- Home
- Legal
- Cookie statement
Cookie statement
In short: lumoheaven.com sets no cookies and loads nothing from third parties. The Lumo app only uses cookies it needs to work. Below, per part, is what gets stored, why and for how long. Last updated: 5 November 2026.
1. The website lumoheaven.com
The website sets no cookies and uses no local storage. It loads no analytics, no advertising pixels and no third-party scripts. Fonts, images and videos are on our own servers. That is why you see no cookie banner on this site.
When you request a trial workspace or contact through the form, or book a demo in the calendar, we send the details you fill in to Sales Surge, together with the page address and the page you came from. This happens without cookies. What we do with that data is described in the privacy statement.
2. Cookies in the Lumo app
The app only uses functional cookies. They are needed to sign in and to show the app in your own language. There are no analytics or advertising cookies.
| Topic | Purpose | Duration |
|---|---|---|
| surge_session | Keeps you signed in. Only readable by the server (HttpOnly), only over https. | At most 14 days after signing in. After 7 days without activity the session ends sooner. Signing out deletes it at once. |
| surge_locale | Remembers the language you choose. | 1 year |
| surge_portal | Keeps a customer signed in to the customer portal. Only readable by the server (HttpOnly). | 7 days after signing in, or until the customer signs out. |
Functional cookies need no consent, because the app does not work without them.
3. Local storage, fonts and video in the app
The app keeps a few display preferences in your browser's localStorage, such as the light or dark theme, the columns of a table and the chosen view of a list. They stay until you clear them in your browser. They are not sent to the server.
The app loads no third-party fonts. The Satoshi typeface is on our own server.
A workspace can put a Loom, YouTube or Vimeo video in a tour or guidance content. Such a video only loads once you click Load video. Until that click, no request goes to that party. After the click your browser loads the video from that party, which then receives your IP address and may set its own cookies under its own policy. YouTube plays through youtube-nocookie.com, YouTube's address for embedded videos in privacy-enhanced mode.
All parties are listed with purpose and location on the sub-processors page.
4. The chat widget and website tracking on a customer's site
Lumo customers can place the chat widget on their own website. The widget keeps the current conversation in the sessionStorage of the visitor's browser, under the name surge-chat with the chatbot's key. That storage disappears when the visitor closes the tab. The widget sets no cookies and uses no AI.
Customers can also place Lumo's website tracking on their site. It sets no cookies. If the site asks for consent (the default), the script only stores a visitor number (lumo_vid) in localStorage after consent. Under Do Not Track or Global Privacy Control it never stores anything.
The customer that uses the widget or the tracking is responsible for its own website. It mentions this storage in its own cookie statement.
5. Managing cookies
You can view, block and delete cookies and local storage in your browser. If you block the app's session cookie, you cannot sign in.
Send questions about cookies to info@sales-surge.nl. See also the privacy statement and the terms of use. How we secure Lumo otherwise is described under security and privacy.