What happens to your data

Who is responsible

Juke Lucid, a two-person music project based in London. We are the data controller for this website. The contact address for anything on this page is jukelucid@gmail.com.

What is collected

When you use the contact form

Your name, email address, the enquiry type you pick and whatever you write in the message. Those four things are put into an email and sent to us, along with two the form adds by itself: the time you sent it, and the two-letter country code Cloudflare works out from your IP address. Your IP address itself is not included. None of it is written to a database, because there is no database — this site is a set of files with no storage behind it.

Please don’t put anything confidential in it; it travels by ordinary email like any other message.

When you simply read the site

If you decline the cookie banner, or ignore it, we learn nothing about you as an individual, and neither does Google — because nothing of Google’s is loaded. Most sites that ask this question still load Google Tag Manager on every page and rely on it to hold its own tags back. This one does not load it at all until you accept analytics, so declining or ignoring the banner means no request leaves this page to any other company for your whole visit.

One thing happens either way, and it does not depend on your answer: Cloudflare, which serves the site, keeps request logs containing your IP address as part of running and protecting it.

The one deliberate exception is the contact page, and it is still under your control: the Cloudflare Turnstile spam check is not fetched when the page loads, only when you first click into the form. Reading that page costs nothing; starting to write to us loads the check that stops the form being used by bots.

Cookies

Nothing that needs your consent is set before you give it.

• jl_consent — set by this site, remembers the answer you gave the banner so it does not have to ask again. Six months. Strictly necessary: without it, a refusal could not be recorded.
• _ga, _ga_* — Google Analytics. Distinguishes one visitor from another so page counts are not nonsense. Up to two years. Only set if you accept analytics.
• Cloudflare Turnstile — the spam check on the contact form may set a short-lived token while it runs. Strictly necessary, and it does not follow you to other sites.

Changing your mind. Reopen the panel from the “Cookies” link in the footer of any page and switch the group off. Cookies already set by a group you switch off are deleted.

There is no advertising on this site, and no advertising cookie is set whatever you choose. If that ever changes we will ask you again first rather than reading a yes given today as covering it.

The Spotify and YouTube players

This is the part most music sites get wrong, so it is worth being plain about. The players on Listen and Watch are not loaded until you press play. Until you do, what you are looking at is an image we host, and neither Spotify nor YouTube receives a request from this page — so neither of them can set a cookie or know you were here.

Pressing play loads that company’s player and hands you over to their cookies and their policy, which we do not control. The YouTube embeds use youtube-nocookie.com, which defers YouTube’s own tracking cookies until playback actually starts, but it is still their player and their rules from that point on. See Spotify’s privacy policy and Google’s privacy policy.

This is why there is no on/off switch for them in the cookie panel. The click is the switch.

Why, and on what legal basis

The contact form. Legitimate interests — you have written to us and we would like to write back. Nothing else is done with the address.

Analytics. Consent, which you give or refuse in the banner and can withdraw at any time. Nothing is measured until you say yes, as set out under Cookies above.

Security and delivery. Legitimate interests — serving the site and keeping bots off the form.

Who else touches it

• Cloudflare — hosts the site and runs the spam check. Sees requests and IP addresses.
• Resend — delivers the contact form email. Sees the contents of that email in transit.
• Google — Analytics and Tag Manager, only if you accept. Google is the one name on this page we cannot honestly describe as a processor acting only on our instructions, which is precisely why it sits behind consent and why declining costs you nothing here.

Nothing is sold, and nothing is added to a mailing list — there is no mailing list.

Transfers outside the UK. All three are US companies and process data outside the UK, under the UK extension to the EU–US Data Privacy Framework or standard contractual clauses. Listed for completeness rather than because it is likely to affect you.

How long it is kept

Contact form emails stay in the inbox unless you ask us to delete them; enquiries have a habit of resurfacing a year later and it is useful to have the history. Ask and it goes.

Google Analytics is set to delete user-level data after 14 months, and we only ever see it in aggregate. Cloudflare’s request logs are kept on their own schedule as part of running the service.

Your rights

Under UK GDPR you can ask for a copy of what we hold, ask for it to be corrected or deleted, object to it being processed, or ask us to restrict what we do with it. For this site that almost always means one email in an inbox. Write to jukelucid@gmail.com and we will deal with it within a month.

If you are not happy with how we have handled it, you can complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk.

Changes

If this notice changes materially, the date below changes with it. There is no archive of previous versions; if that matters to you, save a copy.

Last updated: 1 September 2026