1. Who is responsible
Lunonis LLC is the controller of your personal data: 4 Peddlers Row, Unit #234, Newark, DE 19702, USA. For anything about your data, including access, export, correction or deletion, write to [email protected].
2. What we collect
- Birth details: the name, date, time (if known) and place of birth of you and of anyone you order for, and, if you choose to give it, their gender so that our texts address them correctly.
- Your email address.
- Order details: what you ordered, its options and language, the price, currency, payment method (card or crypto) and status, any discount code, and when you accepted our terms.
- Payment confirmations from Stripe and Heleket. We never receive your full card number.
- Technical data: the country your visit comes from (from Cloudflare, to show prices in your currency) and your IP address, which we use briefly for security and rate limits.
- Email records: which emails we sent you, and delivery reports from our email provider (for example, delivered or bounced).
- Your email choices: whether and when you agreed to marketing emails, and if you unsubscribed.
- If you sign in: a session record, so you stay signed in.
- If you ask us to email you a free chart: your email address and the birth details for that chart.
3. Details about other people and children
When you order for someone else, such as a partner, a family member or a child, you give us their name and birth details. Please do so only if you have the right to: with their permission, or as the parent or guardian of a child. You are responsible for that.
We use these details only to create the product you ordered. Gift recipients enter their own details. You can ask us to delete any person’s details at any time.
4. Why we use it, and on what legal basis
If you are in the EU or the UK, these are the legal bases under the GDPR:
- To create and deliver your product, show your order page, let you sign in and send service emails about your order: to perform our contract with you (Article 6(1)(b)).
- To take payment, prevent fraud and abuse, and keep the site secure: our legitimate interests (Article 6(1)(f)).
- To keep order and payment records for accounting and tax: legal obligation (Article 6(1)(c)).
- To send our monthly sky emails, offers, reminders and birthday emails: only with your consent (Article 6(1)(a)). You can withdraw it at any time with the unsubscribe link in each of these emails.
- To answer your messages: our contract with you, or our legitimate interest in helping you.
- To count visits in total with Cloudflare Web Analytics, which uses no cookies and doesn’t identify you: our legitimate interests.
5. Who processes it for us
We don’t sell personal data. We use these service providers, each only for its task:
- OpenAI (USA): writes the texts of your product. It receives the first names you entered (or a placeholder), the gender if you gave it, and the calculated chart. It doesn’t receive your email address or payment details.
- Stripe (USA and Ireland): card, Apple Pay and Google Pay payments. It receives your email address and the order amount, and the card details you enter in its form.
- Heleket: crypto payments. It receives your email address and the order amount.
- SendGrid by Twilio (USA): sends our emails. It receives your email address and the email’s content. Our emails contain no birth details.
- Cloudflare (USA): delivers the website securely (all visits pass through it) and counts visits without cookies (Cloudflare Web Analytics).
- Our hosting provider: runs the servers and the database where your data is stored.
We look up birth places in the GeoNames place database, which we keep on our own servers; nothing about you is sent to GeoNames. Our internal order alerts (sent to us via Telegram) contain no names, email addresses or birth details.
6. International transfers
We are based in the USA, and some of our providers process data in the USA or other countries. When data from the EU, the UK or Switzerland is transferred, we rely on an adequacy decision (such as the EU–US Data Privacy Framework, for certified providers) or on standard contractual clauses.
7. How long we keep it
- Your orders, the birth details in them and the products we created: until 3 years after your last order, so you can come back to your files, unless you ask us to delete them sooner.
- Order and payment records (product, amount, date, email address): 7 years, for tax and accounting.
- Checkouts that were never paid: up to 6 months.
- Free chart requests and marketing consent: until you unsubscribe, or 2 years after we last heard from you. After you unsubscribe, we keep only a note of it, so we don’t email you again.
- Sign-in: a session lasts 90 days; sign-in links expire after 15 minutes.
- Email delivery records: up to 2 years. Security logs and rate-limit counters: a few days at most.
8. Your rights
Depending on where you live, you have the right to access your data, get a copy in a portable format, correct it, delete it, restrict or object to its use, and withdraw your consent at any time (this doesn’t affect what we did before). You can also complain to your local data protection authority.
9. How to export or delete your data
Email [email protected] from the address you used for your orders and tell us what you need: a copy of your data, a correction or deletion. We may ask you to confirm the request from that address. It is free, and we reply within one month, usually much sooner.
Deleting your data removes your birth details, the products we created and your sign-in. We keep only the order records the law requires.
To stop marketing emails, use the unsubscribe link in any of them.
10. Children
You must be an adult (18 or older, or the age of majority where you live) to place an order. Children don’t use our site. A parent or guardian may enter a child’s name and birth details to order a baby or family book; we use them only for that order and delete them on request.
11. Security
Connections to our site are encrypted. Your order page is protected by a long private link, which we store only in a form that can’t be read back; sign-in works through one-time email links. Access to our systems is limited, and card data stays with Stripe. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
12. California residents
We do not sell or share your personal information, as “sell” and “share” are defined in the California Consumer Privacy Act, and we don’t use it for cross-context behavioural advertising.
We collect the categories of information described above (identifiers such as your name and email address, commercial information about your orders, and the birth details you enter) for the purposes described above. You have the right to know, correct and delete your personal information, and not to be treated differently for using these rights. To use them, write to [email protected].
13. Changes to this policy
If we change this policy in a way that matters, we say so on this page and, where appropriate, by email. The date at the top shows when it last changed.
14. Contact
Lunonis LLC, 4 Peddlers Row, Unit #234, Newark, DE 19702, USA. Email: [email protected].