Privacy & Cookie Policy

Version 2.1 · Last updated: 14 May 2026

Lange Software Solutions ("we", "us", "our") is a sole-trader software consultancy based in Edinburgh, Scotland, run by Hubert Lange. We operate the website at langesoftware.com and the LUCY chat-assistant platform installed on customer sites. This policy explains what personal data we collect, why, who we share it with, how long we keep it, and the rights you have — under the UK GDPR, the EU GDPR, the UK Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), and US state privacy laws including the California Consumer Privacy Act (CCPA/CPRA).

1. Who is the data controller?

Lange Software Solutions, Edinburgh, Scotland, United Kingdom.
Contact: hubert@langesoftware.com
ICO registration number: ZC147184 (verify on the ICO register)

For data you submit through langesoftware.com (the contact form, the public LUCY demo), we are the data controller. For data processed inside a customer's own LUCY installation — bookings, customer records, chat logs belonging to that business — the customer business is the controller and we act as their data processor under a written processing agreement.

2. What data we collect

On langesoftware.com

• Name & email — only if you submit the contact form or leave details with the LUCY demo bot. Used to reply to your enquiry.
• Phone number — only if you choose to provide it for a callback.
• Chat messages — your conversation with the public LUCY demo bot, stored to improve the service. Please don't enter sensitive personal information into the chat.
• Anonymous usage data — Vercel Analytics records page paths and referrers, with IP addresses hashed and discarded after a short window. No cross-site tracking, no advertising profiles.
• Technical data — server logs briefly record a coarse IP and user-agent for security and abuse-prevention (rate limiting). These are not used to identify you and are not retained long-term.

On customer sites running LUCY

• Chat messages — stored against the customer's tenant in our database, used only to operate and improve responses for that tenant.
• Booking details — name, contact details, appointment time. Visible only to the workshop/salon/clinic owner who runs that LUCY installation.
• Vehicle registrations (garage tenants) — passed to the DVLA Vehicle Enquiry API for lookup. Not shared with third parties beyond that government API.

3. Purposes and legal bases

Under the UK GDPR and EU GDPR, every use of your data has a defined purpose and legal basis:

You can object to processing based on legitimate interest, or withdraw consent for analytics, at any time — see section 11.

4. Cookies and similar technologies

In line with PECR and the GDPR, we ask for your choice before setting any non-essential cookie. The cookie banner lets you accept all, reject optional, or pick categories — rejecting is exactly as easy as accepting, and is the default if you ignore the banner. Your choice is stored in localStorage as lss-cookie-consent. You can change it at any time via the "Cookie preferences" link in the site footer.

5. Sub-processors we share data with

We do not sell your personal data and we never have. We share it only with the service providers below, each bound by a data processing agreement and appropriate safeguards:

Anthropic does not train its models on API customer data by default. If we add or change a sub-processor, we will update this table.

6. International data transfers

Some of our sub-processors are based in the United States. Where personal data is transferred outside the UK or the European Economic Area, we rely on appropriate safeguards:

• UK transfers — the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses.
• EU/EEA transfers — the EU Standard Contractual Clauses, and the EU–US Data Privacy Framework where the recipient is certified.

You can request a copy of the relevant safeguard by emailing us.

7. How long we keep data

• Public LUCY demo chat messages: up to 90 days
• Contact-form and enquiry submissions: until the matter is resolved + 12 months
• Booking records: until the booking date + 12 months for accounting
• Billing and tax records: 6 years, as required by HMRC
• Server / security logs: short-lived, not retained long-term
• Cookies and local storage: per the table in section 4

8. Your rights (UK & EU GDPR)

If you are in the UK or the EEA, you have the right to:

• Be informed about how your data is used (this policy)
• Access the personal data we hold about you
• Have inaccurate data corrected
• Have your data erased ("right to be forgotten"), where applicable
• Restrict or object to processing, including processing based on legitimate interest
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time, without affecting prior processing
• Lodge a complaint with a supervisory authority — in the UK, the Information Commissioner's Office (ICO); in the EEA, your national data protection authority

9. Your rights (California & other US states)

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas or Oregon, applicable state privacy laws (including the CCPA as amended by the CPRA) give you the right to:

• Know what personal information we collect about you and how it is used
• Access and obtain a copy of that information
• Delete the personal information we hold about you, subject to legal exceptions
• Correct inaccurate personal information
• Portability — receive your information in a portable format
• Non-discrimination — we will not deny service, charge a different price, or provide a different quality of service because you exercised these rights
• Opt out of any "sale" or "sharing" of personal information for targeted advertising

10. Children's privacy

Our website and services are intended for businesses and adults. We do not knowingly collect personal information from children under 13 (in line with the US Children's Online Privacy Protection Act, COPPA) or, in the UK/EU, from children below the applicable age of digital consent. If you believe a child has provided us with personal data, contact us at hubert@langesoftware.com and we will delete it promptly.

11. How to exercise your rights

To make any request — access, deletion, correction, portability, objection, or to withdraw consent — submit it through our data request form, or email hubert@langesoftware.com. We respond to all verified requests within 30 days (UK/EU GDPR) or 45 days (US state laws), and we'll never charge you for a reasonable request. We may need to verify your identity before acting, to protect your data from someone else requesting it.

Requests submitted through the form are logged and sent to us securely — they are not actioned automatically, so your data can't be exported or deleted by anyone impersonating you. A human reviews and verifies every request.

12. Changes to this policy

If we change anything material, we'll update the version number and "Last updated" date at the top, and re-prompt you for cookie consent if the cookie categories change.

Terms of Service DMCA / Copyright Home

Lange Software Solutions · Edinburgh, Scotland · This is a sole-trader software consultancy. UK Companies House registration is in progress; until incorporation, the legal entity is the sole trader Hubert Lange.