How Lutra Labs handles personal data across this website and our products.
Last updated: August 2026
Lutra Labs d.o.o., Cesta XIV. divizije 20A, 2000 Maribor, Slovenia. Email: info@lutralabs.io.
When you use the contact form, we process the name, email address, message, and the "how did you hear about us" value that you provide. We do not use advertising trackers and we do not build profiles of visitors. We do count page views, using analytics we run ourselves — see "Analytics" below.
Solely to respond to your inquiry and to follow up about a potential collaboration. The legal basis is our legitimate interest in answering messages and taking steps at your request prior to a possible contract.
Resend — delivers contact-form emails on our behalf.
Cloudflare Turnstile — protects the form from bots by processing technical signals to verify you are human.
Hetzner Online GmbH (Nuremberg, Germany) — rents us the servers this website, its analytics, and our other services run on.
Our self-hosted infrastructure briefly stores your IP address to rate-limit the form and prevent abuse.
We count page views with Umami, an open-source analytics tool that we run ourselves at umami.lutralabs.io. There is no Google Analytics and no third-party tracking script here: the measurements go to our own server and are never shared, sold, or combined with data held by anyone else.
Nothing is stored on your device. Umami sets no cookies and writes nothing to local or session storage, and it does not fingerprint your browser. Because it neither stores nor reads information on your device for this purpose, no consent is required for it under the ePrivacy rules as transposed in Slovenia by the Electronic Communications Act (ZEKom-2) — which is why this site shows you no cookie banner.
Per page view we record the address and title of the page, the referring address, the site identifier, your screen size, and your browser language. From your IP address our server additionally derives your browser, operating system, device type, and approximate location (country, region, city), and then discards the address. Your IP address is never written to our database.
So that returning visits within one day are not counted twice, our server computes a one-way hash from your IP address, your browser's user-agent string, and a secret value that is replaced every 24 hours. The hash cannot be reversed, and because the secret changes daily the same person cannot be recognised from one day to the next. We build no profiles and do not follow you to other websites.
The legal basis is our legitimate interest under Article 6(1)(f) GDPR in knowing which pages are read and whether this site reaches the audience it is written for. We consider that proportionate: the data is coarse and pseudonymous, nothing is placed on your device, nothing leaves our own infrastructure, no advertising audiences are built, and the measurement can be switched off in one step. You may object at any time under Article 21 GDPR.
Where and how long: the analytics service and its database run on our own servers in Nuremberg, Germany, and no analytics data is transferred outside the EU/EEA. Records are deleted automatically after 14 months. To opt out, the tracker honours the browser "Do Not Track" setting; you can also disable it permanently in this browser by running localStorage.setItem('umami.disabled', 1) in the developer console, or block umami.lutralabs.io in a content blocker. The site works identically either way. Questions or objections: info@lutralabs.io.
For our products that offer paid plans (currently LutraID), payments are handled by Stripe Payments Europe, Limited ("Stripe") as our payment service provider. When you subscribe to a paid plan, your card and payment details are entered directly into Stripe's secure checkout and processed by Stripe — Lutra Labs never receives or stores your full card number, security code, or bank credentials.
To manage your subscription and issue invoices, we store the billing identifiers and metadata that Stripe returns to us: a Stripe customer and subscription identifier, your plan, subscription status, billing period, seat count, trial usage, usage and overage counts, and the billing name, email, and any billing or tax details (such as an address or VAT ID) you provide for invoicing. Card data itself always remains with Stripe.
Legal basis: performance of the contract for the paid service (Art. 6(1)(b) GDPR) and compliance with our accounting and tax obligations (Art. 6(1)(c) GDPR). Stripe also acts as an independent controller for its own fraud-prevention and regulatory purposes; see Stripe's privacy policy at https://stripe.com/privacy.
Invoices and accounting records are retained for the period required by Slovenian tax and accounting law (generally up to 10 years). Other billing metadata is deleted after your account is closed.
We keep inquiry emails for as long as needed to handle your request and for up to 24 months afterwards, then delete them. Billing records are retained as described under "Payments and billing".
Some processors may process data outside the EU/EEA under appropriate safeguards such as the EU Standard Contractual Clauses. Analytics is not among them: it runs on our own servers in Germany and stays inside the EU/EEA.
You may request access to, correction, deletion, restriction, or portability of your data, and object to processing, by emailing info@lutralabs.io. You may also lodge a complaint with the Slovenian Information Commissioner (Informacijski pooblaščenec).