Privacy
Policy

How to contact us about your data

Write to us in your existing verified LUNATERRIA Telegram Business or WhatsApp Business conversation. You may also use the feedback form or write to the correspondence address. We do not ask for a copy of your identity document by default; any identity check will be proportionate to the request.

What data we use and why

• Telegram or WhatsApp channel identifier, language, messages and interactive choices — to respond, maintain the conversation and accept an order.
• Technical WhatsApp statuses — sent, delivered, read and failure events, plus minimal consent and withdrawal receipts — to deliver requested messages and respect your choices.
• Name or preferred name, and date, time and place of birth, as well as sex for certain methods — to perform the selected calculation and prepare the report.
• Order, price, currency, payment status and proof of delivery — to fulfil the contract, handle enquiries and meet accounting requirements.
• Limited technical events without message content — for security, abuse prevention and incident investigation.
• De-identified website usage events — page views, language, product interest, sample previews and downloads, Telegram clicks, successful form submissions, country code, coarse device category and advertising UTM tags. We use them to understand whether the website is useful and to improve it. The analytics system does not store IP addresses, full User-Agent strings, precise location, form text or contact details; it stores only the category “human”, “bot” or “unknown”.
• Email address or phone number for news — only with separate, voluntary consent that can be withdrawn.
• The feedback-form message, source URL, a technical identifier linking the submission to an order or client, and any attached screenshots — to understand the context, investigate the issue and communicate the outcome.

The primary legal basis for processing an order is taking steps before entering into a contract and performing that contract. Accounting records are processed to meet legal obligations. Minimal security logs and first-party website statistics are processed under our legitimate interest in protecting and improving the service with minimal privacy impact. Marketing is not a condition of purchase.

What not to send

Do not send medical records, payment-card numbers, your precise current location, home address, passwords, copies of identity documents or another person’s data unless you have lawful authority to do so. Direct orders are accepted from adults only.

The LUNATERRIA team and service providers

The service is provided by the LUNATERRIA team. To prepare and deliver materials, the team may use internal technical tools and engage infrastructure, communications, hosting, security and payment providers only to the extent required to operate the service.

The LUNATERRIA team is responsible for preparing and reviewing the materials. Internal tools and the providers listed below may be used for specific technical operations; they do not independently determine the content of a product.

The service may use Telegram, the WhatsApp Business Platform (Meta), Hetzner, Cloudflare, OpenAI, Ahrefs and the active payment provider. Google Apps Script, Google Sheets and Google Drive are used to receive news sign-ups, record feedback submissions, and store the supplied source URL and screenshots uploaded by the user. Transfers outside the EEA take place only where an applicable legal basis and safeguards are in place.

The exact Meta contracting entity, the parties’ roles, applicable processing terms, subprocessors, processing locations and international-transfer safeguards are recorded only from the executed WABA documents. During public acceptance testing, WhatsApp is used only for conversations initiated by the customer on the website or in WhatsApp. The channel is not used for marketing broadcasts or LUNATERRIA-initiated messages outside the permitted service window; this policy does not assert an unverified contractual role for Meta.

Retention periods

• a processed WhatsApp webhook queue item — no more than 30 days after completion, unless an incident hold applies;
• closed support conversations — 90 days, unless needed for an open order, a dispute or a legal obligation;
• WhatsApp provider-media cache — no more than 29 days, and less where the file is no longer needed;
• a minimal consent or withdrawal receipt without source text — 24 months after withdrawal, so that an unwanted send is not restarted;
• birth data and the completed report — 24 months after the last activity, or until an earlier confirmed deletion;
• accounting evidence of a transaction — at least five years, or longer if required by law or an unresolved claim;
• ordinary production logs — 30 days; secure security receipts without conversation content — 12 months;
• de-identified website statistics events and a one-way hash of the temporary session identifier — no more than 180 days;
• the feedback-form message, source URL, technical link to an order or client, and attached screenshots — until the review is completed and for a further 90 days; longer only where required for an unresolved dispute or legal obligation;
• marketing contact details — until consent is withdrawn; a minimal suppression record is then retained for 24 months.

Erasure from the live system creates a tombstone so that deleted data is not restored from a backup. A record that must be retained by law is restricted rather than erased, and the reason for the exception is explained in the response.

Your rights

You may request access, a copy and portable export, rectification, erasure or restriction, object to processing based on legitimate interests, or withdraw consent. We respond without undue delay and normally within one month. An export excludes provider secrets, another person’s data and internal security material. You may also lodge a complaint with the Datu valsts inspekcija, the Latvian Data State Inspectorate.

Europe and other countries

For users in the EEA, the GDPR and Latvian law apply. Users in CIS countries receive the same baseline safeguards and rights, while any mandatory rules of the user’s country apply to the extent that they govern the service. Because the CIS is not a single legal regime, country-specific requirements must be assessed separately before commercial launch in that country.

Cookies and website statistics

The website uses first-party de-identified statistics without cookies. To estimate unique sessions, the browser tab creates a random temporary identifier in sessionStorage; only its one-way hash is sent to and stored by the server. An event may also include the two-letter country code determined at the network edge, the coarse device category “desktop”, “mobile”, “tablet” or “unknown”, the referring domain and strictly limited UTM tags. Precise location and the full User-Agent string are not stored. The temporary identifier disappears from the device when the browser session ends and is not linked to Telegram, a subscription, a bug report or an order.

Public pages also use cookie-free Ahrefs Web Analytics. It helps us review acquisition sources, popular pages and link interactions directly in the Ahrefs SEO workspace. Ahrefs receives the page URL, referring domain, page title, browser language and coarse screen parameters; it does not receive conversation text, birth details, form contents, orders or completed reports. Feedback, payment, internal analytics and error pages are excluded. Ahrefs states that it does not store IP addresses with analytics data or track a visitor across days.

Separately, Ahrefs Bot Analytics receives a server-side event only when a request’s User-Agent clearly identifies an automated search, AI or SEO crawler, and only for public website documents. Query parameters and URL fragments are removed before transfer; APIs, feedback forms, payment, internal analytics and other utility routes are excluded. An event may include the sanitized URL and query-free referrer, the crawler’s technical IP address and User-Agent, HTTP method, status and content type. We use this to monitor indexing and crawl activity. Ordinary visitors, form text, conversations, birth details, orders and reports are not sent through this stream. An Ahrefs failure or exhausted quota cannot affect the website response.

Google Analytics 4 is loaded only after the visitor gives separate, voluntary consent. It helps us understand audience size, engagement, acquisition channels and popular pages. Google Analytics may store analytics cookies and process technical data under Google’s privacy terms.

Meta Pixel and the Google Ads tag are loaded only after separate marketing consent and only when the corresponding integration has been activated by the LUNATERRIA team. They are used to evaluate advertising campaigns, product interest and Telegram clicks. Google Ads personalisation and enhanced conversions are disabled. These browser events never include conversation text, birth details, contact data, order contents or completed reports. A purchase event is not recorded without a confirmed transaction and its correct identifier.

Your analytics and marketing choices are stored in localStorage and can be changed through “Privacy settings” in the website footer. Refusing consent does not restrict the website and does not disable the first-party de-identified statistics. Browser analytics settings do not control the narrowly scoped server-side measurement of crawler requests because it does not track ordinary visitors and is used under our legitimate interest in monitoring the availability and indexing of the public website.

WhatsApp messages

A conversation you start opens only WhatsApp’s limited reply window; it does not consent to later messages or marketing. A service message initiated by LUNATERRIA outside that window requires separate recorded permission and a provider-approved template where required.

To stop service and transactional messages on WhatsApp, write “stop messaging me on WhatsApp” or “opt me out of WhatsApp messages” in the existing verified conversation. The withdrawal takes effect before the next message is queued and does not cancel an order or subscription; that requires a separate explicit request.