Who handles your information
Lucid Growth Media is the public brand of LucidGrowth Media Private Limited. We decide how information collected through this website is used. Our office address is WeWork Embassy TechVillage, Block L, Devarabisanahalli, Outer Ring Rd, Bellandur, Bangalore, Karnataka 560103, India. Our CIN is U74999KA2023PTC170135 and GSTIN is 29AAFCL2951D1ZK.
This notice covers the public website and its forms. Client projects may have separate notices and agreements. When we handle data on a client's documented instructions, the client remains responsible for its purposes, notices and lawful instructions. We remain responsible for our own duties.
Enquiries and newsletter requests
The enquiry form requires your name, email, organisation, phone number, selected phone country, requested services and project details. You can select more than one service. The form also asks about timing. We use these details to assess and answer your request, contact you about it, prepare a proposal and keep the related correspondence. You can browse without submitting the form or contact us by email if you prefer.
Sending an enquiry does not subscribe you to marketing, permit AI model training or create a paid engagement. It does not automatically create a confidentiality agreement. Any confidentiality duties that already apply under law or an existing agreement remain in place.
The newsletter form asks for an email address, then first and last names. We store a request only after the final submission with your affirmative subscription choice. Entering an email at the first step does not submit it. We record the submission time and relevant notice or consent version.
A newsletter request does not mean the address has been verified. We have not connected an email delivery provider, and the form does not send a welcome email. Before newsletters are sent, we will select a provider, update this notice where needed and verify the address and permission as appropriate.
Do not submit passwords, card details, identity documents, health records, children's information or confidential client datasets. Share only information you are entitled to provide. The forms do not accept file uploads or send their contents to an AI model.
Your privacy choice and its record
Privacy choices in the footer lets you control first-party analytics and YouTube media independently. It shows separate external analytics, session-recording and advertising measurement and retargeting choices only when those features are actually enabled. Essential security and enquiry functions remain available whichever optional choices you make. Separate identifier-free page-request totals are described below and do not depend on an optional grant.
The signed preference cookie remembers the choice on this browser for up to 180 days. We retain an earlier rejection. An earlier first-party analytics or media grant does not turn on new external analytics, recordings or advertising. We ask for a fresh choice where a new purpose requires it. A cleared, expired or invalid cookie does not permit optional collection; another browser or device has its own choice.
When you save, we store random browser and record references, your decision, each permitted category, the notice version, time and expiry, bounded User-Agent information and browser language. We also store a keyed HMAC derived from the request IP address for abuse prevention and evidence of the choice. Our consent table does not store the readable IP address. Cloudflare separately processes technical data for its network and security services.
Reading the banner without acting does not create an acceptance record or a new browser reference. Optional device signatures, their page counts and the automatic aggregate counter are separate from the essential choice evidence.
If you later submit an enquiry or newsletter request from this browser, its record can reference the saved privacy choice. That may associate information you provide with previously permitted first-party website activity. We do not discover an email address merely because you browse. Optional-feature consent is not newsletter permission or acceptance of a paid service contract.
Use Privacy choices at any time to stop future optional collection. Rejecting media removes a loaded player and prevents new player loading unless you change that choice. Other open tabs receive an invalidation where supported and recheck the server; browser privacy controls can also keep optional features off. Withdrawal cannot recall information already received by an external provider.
If a choice cannot be saved or confirmed, optional features stay off in that tab and an error asks you to retry. A denial-only marker in session storage helps preserve that protection through a reload; it is not an alternative acceptance record or advertising identifier. The previous saved choice may still exist on the server or in another browser. Clearing storage does not delete a database record, erase an enquiry or withdraw a newsletter request; contact us or use the relevant preference route.
Technical data and who can receive it
Cloudflare provides the network, website hosting and D1 database. It processes technical information needed to deliver and protect the site, which can include IP addresses, request times, URLs, browser details and security signals. The contact form uses Cloudflare Turnstile. The newsletter form has no CAPTCHA but uses server-side abuse checks.
Our application uses short-lived counters derived from IP addresses to limit abuse. Rejected form payloads are not saved as enquiry or newsletter records. These counters are separate from Cloudflare's traffic and security logs.
The automatic request totals and optional first-party device measurement are described separately below. We do not sell enquiry or newsletter information. Google Analytics 4 uses the external-analytics choice and Microsoft Clarity uses the separate session-recording choice. The advertising choice can govern consent-gated Meta Pixel, Google Ads, Microsoft UET, LinkedIn Insight Tag, X Pixel and Reddit Pixel integrations. Google Tag Manager may deliver a named integration only when its required public identifier and reviewed tag are both configured and enabled; naming a supported provider does not mean it received a visit or conversion. Optional media has its own choice. Optional YouTube videos require permission and a separate Load video action.
Authorised staff and service providers can access information needed for their role, subject to appropriate access and confidentiality controls. We may share necessary information with professional advisers or authorities when lawfully required, or to protect rights and security. Enquiries are not published on the website.
Automatic page-request totals
We automatically count eligible requests for selected public business pages to understand broad website use. The counter stores only a UTC date, one of 16 fixed page-path buckets and a total. It does not set a cookie or retain a visitor or session ID, IP address, User-Agent, device signature, privacy-choice reference, query string, referrer or form content.
The same counter operates whether optional features are unknown, allowed or rejected. It is separate from the optional first-party device measurement below and cannot join its totals to a person, enquiry or newsletter record. We do not send these totals to advertising platforms.
Only eligible successful HTML document requests on our production website count. We exclude Contact, confirmation, legal and policy pages, individual guides, political content, newsletter preferences, APIs, assets, error pages, previews and detected bots or prefetches. Request headers are checked for this exclusion without being stored by the counter. URL query values do not become reporting dimensions.
These are limited request totals, not unique people, sessions, complete pageviews or accepted enquiries. Browser behavior, exclusions and interrupted requests can affect the counts. We retain at most 90 UTC date buckets, including today. Cloudflare operational traffic and security processing is separate and is described elsewhere in this notice.
Optional analytics and limited device fingerprint
When you allow optional analytics, we count visits to selected general business pages to understand website use and improve content. The browser sends the page path without query parameters, browser-platform information, preferred language, time-zone name and a broad viewport size group. The server also receives the normal User-Agent header. It reduces these to browser family, platform family, primary language, broad time-zone region and small, medium or large viewport before creating a keyed HMAC device signature.
The signature is a limited, pseudonymous device fingerprint. Its calculation changes each calendar month; different people can share a signature and one device can produce different signatures. It is not a verified identity, fraud verdict or guarantee of anonymity. We do not collect canvas or audio fingerprints, font inventories, deep hardware identifiers, exact location, query strings, referrers, form contents or keystrokes for this measurement.
Our database stores the day, allowed page path, random browser reference, device signature, applicable privacy-choice reference, count and latest event time. These are first-party records in Cloudflare D1; they are not sent to an advertising platform. The metric record does not store the raw fingerprint inputs or a readable IP address. Consent evidence separately includes bounded User-Agent and language information as described above.
The measurement endpoint accepts a fixed list of general agency and service pages. It excludes contact forms, newsletter preferences, legal pages, individual guides and political/public-communications pages. We do not build political-interest or sensitive-interest profiles from these visits.
If you later provide your name or email through an enquiry or newsletter request, its saved privacy-choice reference can connect that record with the opted-in website activity. This helps us understand the content viewed before a request. We do not infer an email address from your device signature, and browsing never subscribes you to communications.
This measurement sets no separate advertising or analytics cookie. It still relies on the essential signed preference cookie to verify permission and associate the browser. Clearing that cookie disables measurement until a new affirmative choice; we do not use the fingerprint to restore a deleted identifier or bypass rejection. This is limited first-party measurement, not a complete customer data platform.
Use Privacy choices to turn analytics off independently of videos. Existing metric records expire after 90 days without another recorded visit to the same daily record, unless limited records must be preserved for a documented legal duty. Contact legal@lucidgrowthmedia.com about access or deletion. Withdrawal stops future collection but does not make earlier lawful collection unlawful.
Optional Google Analytics
If you allow external analytics, Google receives technical connection information, including your IP address, and uses browser identifiers to measure visits across the 43 public canonical sitemap pages and selected service or social-link clicks. We send an approved page path, fixed event labels and a validated page location. We do not send names, emails, phone numbers, project messages, enquiry references, consent references or our first-party device signature to Google Analytics.
We use Basic blocking: Google Analytics does not load before external-analytics permission or after rejection. Error, unknown, newsletter-preference and ordinary confirmation pages remain excluded. If an already measured document moves to one of those excluded locations without a full page load, we deny the running optional tools, clear supported first-party vendor cookies and replace the document so the tools do not continue on that location. A canonical page may retain a bounded campaign query with no more than 12 unique keys and 1,500 decoded characters. Any reviewed UTM key may appear independently, and its value may use ordinary letter case, spaces, hyphens, underscores and full stops. The allowed advertising identifiers are gclid, dclid, gbraid, wbraid, msclkid, fbclid, li_fat_id, twclid and rdt_cid. Duplicate, unknown, control-character, email-like, URL-like, fragment and oversized values fail closed. Google Analytics receives the validated UTM values and Google identifiers only; non-Google click identifiers are not copied into its page location. For our custom Analytics referrer field, an approved same-site referrer may retain its canonical path, while an approved cross-site referrer is reduced to its origin only; queries and fragments are not included. The protected confirmation route sends no automatic page view. A later grant does not replay an earlier enquiry. An accepted-enquiry event is eligible only through the protected one-time receipt path and a separately enabled GA4 tag; eligibility is not evidence that Google received or reported it.
Enhanced Measurement, Google Signals, user-provided data, granular location/device collection and advertising personalization are disabled. We do not configure User-ID, remarketing audiences or customer matching. Google can still create its standard session and engagement events on an eligible page after permission and process normal technical data needed for Analytics; these settings do not make every provider request anonymous.
The GA4 property is configured for the maximum 14-month event-level and user-level retention offered by our standard account. New permitted activity resets the user-data retention period. A longer report history does not guarantee that a browser remains identifiable or eligible for advertising. Aggregated reports can have different retention. Google is a separate service provider; its privacy information explains its processing and international transfers. You can stop future collection using Privacy choices. Withdrawal cannot recall data already received.
Optional Microsoft Clarity recordings
If you allow session recordings, Microsoft Clarity can collect interaction and technical data on approved canonical pages other than political or public-communications content to help us improve navigation and usability. This can include pointer movements, clicks, scrolling, screen layout, browser identifiers, connection information and masked page content. Strict masking remains required on Contact and other pages that can contain entered or private information. Microsoft receives normal network information, including your IP address. This is a separate purpose from Google Analytics and advertising.
We configure Strict masking, additional masking for forms and editable fields, and explicit masking of the newsletter and privacy controls. We do not supply names, emails, phone numbers, form messages, customer IDs or custom identity tags to Clarity. The eligible set covers 40 canonical business, content, Contact and governance pages, including individual guides and policy pages. It excludes the three political or public-communications routes, confirmation and newsletter-preference pages, error and unknown routes. Clarity may run on a clean or validated UTM-only canonical URL, but it is held off when any advertising click identifier is present because its current tag cannot receive our sanitized page-location override. Recording starts only after a current recording grant; refusing that purpose prevents the Clarity script from loading.
Clarity uses its normal provider-managed browser and session cookies after recording permission. Its advertising storage remains denied and advertising-account integrations are not connected. It is a usability tool here, not a customer list for retargeting. Changing or withdrawing the recording choice stops dispatch and replaces the current document so the previous recording script cannot continue on the new page.
Microsoft currently retains ordinary playback data for 30 days, and heatmaps, click data and labeled or favorited sessions for up to nine months. These are Clarity’s fixed service limits; there is no unlimited-retention setting on this project. Our use of a longer supported period does not make any recording permanent. Microsoft’s Clarity privacy and retention information applies to its processing and international transfers.
Optional advertising measurement and retargeting
If you allow advertising measurement and retargeting, a configured Meta Pixel, Google Ads tag, Microsoft UET tag, LinkedIn Insight Tag, X Pixel or Reddit Pixel can receive approved canonical page visits to measure advertising and maintain website-visitor audiences. Each provider remains independently disabled when its required identifier or reviewed Google Tag Manager tag is missing. An eligible, server-confirmed commercial enquiry can also offer one conversion event only to providers with a separately configured conversion path. Source eligibility or a browser request is not provider-side confirmation that an event was processed or reported.
Providers receive normal connection data such as IP address and browser information, and may recognise identifiers or cookies they are permitted to use. We send an approved event name and, for a confirmed enquiry, a separate random conversion identifier to reduce duplicate counting. We do not send your name, email, phone number, organisation, message, receipt reference, privacy-choice reference or first-party device signature. Automatic email and phone matching and additional automatic form-content collection are disabled or excluded by the implementation.
These tools may run on approved business pages, content pages, individual guides and Contact only after advertising permission. They do not run on governance pages such as Privacy, policies, Trust or Sitemap; political or public-communications content; newsletter preferences; error pages; or unknown routes. We do not create political-interest or sensitive-interest audiences. The confirmation event is available only when advertising was permitted at submission and is still permitted; a direct visit, failed form or repeated refresh does not create a new conversion.
We use the longest supported website-audience membership period where an enabled platform provides that setting. The period and any refresh depend on the platform, a further eligible visit, an available identifier and current permission. Audience membership, report retention, cookie expiration and an ad-attribution window are different limits. None promises that a visitor remains reachable indefinitely. Browsers, deletion requests and platform rules may shorten availability. The current provider settings are maintained in our tracking inventory.
Use Privacy choices to refuse or withdraw this purpose. Earlier measurement permission is not reused as permission for the expanded retargeting purpose. A policy update, enquiry submission or newsletter request does not grant advertising permission. Withdrawal stops future collection from this browser but cannot recall an event already received; contact legal@lucidgrowthmedia.com for applicable access or deletion requests.
Purposes and optional tracking
We use the minimum information needed to answer enquiries, administer requested services, record newsletter choices, prevent abuse and meet legal obligations. Where a law requires a specific legal basis, we assess the activity under that law: for example consent for optional marketing, steps requested before a contract, legal duties or a permitted legitimate interest for proportionate security. These are not interchangeable permissions for unrelated uses.
Automatic page-request totals do not use an identifier or optional consent reference. First-party device measurement remains off until you permit that purpose. External analytics, recordings and advertising are not activated merely because technical integration code is present. Before a provider or a new purpose is enabled, we must identify the actual recipient, data, retention and controls, and obtain a fresh choice where required. Server-side or cookieless technology does not remove notice or consent duties.
An enquiry, newsletter request, acceptance of website terms or continued browsing is not blanket consent to tracking, profiling, sale of personal information or new marketing channels. We do not place form contents, phone numbers or email addresses in advertising tags or page URLs.
If the business is reorganised or transferred, necessary records may be disclosed under appropriate confidentiality, due-diligence and legal safeguards. The receiving party must be subject to applicable data-protection obligations; this is not permission to change the purpose of collection without a lawful basis.
Enquiry confirmation and repeat submissions
The form uses a signed, random submission token and protected server records to recognise a retry of the same enquiry and avoid saving it twice. A protected digest checks that a retry contains the same normalised submission. These functional values are not advertising identifiers and are not sent to tracking platforms.
After the server has saved an enquiry, a short-lived HttpOnly confirmation cookie and a tab-local confirmation reference let the thank-you page check that acceptance. The cookie lasts 15 minutes and may be renewed when a recognised submission is safely retried. The server retains the functional retry and confirmation record for up to 30 days; the enquiry itself has its separate retention period below.
A confirmation means the enquiry was saved, not that an email was delivered, a newsletter was confirmed, a proposal was agreed or a paid project began. A direct visit without valid confirmation does not display a received-enquiry claim. Functional confirmation is available without optional analytics or advertising.
Optional videos and external links
Some guides offer a YouTube video. Optional video media must be allowed in Privacy choices, and you must then choose Load video. We do not load its player, thumbnail or other YouTube resources before those choices. The guide remains readable without loading it. After that choice, the player connects to YouTube through youtube-nocookie.com and shares technical data, including your IP address and device or browser information, with Google or YouTube.
YouTube calls this privacy-enhanced mode. It does not mean that no data is collected or that no cookies or browser storage can be used. Google's terms and privacy practices apply to the loaded player. You can use the external video link instead, which opens YouTube under its own terms.
X and Instagram references are ordinary links, not embedded feeds. Following any external link takes you to a service with its own data practices.
Newsletter choices and withdrawal
Newsletter permission is separate from an enquiry or client service. You can withdraw it through the newsletter preferences page or by emailing support@lucidgrowthmedia.com. A valid withdrawal through the preferences page updates the database immediately. Emailed requests are handled promptly after any necessary verification; we do not promise that a mailbox request is processed instantly. Withdrawal does not prevent us from answering a separate enquiry or handling an existing service, and does not make earlier lawful processing unlawful.
On withdrawal, we erase the plain-text email address and first and last names from the subscription record. We keep a keyed hash of the email and limited preference details to prevent accidental re-subscription. A keyed hash is a protected value used for matching; it is not kept as a readable email address.
Submitting the signup form again does not automatically reactivate a withdrawn address. Contact support@lucidgrowthmedia.com if you want to rejoin so we can verify the request.
How long information is kept
An hourly scheduled process removes expired application records. A documented legal duty or dispute may require limited records to be preserved longer. Access remains restricted, and the information is not reused for unrelated purposes.
Backups expire under their configured lifecycle rather than being edited record by record. If a backup is restored, relevant deletions and withdrawal preferences must be applied again before ordinary use. Provider log and backup periods are separate from the application periods above.
- Website enquiries: up to 730 days from submission. Records needed for a later project, accounting duty or documented legal matter may be kept separately under the relevant requirements.
- Unconfirmed newsletter requests: up to 365 days from submission. A confirmed, active subscription is kept until withdrawal or another valid reason for deletion.
- Withdrawn newsletter preferences: the keyed email hash and limited preference record remain for up to 730 days from withdrawal. Repeating a withdrawal does not restart that period.
- Application abuse counters: removed within 24 hours. Provider traffic and security logs follow their own settings and applicable legal requirements.
- Privacy-choice evidence: up to 730 days from each recorded choice, subject to a documented legal preservation duty. The browser preference cookie itself expires after 180 days. An existing form reference does not extend consent-record retention.
- Optional first-party website metrics: up to 90 days after the last update to the daily count. The device signature changes each calendar month. A valid grant for first-party analytics is required; a compatible earlier grant retains only its original purpose.
- Automatic aggregate request totals: at most 90 UTC date buckets, including today. They contain a fixed page bucket and count, with no individual identifier or form association.
- Functional enquiry retry and confirmation records: up to 30 days after acceptance. The browser confirmation cookie lasts 15 minutes per issue; a recognised retry may renew confirmation without creating another accepted enquiry.
Location and security
Cloudflare operates globally. We do not promise that all information stays in India. Any project needing a specific storage location or transfer safeguard must be reviewed and agreed before data is provided.
We use encrypted connections, restricted administrative access, server-side checks and limited collection. No system is completely secure. Ask for an agreed secure transfer route before sharing sensitive project information.
Requests, rights and updates
Email legal@lucidgrowthmedia.com to ask about your information, request a correction or deletion, or raise a privacy concern. You can also use the contact form or office address. We may ask for enough information to verify your identity or authority. We will explain any need for additional evidence and avoid unnecessary identity documents.
Where applicable, rights may include access, correction, erasure, objection or restriction, portability, withdrawal of consent and complaint to the relevant authority. The scope and timing depend on the governing law. A Jaipur contractual dispute clause does not remove an independent regulator’s jurisdiction or a mandatory privacy remedy.
Your rights depend on the law that applies. We honour mandatory rights and explain any lawful reason we cannot fully meet a request. India's Digital Personal Data Protection framework has phased commencement dates; this notice does not claim that every future provision is already in force. Existing applicable privacy and security duties continue during the transition.
The website is intended for adults seeking business services. We do not knowingly seek children's personal information. Tell us if it has been submitted so we can assess and remove it where appropriate.
We date material updates to this notice. A notice update alone does not authorise a new use that requires a fresh choice or consent.