Privacy policy
Last updated: 28 September 2026
This policy explains how Lustre collects and uses personal information, and the rights you have over it.
Who we are
Lustre is a trading name of Nicholas Waller, a sole trader. In this policy, "Lustre", "we" and "us" mean Nicholas Waller trading as Lustre.
Lustre provides a device condition service to businesses such as insurers and resellers ("our clients"). Our clients' customers use it to photograph and verify their phone.
For any privacy question or request, email [email protected].
Our two roles
How we handle your information depends on how you've come across us.
- If you visit this website, contact us or sign up for product updates, we decide how your information is used. We are the controller of that information, and this policy covers it in full.
- If you've been asked to check your device by an insurer or reseller, that business decides why your information is collected. It is the controller, and we process your information on its behalf as its processor. Its privacy notice explains how it uses your information, and it is the best first contact for requests about it. We explain below what the check collects and how we look after it.
Information we collect
When you visit the website
- Technical information: your IP address and basic browser details. Our hosting provider, Cloudflare, processes these to deliver the website and protect it from attacks and abuse.
- Analytics, only if you agree: if you accept analytics cookies, Cloudflare Web Analytics records which pages are visited, the referring website, and your browser, device type and country. It doesn't use cookies or track you across other websites. You can change your choice at any time using Cookie settings at the bottom of each page.
When you contact us
- Your name, email address, phone number (optional), company, estimated usage and your message.
- The contact form uses Cloudflare Turnstile to check that it's being filled in by a person, not a bot. Turnstile processes signals from your browser to do this.
When you sign up for product updates
- Your email address, name and company, and a record of when you agreed and the exact wording you agreed to.
When you check your device (on behalf of our client)
- Photos of your device: its screen, taken in a mirror, and its back. Before a photo is stored, everything around the phone is blurred, and the photo used for damage analysis is cropped to the phone.
- Device details: IMEI numbers, the make and model provided by our client, and the results of an independent IMEI lookup.
- Technical details from your browser: such as your phone's operating system, browser and screen size, used to confirm the check was completed on the phone being checked.
- Your phone number, if our client provides it so that we can text you the link to your check.
- The results of the check, including the outcome of our automated damage analysis and anything you tell us during it (for example, that your phone has a screen protector or a case that can't be removed).
The screenshot of your IMEI number is read on your phone and is not sent to us.
How we use it and our lawful bases
| What we do | Lawful basis |
|---|---|
| Run and secure the website, and stop spam and abuse | Our legitimate interests in operating a secure website |
| Reply to your enquiry and talk to you about our services | Our legitimate interests in responding to businesses that contact us, or taking steps at your request before entering into a contract |
| Send you product updates | Your consent, which you can withdraw at any time |
| Website analytics | Your consent, which you can withdraw at any time |
| Carry out device checks | On our client's instructions, under its own lawful basis |
We use automated analysis to assess device damage from the photos. The result is passed to our client. We do not ourselves make decisions about you, such as whether to offer or pay out on insurance; our client makes those decisions.
Who we share it with
We don't sell personal information. We use these service providers to run Lustre. Each acts on our instructions and only uses the information to provide its service to us:
| Provider | What for |
|---|---|
| Cloudflare | Website hosting, database and file storage, security, the Turnstile spam check and, if you consent, web analytics |
| Anthropic | Automated damage analysis of device photos |
| IMEI.info | Independent IMEI lookups |
| Resend | Sending emails, including contact enquiries and product updates |
| Twilio | Sending text messages with device check links, when our client asks us to |
In device checks, results and photos are shared with the client that requested the check.
We may also share information where the law requires it, or to protect our rights, property or safety or those of others.
International transfers
Some of these providers are based in, or process information in, the United States. Where personal information is transferred outside the UK, we rely on safeguards recognised under UK data protection law. These are the UK–US data bridge, where the provider is certified under it, or the UK International Data Transfer Agreement or Addendum.
How long we keep it
| Information | How long |
|---|---|
| Device check photos, details and results | 18 months after the check, unless our client asks us to delete it sooner |
| Contact enquiries | 18 months after our last contact with you |
| Product update subscriptions | Until you unsubscribe. We then keep a record of your email address and when you unsubscribed, so that we don't contact you again |
| Website analytics | Kept by Cloudflare in aggregate form, not linked to you |
How we protect it
Personal details such as phone numbers and device make and model are encrypted when stored. Photos are blurred around the phone before storage. Access to our systems is restricted and protected by sign-in.
Your rights
Under UK data protection law, you have the right to:
- ask for a copy of your personal information;
- ask us to correct information that's wrong or incomplete;
- ask us to delete your information;
- ask us to restrict or stop using your information, or object to how we use it;
- ask for your information in a portable format;
- withdraw your consent at any time, where we rely on it. This doesn't affect anything we did before you withdrew it.
To use any of these rights, email [email protected]. We'll respond within one month. If your request is about a device check, we'll pass it to, or work with, the client that requested the check.
To unsubscribe from product updates, use the link in any of our emails.
Complaints
If you're unhappy with how we've handled your information, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.
Cookies
Our cookie policy explains the cookies and similar technologies we use and how to control them.
Changes to this policy
We'll update this policy when our practices change. The date at the top shows when it was last updated. If we make significant changes, we'll make that clear on this page.