Privacy notice

This notice explains how Illustrious Labs SARL-S (s.c.c.) handles personal data collected through this website: the contact form, email sent to us, and the delivery of the website by Cloudflare.

1. Who is responsible for your data

The controller is Illustrious Labs SARL-S (s.c.c.). Send privacy requests and questions to privacy@illustrious.observer.

We have not appointed a Data Protection Officer.

2. What we collect, why, and on what basis

• Contact form (name, email, company, and message). When the form is switched on, we use these details to read and answer your inquiry. Basis: steps you ask us to take before entering into a contract (Article 6(1)(b) GDPR), and our legitimate interest in answering inquiries about our services (Article 6(1)(f)).
• Email. If you email webmaster@illustrious.observer or privacy@illustrious.observer, we use your message and address to reply and to deal with your request. Basis: the same as for the contact form. Requests about your data are also handled under our legal obligation to answer them (Article 6(1)(c)).
• Website delivery. When you visit the website, Cloudflare receives your IP address, the page you request, and technical details of your request, so that it can deliver the site and protect it from abuse. Basis: our legitimate interest in running and securing the website (Article 6(1)(f)). Sections 3 and 4 say who receives this data and where it goes.
• Form server logs (IP address, time, and request) from the server that receives contact form messages. We use them to keep the form secure and to stop abuse. Basis: our legitimate interest in security (Article 6(1)(f)).
• Rate limiting. The form server counts messages per visitor address over 15 minutes to prevent abuse. The counts are held in memory and not stored.
• Spam protection. A hidden form field catches automated submissions. Those submissions are discarded and not sent.

We do not use your data for marketing, profiling, or automated decisions.

3. Who receives your data

Inquiries arrive at the company's mailbox and are read only by the company's managers. These providers handle your data:

• Proton AG, based in Switzerland, which provides our email service and, when the contact form is on, its SMTP sending service.
• Cloudflare, Inc., in the United States, which delivers the website. Cloudflare acts as a controller for the visitor data it collects, as its privacy policy explains. For other data it handles for us, its Data Processing Addendum applies.

We do not sell your data.

4. Where your data is processed

Cloudflare primarily stores personal information in the United States and the European Economic Area. It may also access information from other countries, as its privacy policy explains. When you visit the website, your request is handled by the Cloudflare data center nearest to you, which may be outside the EU/EEA. For transfers to the United States, Cloudflare relies on the EU-U.S. Data Privacy Framework and, if that framework no longer applies, on the EU Standard Contractual Clauses.

Our email provider, Proton AG, is based in Switzerland. The European Commission recognizes Switzerland as providing an adequate level of data protection, so no further transfer safeguard is needed for data processed there. Proton also uses other service providers in countries outside Switzerland and the EU, such as the United States and Singapore. Its privacy policy lists them.

5. How long we keep data

• Inquiries, whether sent through the form or by email: until the inquiry is resolved, then deleted six months later.
• Form server logs: 30 days, then deleted. The log rotates daily.
• Rate-limit counts: 15 minutes, in memory only.
• Cloudflare: its privacy policy keeps personal information for a period consistent with the business purposes it describes. It gives no fixed period for IP addresses and logs.

6. Cookies and similar technologies

This website's own code sets no cookies and uses no analytics, advertising, or third-party scripts. Its fonts are hosted by us, so your browser makes no requests to third parties for them. The two items below come from Cloudflare, not from our code.

Cloudflare, which delivers the website, may set a few technical cookies to protect it from abuse. For example, a bot-detection cookie named __cf_bm expires after 30 minutes of inactivity. Cloudflare lists these cookies, and their purposes, in its cookie documentation.

Email addresses. Cloudflare may encode the email addresses on pages that show them, to make them harder for bots to collect. When it does, it adds a small script of its own that decodes the addresses in your browser. We did not write this script. If your browser blocks scripts, you may not see the addresses.

To remember whether you chose light or dark mode, the site saves that choice in your browser's local storage. It is never sent to us.

7. Your rights

You have the right to access your data, have it corrected or erased, restrict or object to its use, and receive a copy in a portable form where that applies. Where we rely on your consent, you can withdraw it at any time. To use these rights, email privacy@illustrious.observer. We will reply within one month and tell you if we need longer.

You may lodge a complaint with the Luxembourg supervisory authority, the Commission nationale pour la protection des données (CNPD), at cnpd.public.lu.

8. Whether you must give us your data

Providing your details is voluntary. We cannot reply to an inquiry without an email address.

9. Security

Visitors' connections to the website are encrypted between their browser and Cloudflare's network. Our email is sent over an encrypted connection, and access to the mailbox is limited to the company's managers.

10. Changes to this notice

We will update this notice when our practices change. Before we add analytics, marketing, or any new recipient of your data, we will update this notice first.

Last updated: 8 October 2026.