy of personal data we hold about you |
| Rectification | Ask us to correct inaccurate or incomplete data |
| Erasure | Ask us to delete personal data where the law applies |
| Restriction | Ask us to limit certain processing |
| Data portability | Receive certain data in a portable format where the law applies |
| Object | Object to processing based on legitimate interests and to direct marketing |
| Withdraw consent | Withdraw consent at any time where consent is our lawful basis |
| Complain | Raise a concern with us or the ICO |
To exercise a right, please contact us using Section 1. We may need to verify your identity before acting, and we will respond within the timescales required by applicable law. You can object to direct marketing at any time, and we will stop processing your data for direct marketing. We may keep a limited suppression record to ensure we respect that choice.
17. Registration
Lucidx Limited has applied to register with the Information Commissioner's Office, application reference C2021815.
18. Changes to this policy
We may update this policy when our services, providers, law or processing practices change. The current version will be published on our website with its effective date.
