Privacy Notice — this website

The controller for the personal data described here is Lutra Labs d.o.o.

Lutra Labs d.o.o.
Cesta XIV. divizije 20A, 2000 Maribor, Slovenia
Email: info@lutralabs.io

This notice covers the website at id.lutralabs.io. The LutraID Wallet mobile app is a separate matter: it runs no analytics and sends us nothing at all, and it has its own policy at /privacy/wallet.

This site sets exactly one cookie: NEXT_LOCALE, written by the next-intl middleware to remember which language you chose so that the next page you open is in that language. It holds a language code and nothing else — no identifier, no session token — and it is never used for analytics or advertising.

Nothing else on this site sets a cookie. The analytics described below does not, which is why you see no cookie banner here.

We count page views with Umami, an open-source analytics tool that we run ourselves at umami.lutralabs.io. There is no Google Analytics and no third-party tracking script here: the measurements go to our own server and are never shared, sold, or combined with data held by anyone else.

Nothing is stored on your device. Umami sets no cookies and writes nothing to local or session storage, and it does not fingerprint your browser. Because it neither stores nor reads information on your device for this purpose, no consent is required for it under the ePrivacy rules as transposed in Slovenia by the Electronic Communications Act (ZEKom-2) — which is why this site shows you no cookie banner.

Per page view we record the address and title of the page, the referring address, the site identifier, your screen size, and your browser language. From your IP address our server additionally derives your browser, operating system, device type, and approximate location (country, region, city), and then discards the address. Your IP address is never written to our database.

So that returning visits within one day are not counted twice, our server computes a one-way hash from your IP address, your browser’s user-agent string, and a secret value that is replaced every 24 hours. The hash cannot be reversed, and because the secret changes daily the same person cannot be recognised from one day to the next. We build no profiles and do not follow you to other websites.

The legal basis is our legitimate interest under Article 6(1)(f) GDPR in knowing which pages are read and whether this site reaches the audience it is written for. We consider that proportionate: the data is coarse and pseudonymous, nothing is placed on your device, nothing leaves our own infrastructure, no advertising audiences are built, and the measurement can be switched off in one step. You may object at any time under Article 21 GDPR.

The analytics service and its database run on our own servers, rented from our processor Hetzner Online GmbH in Nuremberg, Germany. No analytics data is transferred outside the EU/EEA. Retention: records are deleted automatically after 14 months.

The tracker honours the browser “Do Not Track” setting: if you have it switched on, nothing is measured. You can also switch measurement off for this browser here.

A third option is to block umami.lutralabs.io in a content blocker. The site works identically either way — nothing here is gated on being measured.

You may request access to, correction, deletion, restriction, or portability of your data, and object to processing, by emailing info@lutralabs.io.

You may also lodge a complaint with the Slovenian supervisory authority, the Informacijski pooblaščenec Republike Slovenije.