Privacy Policy
Last updated 16 September 2026
Luxa is operated by Marceli Pawliński. This policy explains what data Luxa collects, why, and the choices you have.
Who is responsible
Marceli Pawliński is the data controller for Luxa. For any privacy question or request, contact support@marcelipawlinski.co.uk.
Data we collect
Account details you provide (name, email, and a password hash or the identifier from Google/GitHub if you sign in with them); the website URLs you add; monitoring results and audit findings for those sites; screenshots and generated reports; and billing records. Payment card details are handled entirely by Stripe and are never seen or stored by Luxa.
How we use your data
To run monitoring and audits on the sites you add, send transactional email (verification, alerts, receipts), operate billing, secure the service, and provide support. We do not sell your data or use it for advertising.
Fix with Claude and AI
Luxa does NOT send your website content to Anthropic or any AI provider. “Fix with Claude” prompts are generated deterministically on our own servers from the audit findings. You choose whether to paste a prompt into your own AI tool; that action happens outside Luxa.
What we don't retain
We do not keep long-term full copies of your website's HTML. Audits store the findings, limited evidence samples, and screenshots needed for your report.
Analytics
We keep a small amount of privacy-friendly first-party usage data (which pages and actions are used) that does not rely on tracking cookies. Separately, with your consent, we use Google Analytics 4 to understand site usage; it loads only after you accept in the cookie banner, IP addresses are anonymised, and you can decline or withdraw consent at any time.
Lawful bases
We process account, monitoring, audit and billing data to perform our contract with you; transactional email and security processing on the basis of legitimate interests; and we rely on your consent for any optional communications.
Processors
We use a small set of providers to run the service. See the Subprocessors page for the current list and what each one processes.
Retention
Account and site data are kept while your account is active. When you delete your account, your sites, screenshots and reports are removed and monitoring stops. Billing records are retained only as long as required for tax and accounting. Operational logs are short-lived.
Your rights
You can export your data and permanently delete your account at any time from Settings. Depending on your location you may also have rights to access, correct, restrict or object to processing, and to lodge a complaint with your local data-protection authority.
International processing
Our providers may process data in the UK, EU and US under appropriate safeguards. See Subprocessors for detail.
Contact
Questions or requests: support@marcelipawlinski.co.uk.