Privacy Policy
This Privacy Policy explains how Lunea Labs LLP (“LuneaMail”, “we”, “us”) collects, uses, discloses, and protects personal data when you visit our websites, sign up for an account, or use our email marketing platform (collectively, the “Services”). It applies to all visitors, prospective customers, account holders, authorized users, and to the recipients of emails our customers send through the Services.
Never sold, never shared
We never sell personal data and never disclose it for cross-context behavioral advertising.
Yours stays yours
Customer content (contacts, templates, campaigns) belongs to you. We don’t train AI on it.
Encrypted in transit and at rest
TLS in transit, an encrypted database, extra encryption for SMTP passwords, scrypt-hashed passwords.
Delete on request
Export or erase your data at any time from Settings. Deletion is immediate; backups expire within 30 days.
Who we are & how to contact us
The data controller for personal data described in this Policy is Lunea Labs LLP, Shadrin Street 2/12, Alatau District, Almaty 050061, Republic of Kazakhstan (BIN 260240022496), the operator of LuneaMail. For any privacy question, request, or complaint you can reach us at privacy@luneamail.com.
When our customers use LuneaMail to send email to their own recipients, the customer is the controller of that recipient data and LuneaMail acts as a processor on their behalf, under our Data Processing Addendum (DPA), available on request from privacy@luneamail.com.
Information we collect
Account & organization data
Name, email address, hashed password (or OAuth identifier from a provider you choose to sign in with, such as Google), workspace/organization name, your role, and your sign-in sessions (IP address, browser, timestamps). When you create an account we also record that you confirmed you're 16 or older and which version of our Terms and this Policy you accepted, and when. We don't ask for or store your date of birth. Sign-in uses Better Auth; passwords are stored only as scrypt hashes.
Billing data
Plan, subscription status and renewal dates, and Polar customer and subscription identifiers. Paid plans are sold by our reseller, Polar, which acts as Merchant of Record: it collects your billing name, email, address, and payment details at checkout, processes payments, and handles sales tax and VAT as an independent controller under its own privacy policy. Card numbers, CVCs, and bank details are collected and stored directly by Polar and its payment processors; LuneaMail does not see or store full payment instruments.
Customer content (recipient data you upload)
The contacts, lists, segments, templates, subject lines, body copy, custom attributes, suppression entries, and campaign metadata that you create or import. This may include the personal data of your recipients (email, first/last name, and any custom attributes you choose to collect). Treat custom attributes carefully — do not upload special-category data (Article 9 GDPR) such as health, biometric, political, or religious information.
Send events & engagement data
For each campaign we record delivery, bounce, complaint, unsubscribe, open, and click events returned by our delivery provider, tied to a contact and campaign identifier. These events power your analytics and our deliverability safeguarding. Opens are counted with a small invisible image and clicks by routing links through a redirect; workspace admins can turn either off in Settings. Emails we send you about your own account (password resets, confirmations, invites) are never tracked.
AI prompts & outputs
If you use AI-assisted features (writing and designing emails, subject lines, segment building, the spam check, the marketing agent), the inputs you submit, and the workspace data the feature needs to answer, are sent to our AI sub-processor, Anthropic. Marketing agent conversations, and notes you ask the agent to remember, are stored in your workspace until you delete them.
Usage, device & log data
The IP address and browser of each sign-in session, and request and error logs kept by our hosting provider, which we use to operate and secure the Services. We don't run analytics or advertising trackers on our website or in the app.
Cookies & local storage
We use only first-party cookies: better-auth.session_token and better-auth.session_data keep you signed in (strictly necessary; they end when your session does); lm_ws remembers which workspace you last used (1 year); and lm_ref is set only when you open a friend's referral link, so you both get the referral reward (30 days). Your light or dark theme is kept in your browser's local storage. We use no advertising, analytics or cross-site tracking cookies.
How we use information
We use personal data only where we have a lawful basis, and only for the purposes set out below:
- Provide the Services — create your account, authenticate sessions, render workspaces, send campaigns on your instructions, return analytics. Basis: performance of contract.
- Secure & operate the platform — fraud and abuse prevention, rate limiting, log review, deliverability protection, capacity planning. Basis: legitimate interests in running a safe, reliable platform.
- Billing & legal compliance — process payments, calculate taxes, retain records required by law. Basis: contract and legal obligation.
- Customer support — respond to your requests and incidents. Basis: contract and legitimate interests.
- Product improvement — aggregated, de-identified usage totals (such as how many campaigns were sent) to improve features. We do not train AI models on customer content, and we do not permit our AI sub-processors to train their general models on customer content.
- Product communications — service announcements, security notices, and (only with separate consent or where permitted) optional marketing emails about new features. You can unsubscribe from marketing at any time.
We will never sell your personal data, and we will never share it for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws.
Legal bases (EEA, UK & Switzerland)
Where the GDPR applies, we rely on the following Article 6 bases: (a) performance of a contract for account, workspace, and sending features; (b) compliance with a legal obligation for tax, financial, and law-enforcement records; (c) legitimate interests for product security, deliverability protection, anti-abuse, and product analytics — balanced against your rights and freedoms; (d) consent for optional marketing communications and any non-essential cookies we may introduce in future. When LuneaMail acts as a processor on behalf of a customer (Article 28), the customer is responsible for identifying the lawful basis for processing their recipients’ data.
International data transfers
We are based in Kazakhstan, and our database, hosting, email delivery and AI providers process personal data in the United States. Personal data may also be processed in other countries where our sub-processors operate. Where we transfer personal data out of the EEA, the UK, or Switzerland we rely on an approved adequacy decision where available; otherwise we use the European Commission’s Standard Contractual Clauses (2021), the UK International Data Transfer Addendum, and the Swiss FDPIC-approved version, supplemented by appropriate technical and organizational measures (encryption in transit, encryption at rest, access controls, and transfer-impact assessments).
How long we keep data
- Your account: until you delete it in Settings › Your data. Deletion is immediate in our live database (with any workspace you own on your own); copies in database backups expire within 30 days.
- Workspace content (contacts, lists, templates, campaigns, agent conversations): while the workspace exists. Deleting the workspace deletes all of it straight away; backups expire within 30 days.
- A deleted contact: erased straight away, together with their list memberships, per-campaign send records and delivery, open and click events.
- Send events (delivery, open, click, bounce, complaint): deleted after 24 months. Campaign totals, which don't identify anyone, are kept.
- Suppression list: addresses that unsubscribed, bounced or complained are kept for as long as the workspace exists, even if the contact is deleted, so they are never emailed again. They are deleted with the workspace.
- Sign-in sessions: deleted 30 days after they expire. Expired team invitations are deleted 30 days after they lapse.
- Billing: Polar keeps invoices and tax records as Merchant of Record under its own policy; we keep your plan and subscription identifiers while the workspace exists.
- Hosting logs: request and error logs are kept by our hosting provider for its standard short retention period.
Your rights & how to exercise them
Depending on where you live, you may have the right to access, rectify, erase, restrict or object to processing, withdraw consent, and receive a portable copy of your personal data. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and other U.S. states with comprehensive privacy laws have equivalent rights, including the right to know, the right to delete, the right to correct, and the right to opt-out of sale or sharing (which we do not engage in).
You can do much of this yourself: workspace admins can download everything in the workspace, and owners can delete it, under Settings › Your data; anyone can delete their own account there; contacts can be deleted one by one from Audience. For anything else, email privacy@luneamail.com from the address associated with your account. We will respond within the period required by applicable law (typically 30 days, extendable for complex requests). Where LuneaMail is a processor acting on behalf of a customer (for instance, you are an email recipient of one of our customers), please contact the customer directly; we will assist them in responding to you.
You have the right to lodge a complaint with a supervisory authority, including the data protection authority of your country of residence.
Security
We implement administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, accidental loss, and unlawful processing. These include TLS encryption in transit, encryption at rest by our database provider, additional AES-256-GCM encryption for stored SMTP passwords, scrypt password hashing, role-based access within each workspace, rate limiting, environment isolation, vendor due diligence, and regular dependency updates. No method of transmission or storage is 100% secure; in the unlikely event of a personal data breach affecting your information, we will notify you and any applicable supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, in accordance with applicable law.
Children
The Services are not directed to children. You must be 16 or older (or the age of digital consent in your jurisdiction, where higher) to create an account, and we ask you to confirm this when you sign up. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
Automated decision-making & AI
The Services include AI-assisted features that write and check emails, suggest subject lines and segments, and a marketing agent that can carry out tasks in your workspace. These are assistive: you review the output, and the agent asks for your approval before it sends a campaign or adds contacts. We do not make decisions that produce legal or similarly significant effects about you using solely automated processing within the meaning of Article 22 GDPR. We do not use customer content, recipient data, or AI prompts to train our own or our sub-processors’ general-purpose models.
Notice to California residents (CCPA/CPRA)
In the prior 12 months we have collected the categories of personal information described in Section 2 (identifiers, commercial information, internet/network activity, professional information, and inferences). We collect it for the business purposes in Section 3 and we share it only with the sub-processors in Section 5 as “service providers” under the CCPA. We do not sell personal information and we do not share it for cross-context behavioral advertising. We do not knowingly process the sensitive personal information of California residents for purposes other than those permitted without an opt-out under § 7027 CCPA Regulations. To submit a verifiable consumer request or to designate an authorized agent, email privacy@luneamail.com. We will not discriminate against you for exercising your rights.
Changes to this Policy
We may update this Policy from time to time. When we make material changes, we will update the “Effective” date above and ask you to review and accept the new version in the app.
Contact us
Questions or requests? Email privacy@luneamail.com. For security disclosures please use security@luneamail.com.