Privacy Policy

01Data we collect

We collect only what we need, and we never sell personal data. Depending on how you interact with us:

• Waitlist information — the email address you submit to our waitlist form. The form is processed by Formspree on our behalf.
• Contact & correspondence — when you email us, we receive your email address, name (if provided), and the content of your message.
• Analytics data (only with your consent) — usage data collected by Google Analytics 4 and Microsoft Clarity: pages viewed, approximate location (city level), device and browser type, and how you interact with the site. Clarity may record anonymized session replays with typed input masked.
• Authentication data (Adara, when available) — your name, email address, and login identifiers when you create an account.
• Ad account connections & API tokens (Adara) — when you connect an advertising account (Meta Ads, Google Ads, or TikTok Ads), we receive account identifiers, OAuth access tokens, and campaign, ad set, ad, creative, performance, and reporting data from the connected account.
• Service usage analytics — logs, diagnostics, and feature-usage data tied to your account, used to keep the service secure and improve it.

02Cookies & similar technologies

We do not set any analytics cookies until you allow them. When you first visit, a consent banner lets you allow or decline analytics — both choices are equally easy, and your decision is remembered in your browser’s local storage (a strictly functional record with no tracking value).

• If you allow analytics: Google Analytics 4 sets cookies such as _ga and _ga_* (up to 24 months), and Microsoft Clarity sets cookies such as _clck and _clsk (up to 12 months).
• If you decline: no analytics scripts load and no analytics cookies are set. The site works exactly the same.

You can change your choice at any time via Cookie Settings in the footer of every page. Withdrawing consent stops further tracking immediately.

03Why we process your data (legal bases)

Under Article 6 GDPR, we rely on:

• Consent — for the waitlist (you choose to submit your email) and for analytics cookies. You can withdraw consent at any time.
• Contract — to provide Adara and related services you sign up for, including processing the data needed to analyze your connected ad accounts.
• Legitimate interests — to keep our services secure, prevent abuse, and understand how our services perform, balanced against your rights.
• Legal obligation — where laws such as accounting rules require us to retain certain records.

04How we use your data

• To operate and improve hellolunr.com and Adara.
• To send you the waitlist launch email you asked for — nothing else, no drip sequences.
• To respond to your messages and support requests.
• To analyze connected ad accounts and generate optimization suggestions that always require human approval before any action.
• To secure our services, prevent fraud and abuse, and debug problems.
• To comply with legal obligations.

We do not sell personal data, and we do not use your data for third-party advertising.

05Who we share data with

We share personal data only with processors who help us run the service, under data-processing agreements:

• Formspree — waitlist form processing.
• Google — Google Analytics 4 (only with your consent).
• Microsoft — Clarity analytics (only with your consent).
• Vercel — website hosting.
• Advertising platforms (Meta, Google, TikTok) — when you connect a Meta Ads, Google Ads, or TikTok Ads account to Adara, data flows through that platform’s advertising APIs under its platform terms.

Where data is transferred outside the EEA (for example to the United States), we rely on safeguards such as the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

06Data retention

• Waitlist emails — kept until we have sent the launch communication and a reasonable period after, or until you ask us to delete them, whichever comes first.
• Correspondence — kept as long as needed to handle your request and for a reasonable record afterwards.
• Analytics data — Google Analytics retention is set to 14 months; Clarity retains session data up to 12 months.
• API tokens & ad account data — kept only while your account connection is active; revoked and deleted when you disconnect or request deletion.
• Account data — kept for the life of your account, then deleted or anonymized, except where law requires longer retention.

07Your rights under the GDPR

You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”) — see our Data Deletion Instructions.
• Restrict or object to processing based on legitimate interests.
• Port your data to another service in a machine-readable format.
• Withdraw consent at any time, without affecting processing that happened before withdrawal.

To exercise any right, email office@hellolunr.com. We respond within one month. If you believe we have not handled your data lawfully, you may lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi (opens in a new tab)) or your local supervisory authority.

08Ad account connections & API tokens

When Adara connects to your advertising accounts, we request the minimum scopes needed to read performance data and provide suggestions. Access tokens are stored encrypted and are never shared with third parties. You can revoke access at any time from the connected platform’s own settings (for example Meta under Settings → Business Integrations, Google under Third-party apps & services, or TikTok under Authorized apps), or by asking us to delete your data — see the Data Deletion Instructions.

09Security

We protect personal data with technical and organizational measures appropriate to the risk: encryption in transit, encrypted token storage, access controls limited to people who need it, and data minimization by design. No system is perfectly secure, but we treat your data the way we would want ours treated.

10Children

Our services are not directed at children under 16, and we do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will delete it.

11Changes to this policy

We will post any changes on this page and update the date above. For material changes, we will provide a clear notice on the site before the change takes effect.

12Contact