Cookie Policy
This Cookie Policy explains which cookies and similar storage technologies Lumaa uses on lumaa.ai and the Lumaa CRM dashboard, why we use them, and how you can control them. It complements our Privacy Policy.
What is a cookie?
A cookie is a small text file a website stores in your browser. Cookies can be "first-party" (set by the site you visit) or "third-party" (set by another domain). They expire either when you close the browser ("session cookies") or after a fixed period ("persistent cookies").
Cookies we use
Strictly necessary (always on)
| Name | Purpose | Type / Lifetime |
|---|---|---|
lumaa_crm_session | Authenticates you to the Lumaa CRM. Without it, the dashboard cannot work. | HttpOnly, Secure, SameSite=Lax. 30 days. |
lumaa_session | Authenticates the marketing-site admin area. | HttpOnly, Secure, SameSite=Lax. 30 days. |
lumaa_cookie_consent | Remembers your cookie banner preference so we don't ask again. | First-party. 12 months. |
Local storage
The CRM uses the browser's localStorage to remember the last-viewed page (lumaa_last_page). This is cleared when you log out or clear site data.
Third-party / tracking
We do not use third-party tracking, advertising, or analytics cookies. Page-load data is not shared with Google Analytics, Meta, or any ad network.
We run our own first-party, privacy-friendly visit analytics. To count return visits and understand which pages and sections are useful, the site stores two random identifiers in your browser's localStorage: lumaa_vid (a visitor identifier that persists across visits) and lumaa_sess (a visit identifier that expires after 30 minutes of inactivity). They contain no name, contact details or other directly identifying data, and are never shared with third parties. The server records the page viewed, the referring site, the time spent on each section, scroll depth, device type and a one-way hash of your IP address and browser signature; raw IP addresses and user-agent strings are not stored with your visit; a raw IP is kept only when a submission is blocked as spam, to prevent abuse. If you choose "Decline non-essential" on the banner, the visitor identifier is not persisted between visits.
Your choices
- Banner choice: the first time you visit, a banner offers Accept / Decline. Strictly-necessary cookies are set regardless because the site cannot function without them; our own first-party analytics runs by default and sends nothing to third parties; choosing Decline non-essential stops the persistent visitor identifier, so your visits are no longer linked together.
- Browser settings: all major browsers let you block or delete cookies. Blocking the session cookie will log you out of the CRM.
- Withdrawing consent: clear your cookies for lumaa.ai and you'll see the banner again on next visit.
UAE PDPL basis
Strictly-necessary cookies are processed under contract performance (UAE PDPL Art. 4) — without them, the Service cannot be delivered. Our first-party analytics identifiers are processed under legitimate interest (PDPL Art. 4), with the Decline option described above. Should we ever introduce third-party or advertising cookies, they will be processed under consent (PDPL Art. 4(1)) collected via the cookie banner before the cookie is set.
Changes
If we add new cookies or change purposes, we update this page and re-prompt the banner. The "Effective" date at the top reflects the latest revision.
Contact
Questions: leave your details on our contact form and we will come back on WhatsApp.