Privacy Policy

01Who we are, and our two roles

The controller for the processing described in this policy is:

We have not appointed a Data Protection Officer; privacy questions go to the address above.

LUNR as controller. We decide why and how data is processed — and this policy governs it — for:

• this website and the people who visit it, book a call, use the free ad audit, or write to us;
• LUNR’s own sales work and lead-generation campaigns, and the enquiries they produce;
• the contact people, contracts, and billing of our clients.

LUNR as processor. When we run the growth service for a client, we work with data from the client’s shop and advertising accounts on the client’s behalf. The client is the controller of that data and we are its processor. We act only on the client’s documented instructions, under the data processing agreement that is part of the client’s service agreement. This policy does not govern that data — the client’s own privacy notice does. Section 07 describes how we handle it.

So: if you visited or bought from a shop that works with LUNR, that shop is your controller, not LUNR. The privacy notice you should read is the shop’s own. If you are unsure who to approach, section 11 explains what to do.

02Data we collect

We collect only what we need, and we never sell personal data. Depending on how you interact with us:

• Contact & correspondence — the content of an email you write to us, and your name and email address as they appear in it.
• Call bookings — when you book a call with us through a “Get started” or other booking button, the booking calendar is provided by Cal.com. It collects your name and email address, the time slot you choose and your time zone, and, only if you add them, notes about what you want to discuss and the email addresses of guests you invite. If you later reschedule, it also records any reason you give. The call is added to our Google Calendar with a Google Meet link, and Cal.com and Google send the confirmation and reminders.
• Free ad audit — the ad report file you choose on our audit page is checked in your browser and never uploaded to us. Only if you ask for the full report by email, or ask us to look at your ads by hand, do we receive your email address, your website and goal where you give them, and the audit results: the platform, total spend and currency, the score, and the findings, which can name campaigns or ads as they appear in your file.
• Lead-generation form submissions — when you submit one of LUNR’s own lead forms on Meta, Google, or TikTok. Section 03 describes exactly what those forms collect.
• People we contact about our service — if we write to you because of your role at a business we think we could help, we hold your name, role, and company, your business email address or phone number, your public professional profile, and a record of our exchanges. We take these from your company’s website, public company information services, LinkedIn, or an introduction by someone who knows you. We use business contact details only.
• Client contacts — if your company is a client, we hold the names, roles, and work contact details of the people we work with, the messages we exchange by email or in the shared Slack channel, meeting notes, and, only if everyone on the call agrees, a recording of the kickoff call. We also hold the client company’s contract and invoicing records.
• Cookieless site analytics — Vercel Web Analytics records anonymous, aggregate page-view data such as the page URL, referrer, approximate location, device, operating system, and browser. It does not use cookies or store an IP address or other personal identifier; its daily visitor hash is discarded after 24 hours.
• Analytics data (only with your consent) — usage data collected by Google Analytics 4 and Microsoft Clarity: pages viewed, approximate location (city level), device and browser type, and how you interact with the site. Clarity may record anonymized session replays with typed input masked.

Data from a client’s shop and advertising accounts is handled differently, with LUNR as the client’s processor — see section 07.

03Lead-generation forms

LUNR runs lead-generation campaigns for its own business. If you submitted one of our forms, LUNR is your controller and this section applies to you.

Where the form lives. We use the in-platform lead forms offered by the advertising platforms:

• Meta Instant Forms on Facebook and Instagram;
• Google lead form assets on Google Ads;
• TikTok Instant Forms on TikTok.

You fill the form inside the platform’s app. The platform passes the submission to the advertiser, and we retrieve it from the platform, using LUNR’s own advertising accounts.

What we collect. Only the fields shown on the particular form you submitted:

• your name;
• your email address;
• your phone number, where that form asks for one;
• company details — such as company name or your role — where that form asks for them;
• your answers to any custom questions on that form;
• submission metadata: the platform’s lead identifier, the form and the campaign or ad it belonged to, and the time of submission.

Forms differ. A given form collects only what it displays to you before you submit. We do not add fields afterwards, and we do not buy, append, or enrich your details from any other source.

The platform is processing your submission too. When you use an in-platform lead form, the platform handles your data for its own purposes as well, under its own terms and policy — TikTok, for example, states that it and the advertiser are each controllers for lead ads. What the platform does with your submission, and how long it keeps it, is governed by that platform’s policy, not by this one.

Forms run by other advertisers are not covered here. If the advertiser named on the form was someone other than LUNR, that advertiser is your controller. See section 01.

04Cookies & similar technologies

We do not set any analytics cookies until you allow them. When you first visit, a consent banner lets you allow or decline Google Analytics and Microsoft Clarity — both choices are equally easy, and your decision is remembered in your browser’s local storage (a strictly functional record with no tracking value).

• If you allow analytics: Google Analytics 4 sets cookies such as _ga and _ga_* (up to 24 months), and Microsoft Clarity sets cookies such as _clck and _clsk (up to 12 months).
• If you decline: Google Analytics and Microsoft Clarity do not load, and no analytics cookies are set. Cookieless, anonymous Vercel Web Analytics remains active. The site works exactly the same.

The booking calendar. Booking buttons open Cal.com’s scheduling page in a window over this site. Cal.com’s code loads only when you point at, move to, or press a booking button, not when a page opens. What Cal.com stores in your browser inside that window is governed byCal.com’s privacy policy (opens in a new tab).

You can change your choice at any time via Cookie Settings in the footer of every page. Withdrawing consent stops further cookie-based analytics tracking immediately.

05Why we process your data, and on what legal basis

Each purpose below is separate, and each has its own legal basis under Article 6 GDPR. Submitting a form gives us what we need to answer it. It is not blanket permission to use your details for every other purpose.

If you contacted us, booked a call, used the free ad audit, or submitted one of our lead forms:

• Answering your enquiry — replying to what you actually asked. Legal basis: steps taken at your request before entering a contract (Art. 6(1)(b)), or our legitimate interest (Art. 6(1)(f)) in responding to a business enquiry where you wrote on behalf of an organisation.
• Arranging a call or demo, where you booked or asked for one — scheduling it, sending the invitation and reminders, holding the call, and following up on it. Legal basis: Art. 6(1)(b), pre-contractual steps at your request.
• Sending the free ad audit you asked for — emailing you the report, or looking at your ads by hand when you asked us to, and at most one personal follow-up about it. Legal basis: Art. 6(1)(b) for the report you requested; our legitimate interest (Art. 6(1)(f)) in a single follow-up to a business that asked us to review its ads, which you can stop by replying or writing to us.
• Preparing a quotation or proposal, where you asked for one — working out scope and pricing and sending it to you. Legal basis: Art. 6(1)(b).
• Ongoing promotional communications — a newsletter or recurring marketing email, which is not the same as answering you. Legal basis: your separate consent (Art. 6(1)(a)). Submitting a lead form is not that consent, and we do not add you to a marketing list because you asked us a question. See section 06.
• Keeping a record of your enquiry and of any consent you gave — so we can show what was asked and what was agreed. Legal basis: legitimate interests, and Art. 7(1) where the record evidences consent.

If we contacted you first:

• Offering our service to your business — a personal message about what we could do for the business you work for, and a follow-up where you answer. Legal basis: our legitimate interest (Art. 6(1)(f)) in offering a business service to the people responsible for it. You can object at any time, and we stop. See section 06.

If your company is a client:

• Running the service and the client relationship — onboarding, day-to-day communication, reporting, and invoicing. Legal basis: the contract, where you are the contracting party yourself (Art. 6(1)(b)); otherwise our legitimate interest (Art. 6(1)(f)) in carrying out the agreement between your company and ours.
• Recording the kickoff call — so that what was said and agreed is not lost. Legal basis: the consent (Art. 6(1)(a)) of the people on the call, asked before the recording starts. Saying no does not affect the service.

Everywhere else:

• Consent (Art. 6(1)(a)) — analytics cookies, and any optional marketing.
• Legitimate interests (Art. 6(1)(f)) — keeping our site and systems secure, preventing fraud and abuse, debugging, and understanding in aggregate how the site performs; always balanced against your rights.
• Legal obligation (Art. 6(1)(c)) — where accounting or tax law requires us to keep records.

We do not sell personal data, and we do not use your data for third-party advertising.

06Marketing preferences, consent, and withdrawal

How we follow up. When you submit one of LUNR’s lead forms, we reply by email, to the address you gave, about the thing you asked about. We do not cold-call people who submit our forms, and we do not send SMS or WhatsApp marketing. Where a form asks for a phone number, we use it only if you have asked us to reach you that way.

If we wrote to you first. A message that introduces our service goes to a business address or number, says who we are, and says how to stop further contact. One reply is enough: we stop, and we keep only the minimum record needed to honour that (see section 10).

Marketing consent is asked for separately. Where we want to send you promotional communications beyond answering your enquiry, we ask for that on its own: an optional, unchecked control on the form, worded so it is clear what you are agreeing to. It is never bundled into the submit button, never pre-ticked, and declining it never blocks your enquiry.

An advertising platform’s terms are not your consent. LUNR’s acceptance of TikTok’s LeadAds terms — or Meta’s or Google’s equivalents — is an agreement between LUNR and that platform. It says nothing about what you agreed to, and we do not treat it as marketing consent.

Withdrawing, and objecting.

• Every marketing email we send carries a working unsubscribe link.
• You can also email office@hellolunr.com at any time and ask us to stop. One line is enough; you do not have to give a reason.
• Withdrawing consent is as easy as giving it (Art. 7(3)). It takes effect promptly and does not affect processing that already happened.
• You have an absolute right to object to direct marketing (Art. 21(2)). If you object, we stop — there is no balancing test and nothing for you to justify.
• If you ask never to be contacted again, we keep the minimum record needed to honour that (see section 10).

As things stand, LUNR does not run a newsletter or send ongoing promotional email to people who submit a lead form. If that changes, we will ask for consent separately and update this policy before doing it — not after.

07How the growth service handles a client’s data

This section describes what happens to data from a client’s shop and advertising accounts. HereLUNR is a processor; the client is the controller.

What we work with. What the client’s agreement sets out, which is typically:

• order data from the shop: order number, date, products, amounts, discounts, refunds, and whether it is a customer’s first or a later order;
• where a visit or an order came from: campaign and tracking parameters;
• advertising account data: campaigns, ads, creatives, budgets, spend, and results, and the Facebook Page, Instagram account, pixel or dataset, and product catalog the ads use;
• search performance data from the client’s Google Search Console, where the service includes search content;
• audience data in aggregated form.

What we leave out. We work with orders, not with people. We do not use shoppers’ names, email addresses, phone numbers, or postal addresses in our analysis, and we do not upload customer lists to AI tools.

How the work is done. Much of the analysis, writing, and reporting is done by AI agents, supervised by LUNR’s team. The AI provider we use for analysis and writing does not train its models on client data. Images and videos for ads are generated from the client’s product images and brand material; no personal data is used for that. Changes in a client’s advertising account are made within the limits agreed with the client, and every change is logged with its time, its before and after state, and its reason.

What we do not do with a client’s data. We do not:

• use a client’s personal data for our own purposes, or for another client;
• sell it, or share it for anyone else’s advertising;
• use it to train AI models.

What we learn about what works may be used to improve our service only in aggregated form that identifies neither the client nor any person.

The client’s own providers are not ours. The shop system, the advertising platforms, and Google Search Console are the client’s own service providers, under the client’s agreements with them. See section 09.

08Access to shops and advertising accounts

A client gives us access through its own accounts: a staff account or an app it installs in its shop, and partner access to its advertising accounts, granted in the advertising platform’s business settings. We ask for the access the agreed work needs and no more.

Data we receive through the advertising platforms. Through the access a client grants on Meta (Facebook and Instagram) and, where the agreement covers them, Google Ads and TikTok, we receive the advertising account’s structure, its campaigns, ads, creatives, budgets, spend, and results, the Page and Instagram account the ads run from, the pixel or dataset, the product catalog, and the audiences we create there. We use this data only to run, measure, and report on that client’s advertising, on that client’s instructions. We do not sell it, and we share it with no one except the client itself and the processors in section 09.

What we change, and what we do not. Within the limits agreed with the client we create, change, pause, and resume campaigns, ad sets, and ads. We do not change an ad account’s settings, payment method, pixel, or event definitions.

Keeping access safe. Access is limited to named team members, the accounts we use are protected with two-factor authentication, and any credentials or access tokens we hold are stored encrypted and never shared with third parties.

Ending access. A client can remove our access at any time in the shop’s or the advertising platform’s own settings, or ask us to give it up. When an agreement ends, we end our access to the shop and the advertising accounts, delete the audiences we created, and return or delete personal data within 30 days. The steps are in the Data Deletion Instructions.

The earlier Adara workspace. Until November 2026, LUNR also offered Adara as a workspace that advertisers signed in to and connected their Meta Ads, Google Ads, or TikTok Ads accounts to. That workspace was closed on 10 November 2026 and is offline. The account details (name, email address, and login identifiers), the connections and access tokens, and the advertising data read through them are no longer used for anything. Section 10 says when they are deleted, and you can ask us to delete yours sooner (section 11).

09Who receives data, and transfers outside the EEA

Not every recipient plays the same role, and the difference matters.

Processors acting for LUNR, under Article 28 data-processing agreements:

• Vercel — website hosting, serverless functions, the hosting of our own sales tool, and cookieless, anonymous Web Analytics.
• Supabase — the database of our own sales tool, where enquiries, free ad audit requests, and client contacts are recorded.
• Cal.com — the booking calendar for calls with us: your booking details, the confirmation and reminder emails, and rescheduling or cancelling.
• Google — Google Workspace, our email, calendar, documents, and meetings: bookings appear in our Google Calendar with a Google Meet link, calls take place on Google Meet, and a kickoff call is recorded there when the people on it agree.
• Slack — the shared channel in which we work with a client’s team.
• Anthropic — writes the short plain-language summary at the top of an emailed ad audit. It receives only the audit results (platform, spend, score and findings), not your email address or website.
• Resend — delivery of the free ad audit report to you and of the audit request to our inbox.
• Google — Google Analytics 4 (only with your consent).
• Microsoft — Clarity analytics (only with your consent).

We do not use a third-party CRM. Leads from our own campaigns, free ad audit requests, and the messages you send us are held in LUNR’s own systems: our own sales tool, our calendar, and email. They are not loaded into a sales or marketing platform, and there is no other recipient to disclose.

Sub-processors for a client’s data. Where LUNR is a processor (section 07), the sub-processors are listed in the client’s agreement, and the client is told in advance before one is added or replaced. At present they are Anthropic (analysis and drafting), Higgsfield (image and video generation from product images and brand material; no personal data), Slack(communication with the client), and Google Workspace (email, documents, and meeting recordings).

The advertising platforms and the shop system are not our processors.

• Meta Platforms, Google, and TikTok process advertising and lead data for their own purposes as well, under their own terms and privacy policies. TikTok states that it and the advertiser are each controllers for lead ads; Meta and Google likewise process lead form data under their own terms alongside the advertiser. Retrieving data through their APIs does not turn them into our processors, and we cannot answer for what they do with it.
• A client’s shop system, such as Shopify, is the client’s own provider, under the client’s agreement with it.

Transfers outside the EEA. Several of these providers process data outside the European Economic Area, principally in the United States. Each such transfer relies on a mechanism under Chapter V GDPR — in practice the European Commission’s Standard Contractual Clauses, supplemented, where a provider offers it, by certification under the EU–US Data Privacy Framework. We do not assert a particular safeguard for a particular recipient in this policy unless we have confirmed it in that provider’s current terms. If you want to know which mechanism covers a specific recipient, emailoffice@hellolunr.com and we will tell you what their terms say and give you a copy of the relevant clauses.

10How long we keep data

Website, enquiries, and outreach

• Email correspondence — kept while we deal with your request and for up to 24 months after our last exchange, then deleted.
• Call bookings — kept in Cal.com and our calendar while we deal with your enquiry and for up to 24 months after our last contact with you, then deleted. If you become a customer, they become part of the customer relationship.
• Free ad audit requests — your email, website, goal and audit results are kept for up to 24 months after our last contact with you, then deleted. The file you checked was never sent to us, so there is nothing of it to keep.
• People we contacted about our service — kept while the conversation is open and for up to 24 months after our last contact with you, then deleted.
• Analytics — Vercel’s daily visitor hash is discarded after 24 hours; Google Analytics retention is set to 14 months; Clarity retains session data up to 12 months.

Clients

• Client contacts and correspondence — kept for the life of the customer relationship and for up to 24 months after our last exchange, then deleted.
• Kickoff call recordings — kept for the term of the agreement and deleted within 30 days of its end.
• Data from a client’s shop and advertising accounts (section 07) — kept for the term of the agreement. When it ends, personal data is returned or deleted within 30 days, as the agreement sets out. Totals that identify no person, such as the monthly revenue figures behind a baseline or an invoice, may be kept for up to one year after the work ends.
• Contracts, invoices, and accounting records — kept for the period Finnish accounting law requires, currently six years from the end of the accounting year.

Leads from LUNR’s own campaigns

• Lead records we download into our own systems — kept while we are dealing with your enquiry and for up to 24 months from our last contact with you, then deleted. If you go on to become a customer, the record becomes part of the customer relationship and is kept under the contract and accounting rules above.
• Consent records, where you gave an optional consent — kept for as long as we rely on that consent and for 3 years after it is withdrawn or lapses, as evidence under Art. 7(1). Nothing more is kept for that purpose.
• Suppression records — if you ask us never to contact you again, we keep the minimum needed to honour that (normally a one-way hash of your email address) for as long as we operate, because deleting it would defeat your own request.

The earlier Adara workspace

• Account details, connections, access tokens, and the advertising data read through them — not used since the workspace closed on 10 November 2026. They are deleted by 8 February 2027 at the latest, and sooner if you ask.

What our retention does not reach. Ending our access does not delete data held by Meta, Google, TikTok, or a shop system in their own systems, which they keep under their own retention rules. Nor does it remove the campaigns in a client’s advertising account, which stay with the client. To have data removed there, go to that provider, or to the business whose account it is.

11Your rights under the GDPR

Whether you visited the site, wrote to us, heard from us, work with us as a client, or submitted a lead form, you have the right to:

• Access the personal data held about you.
• Rectify data that is wrong or incomplete.
• Erase your data (“right to be forgotten”) — see below and our Data Deletion Instructions.
• Restrict processing, or object to processing based on legitimate interests.
• Object to direct marketing at any time — an absolute right under Art. 21(2), with no balancing test.
• Port your data to another service in a machine-readable format.
• Withdraw consent at any time, without affecting processing that already happened.

How to ask, including for deletion. Emailoffice@hellolunr.com from the address we know you by and tell us what you want. For deletion, use the subject line “Data Deletion Request”. Give us enough to find your record: the email address you used and roughly when. We respond within one month. TheData Deletion Instructions describe the steps and what happens next.

Who to ask depends on whose data it is.

• If you used this site, wrote to us, heard from us, are a contact at a client, had an Adara workspace account, or submitted one of LUNR’s own lead forms — email office@hellolunr.com.
• If you visited or bought from a shop that works with LUNR — that shop is your controller, not us. Contact the shop, using its own privacy notice. If you write to us instead, we point you to the shop where we can identify it, and we pass your request on. Under our agreement with the shop we help it answer such requests — but we cannot decide them, and we will not disclose or delete a client’s data without the client’s instruction.

Where a request concerns sensitive detail we may ask you to confirm your identity; that is only to check it is you, and we delete whatever you send for that check once it is done.

If you believe we have not handled your data lawfully, you may lodge a complaint with theFinnish Data Protection Ombudsman(tietosuoja.fi (opens in a new tab)) or your local supervisory authority.

12Security

We protect personal data with technical and organizational measures appropriate to the risk: encryption in transit, encrypted storage of credentials and access tokens, two-factor authentication on the accounts we use, access controls limited to people who need it, and data minimization by design — including, for a client’s shop, working with order data and not with customers’ names or contact details. No system is perfectly secure, but we treat your data the way we would want ours treated.

13Children

Our services are not directed at children under 16, and we do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will delete it.

14Changes to this policy

We will post any changes on this page and update the date above. For material changes, we will provide a clear notice on the site before the change takes effect.

A policy update is not a permission slip. We will not use a revision of this page to authorize a new use of data you have already given us. Where a new purpose needs consent, we ask you for it separately, before we start.

November 12, 2026 — rewritten for LUNR’s growth service. Added clients’ contact people, people we contact about our service, how we handle a client’s shop and advertising data as its processor, and access to shops and advertising accounts (sections 01, 02, 05, 06, 07, 08, 10 and 11). Added Supabase, Slack, and the sub-processors for a client’s data as recipients (09), and how to request deletion (11). Removed the sections on the Adara workspace, which closed on 10 November 2026; sections 08 and 10 say what happens to its data. Also added call bookings through Cal.com and the free ad audit (sections 02, 04, 05, 09 and 10), added Cal.com, Google Workspace and Anthropic as recipients, and removed the website contact form, which no longer exists.

September 5, 2026 — added disclosures covering Adara’s foreground activity and Brand-attention records, optional Attention required emails, Resend’s operational email-delivery role, delivery and suppression metadata, unsubscribe controls, and the corresponding retention and deletion rules.

August 31, 2026 — added lead-generation forms (section 03), separated LUNR’s controller and processor roles (01), split purposes and legal bases per purpose (05), added marketing consent and withdrawal (06), described Adara’s fetch-and-export processing (07), corrected recipient roles and transfer wording (09), and added lead-specific retention (10). Removed the waitlist, which no longer exists.

15Contact