Privacy Policy

1. Data controller

Davide Nero, sole trader, VAT number 04051930131, registered at Via Salvo D'Acquisto 197, 22038 Tavernerio (CO), Italia.

For any request about your data: trust@luneaistudio.com. No Data Protection Officer has been appointed, as the conditions of Article 37 GDPR do not apply.

2. What data we process

Account data — email address, organisation identifier, registration date. Sign-in uses a one-time link: we do not process passwords.

Billing data — handled by Stripe. We do not store your card details, and they never pass through our systems.

Material you upload — photos and videos, including images of the people appearing in them.

Prompts and generated content — the text you write, the compiled prompt and the output produced.

Rights declarations — the exact text you accepted, the language, your IP address, your browser and the time of acceptance. They exist to prove what was declared, which is why they are retained.

Technical and moderation logs — necessary for security and abuse prevention.

3. Purposes and legal bases

Providing the service — performance of the contract (Art. 6.1.b).

Billing and tax obligations — legal obligation (Art. 6.1.c).

Security and abuse moderation — legal obligation and legitimate interest (Art. 6.1.c and f).

Improving presets using aggregated data — legitimate interest (Art. 6.1.f). You may object by writing to the controller.

Marketing — only with your consent (Art. 6.1.a), which you can withdraw at any time.

4. Our roles

We are the controller for your account data, billing and security.

We are a processor acting on your behalf for the material you upload and the people appearing in it: that data is yours, and we process it on your instructions. It is for you to hold the consent of the people portrayed.

5. Who we share data with

The following process data on our behalf, each for its own part:

- muapi.ai — video and image generation (outside the EU).

- fal.ai — generation, as fallback (outside the EU).

- OpenAI — prompt rewriting and text moderation (outside the EU).

- Anthropic — prompt rewriting, as fallback (outside the EU).

- ElevenLabs — voice-over, when requested (outside the EU).

- Supabase — database, authentication and file storage (EU).

- Stripe — payments and billing (EU and outside the EU).

- Netlify — website hosting (outside the EU).

- Fly.io — video processing and provenance signing (EU (Paris)).

This list is current as of the date above. We will announce any change on this page.

6. Transfers outside the European Union

Some of the providers listed above operate outside the European Union. In those cases the transfer relies on the Standard Contractual Clauses adopted by the European Commission, or on an adequacy decision where applicable.

⚠️ If you upload images of identifiable people, those images are also processed by providers outside the EU. Take this into account when collecting the consent of the people portrayed.

7. How long we keep data

Generated content — 12 months. Uploaded material — 90 days. Tax data — 10 years, as required by law. Rights declarations and moderation logs — for as long as needed to defend a legal claim.

You may request shorter retention, and deleting your account removes your content within the periods above.

8. Automated decisions

Content moderation is automated: a filter may block an upload or a generation without human involvement. You have the right to obtain human review of the decision by writing to the controller, to state your position and to contest the outcome.

9. Your rights

You may at any time request access, rectification, erasure, restriction, data portability, and object to processing based on legitimate interest. We respond within 30 days.

Write to trust@luneaistudio.com. If you believe the processing breaches the law, you may lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or the authority of your country of residence.

10. If you appear in material uploaded by someone else

If someone has uploaded images of you, the controller for that data is that person, not us: we act as a processor on their behalf. You can still write to our address and we will help you reach them, or step in directly if the report concerns unlawful content.

To have content about you removed, use the Report an infringement page.

11. Cookies

We use only technical cookies: the session cookie that keeps you signed in, and the one that remembers your chosen language. We use no profiling cookies, there is no advertising, and no third-party analytics tool is installed.

We count page views, without cookies and without personal data. We record the day, the page path, the language and the host you arrived from (for example “google.com”). We do not record your IP address, your browser, any identifier or the time of day: there is no row per visit, there is a counter that goes up. You cannot be identified from it, and two visits cannot be linked to each other. The signed-in area — the studio and sign-in — is not counted.

That is why you do not see a consent banner: technical cookies do not require one, and the counter processes no personal data. If we ever introduce tools that do, a banner will appear and this section will change before that happens.