Privacy notice
Last updated: 29 September 2026
About this translation
Who is responsible for your data
The controller of the personal data processed on scamalert.lumosstudio.ro is Lumos Studio, individual (not yet registered as a business), at Roman, Neamț County, Romania. Email: hello@lumosstudio.ro.
You can write to the address above at any time with any question about your data.
What we process, why, and for how long
We only process the data we need. The table below lists all of it.
| Activity | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Hosting and security | IP address, browser type, requested page, date and time | delivering the site, security and preventing abuse | legitimate interest (Art. 6(1)(f) GDPR) | a short period set by the hosting provider |
| Emails you send us | your name, email address and the message | replying to your message | legitimate interest (Art. 6(1)(f)) or steps before a contract (Art. 6(1)(b)) | for the conversation and up to 24 months after the last message |
| The checker | the text, phone number or link you paste | calculating the verdict; the content is analysed on the spot and is not saved | your request, to provide you the service (Art. 6(1)(b) GDPR) | not kept |
| Scam reports | the type of report and the text you send, with card numbers, IBANs, personal ID numbers, email addresses and one-time codes masked before saving; we automatically extract phone numbers and domains from the text; we also keep a keyed hash of your internet address, not the address itself, so the same person is counted once. We do not ask for a name, email or other contact details | counting the different people who reported a number or a domain; a team member checks before a number or domain can change other users' verdicts; reports are not published. If a number or domain was confirmed by mistake, write to us and we remove it | legitimate interest in preventing fraud (Art. 6(1)(f) GDPR) | the report text and the hash, 12 months; the counter of an unconfirmed number, 24 months after the last report; a number or domain confirmed by the team, while it stays active or until you ask for removal |
| Abuse limiting | the IP address, held in the server's memory (for checks) and, only as a keyed hash, in a counter in the database (for reports) | limiting the number of checks per minute and of reports per hour and per day | legitimate interest (Art. 6(1)(f) GDPR) | checks: at most one minute, in memory only; reports: the counter is deleted after at most 24 hours |
We do not sell your data and do not use it for advertising or profiling.
Who receives your data
We use providers that process data on our behalf under data processing agreements. We do not pass your data to anyone else unless the law requires it.
| Provider | What it does | Where | Their policy |
|---|---|---|---|
| Vercel Inc. | website hosting and delivery | USA (with EU data centres where available) | https://vercel.com/legal/privacy-policy |
Transfers outside the European Economic Area
Some providers are outside the EEA. Transfers rely on the EU–US Data Privacy Framework (for certified providers) and/or the standard contractual clauses approved by the European Commission. You can ask us for a copy of the safeguards.
Cookies and browser storage
The details are on the cookies and storage page.
Your rights
You have the right to:
- find out what data we hold about you and get a copy (access);
- have incorrect data corrected;
- have your data erased (the “right to be forgotten”);
- restrict how we use your data;
- receive your data in a common format and pass it to someone else (portability), where we process it under a contract or consent;
- object to processing based on legitimate interest;
- withdraw consent at any time, without affecting what happened before.
Write to hello@lumosstudio.ro. We reply within one month at most. We may ask for proof of identity so we do not hand your data to an impostor.
If you are not satisfied
You have the right to lodge a complaint with the supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, cod poștal 010336, București, https://www.dataprotection.ro, anspdcp@dataprotection.ro. We would appreciate the chance to fix the problem first.
Security
We use encrypted connections (HTTPS), limit access to data and choose providers with recognised security measures. No method is 100% safe; if an incident affects you, we will tell you and the authority where the law requires it.
Changes
When we change how we process data, we update this page and the date above.