Service privacy notice

0. Status of this document

This is a draft, not yet reviewed by a lawyer. It describes processing as it is actually carried out today; it will be replaced after review.

1. Data controller

Davide Nero, sole trader, Italian VAT number 04051930131, registered at Via Salvo D'Acquisto 197, 22038 Tavernerio (CO), Italia.

For any request about your data: info@luneaistudio.com. No Data Protection Officer has been appointed, the conditions of Article 37 GDPR not being met.

2. What we process

When you write on WhatsApp or by email: your number or address, your name or your business name, and the content of the messages.

When you send material: the photos and files you send for the work. They may contain images of places, products and — if you send them — of people.

For invoicing: company name, VAT number, registered address and the other mandatory tax details.

On the website: an aggregate counter of page views and of clicks on the WhatsApp button. Day, page and source, nothing else: no IP address, no identifier, no profiling cookie. No one can be identified from it.

3. Why we process it

To answer your requests and to carry out the work you commission: the legal basis is performance of the contract or pre-contractual steps you ask for (Art. 6.1.b GDPR).

For tax and accounting obligations: legal obligation (Art. 6.1.c).

To understand which pages work, with the aggregate counter described above: it processes no personal data.

4. Who we send it to

Meta (WhatsApp) — the channel you write on. Messages pass through its infrastructure under WhatsApp's own terms, which you accept directly with Meta. Outside the EU.

Higgsfield Inc. (535 Mission St, San Francisco, California) — processing of the photos and generation of the content. This is the provider the material you send passes through. Outside the EU: the United States, with a declared location in Kazakhstan as well.

⚠️ Higgsfield states in its own terms that it uses uploaded content to train its models. We write this because it is true and verifiable, not because it suits us: its Terms of Use read that «Your Content, Inputs, and Outputs may be used by Company to train, develop, enhance, evolve, and improve its (and its affiliates') AI models». The exclusion applies only to customers under an enterprise agreement, which we do not currently hold. Content already incorporated into a trained model cannot be extracted from it. If this matters to you, say so before sending material: we can decide together whether to proceed.

Google (Workspace) — the mailbox behind info@luneaistudio.com. Emails and attachments you send us pass through it. Processing also outside the EU.

No external editor: editing is done by the owner. Once downloaded, the photos you send stay in a local folder on his computer, outside iCloud, Drive and any sync service — so the 90-day deletion really does cover every copy we control.

Netlify — website hosting. Outside the EU (USA).

Supabase — the website database, where the aggregate counter lives. EU.

Accountant and advisors for tax compliance, to the extent necessary.

⚠️ List current as of 11 October 2026. If we start using other providers, this section will change first.

5. Transfers outside the European Union

Some of the providers above are established outside the European Union, in countries without an adequacy decision from the Commission.

Higgsfield states in its own privacy policy that it relies on appropriate safeguards, naming the standard contractual clauses approved by the European Commission: «we seek to use specific appropriate safeguards […] for example, standard-form contracts approved by relevant authorities for this purpose (e.g., Standard Contractual Clauses / 'SCCs' as approved by the European Commission)».

⚠️ Transparency statement, and it should be read in full: that is a unilateral statement in their privacy policy, not a data processing agreement signed with us. No such agreement appears to be publicly offered. The contractual formalisation of these transfers is therefore not complete. If this matters to your business, write to us before sending material.

6. How long we keep it

The photos and material you send: for the duration of the work and for 90 days after delivery, so we can handle revisions and re-deliveries. After that they are deleted from our archives. If you ask us to delete them sooner, we do.

⚠️ Those 90 days are OUR limit. The third-party providers listed in section 4 apply their own retention rules, which are not ours to set: if this matters to your business, write to us before sending material.

The content we deliver to you: kept for 12 months, so you can ask for it again if you lose it.

WhatsApp and email conversations: for as long as needed to manage the relationship and any dispute.

Tax documents: for the periods required by law, ten years.

6-bis. Cookies and tracking

This site uses no profiling cookies, no third-party cookies and no external analytics. That is why there is no banner: there is nothing to consent to.

The only cookie the site may write is the one remembering your chosen language, if you switch it at the top: a technical cookie, lasting a year, containing nothing but `it` or `en`.

Visits are counted in aggregate — day, page, source — by a counter running on our own domain. It records no IP address, issues no identifier and follows no one from page to page: no person can be identified from those numbers.

6-ter. Providing data, and automated decisions

Giving us your data is optional, but without it the work cannot be done: without the photos there is nothing to process, and without a VAT number and company name we cannot invoice and therefore do not accept the order.

There is no automated decision-making, profiling included, producing legal effects concerning you or similarly significantly affecting you (Art. 22 GDPR). Decisions about your material are made by a person.

7. Your rights

You can request access, rectification, erasure, restriction and portability of your data, and object to processing in the cases provided for. Write to info@luneaistudio.com: we reply within one month.

If you believe the processing infringes the Regulation you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

8. People in photos: there should be none

⚠️ We ask for photos with no recognisable people, and this is the rule that removes the problem rather than managing it. By sending material you declare that you hold the rights to it and that it does not show identifiable faces or people.

The reason is concrete: the material passes through a non-EU provider that also uses it to train its own models (section 4). Processing a person's image in that context would require their informed consent along a chain we do not control. It is more honest to keep it out.

If someone appears in a photo we notice and tell you before starting, asking you to replace it.

If you are a person shown in material someone else sent us, write to info@luneaistudio.com: we check and delete.