LunieAI

Privacy Policy

Last updated: 9 September 2026

This document is not finalIt accurately describes how the software handles data, but the operating company’s registered details are still to be confirmed and it has not yet been reviewed by a legal adviser. It should not be relied on as published policy until both are done.

Two different roles

LunieAI handles personal data in two distinct situations, and your rights differ between them:

  • If you have a LunieAI account — we are the controller of your account data, and this policy governs it directly.
  • If you chatted with a chatbot on someone else’s website — that website’s operator is the controller. LunieAI is only their processor: we store and process the conversation on their instructions. Requests about that conversation should go to the website operator, though we also offer a direct route below.

Part 1 — If you have a LunieAI account

What we hold

  • Your email address, display name and profile photo, if you set one.
  • Your authentication credentials, held by Google Firebase Authentication. We never see or store your password.
  • The chatbots you create and their configuration.
  • The content you upload or ask us to crawl for training: files, text, Q&A pairs and website pages, together with the search index built from it.
  • Usage records: message counts, model usage and API keys you generate.

Why, and on what legal basis

  • To provide the service (Art. 6(1)(b), performance of a contract) — running your chatbots, storing your training content, generating replies.
  • To keep the service working and secure (Art. 6(1)(f), legitimate interests) — rate limiting, error logs, abuse prevention. IP addresses used for rate limiting are hashed and held in memory only; they are never written to the database.
  • To meet legal obligations (Art. 6(1)(c)) — for example keeping a record that a deletion request was carried out.

How long we keep it

Account data is kept while your account is open. When you delete your account it is erased immediately and permanently — see below. We keep a minimal record that the deletion happened (your user id, email address and timestamp), because we have to be able to demonstrate we honoured the request.

Your rights

You can exercise these directly from your profile page:

  • Access and portability (Art. 15, Art. 20) — “Download my data” produces a complete JSON export.
  • Erasure (Art. 17) — “Delete Account” permanently removes your profile, chatbots, conversations, messages, uploaded files, crawled content, search indexes and login. It cannot be undone.
  • Rectification (Art. 16) — edit your name and email on the profile page.

You also have the right to object to or restrict processing. If you would rather make any of these requests by email than use the buttons above, contact us at the address at the end of this policy and we will action it within 30 days.

Part 2 — If you chatted with a chatbot on a website

What is stored

  • The messages you send and the replies you receive.
  • A randomly generated session identifier for the conversation, so replies can be matched to the right chat.

What is deliberately not stored

These are worth stating plainly, because chat widgets commonly do all of them:

  • No cookies, and no browser storage. The widget sets none. Your session identifier exists only in the page’s memory and is gone when you close the tab.
  • No tracking across websites or sessions.
  • No IP address or browser fingerprint is stored against your conversation.
  • No advertising, analytics or profiling.

Who is responsible

The operator of the website you were using decides why the chatbot exists and what it is for, which makes them the controller. LunieAI stores the conversation on their behalf. They choose how long conversations are kept.

Deleting your conversation

While the chat is still open, you can delete the conversation and all of its messages from the widget’s privacy menu. This is immediate and permanent.

Once you close the tab we have no way to identify you — which is a deliberate privacy property, not an oversight, but it does mean we cannot look your conversation up afterwards. If you need it deleted later, contact the website operator, who can find and delete it. Conversations are also deleted automatically once the operator’s retention period expires.

Automated processing

Replies are generated by a large language model (Google Gemini) from the operator’s own published content. It answers questions; it does not make decisions about you, and there is no profiling or automated decision-making with legal or similarly significant effects.

Who else processes the data

We use a small number of subprocessors, including providers in the United States. They are listed individually, with what each one receives, on our subprocessors page.

Security

Data is encrypted in transit. Access is restricted to the account it belongs to and enforced on the server. Uploaded files and generated exports are served only to authenticated requests.

How to contact us

LunieAI is operated by [company legal name to be confirmed], [registered address to be confirmed].

For anything in this policy — including a request to access, correct, export or delete your data — write to [privacy contact email to be confirmed]. We aim to respond within 30 days, which is the maximum the GDPR allows.

We do not currently have a Data Protection Officer. One is required only where an organisation carries out large-scale systematic monitoring or processes special category data at scale, and LunieAI does neither: we do not profile visitors, track them across sites, or ask for sensitive categories of data.