Privacy policy

Lunora d.o.o., 44400 Glina, Croatia, OIB 00000000000, is the controller of your personal data. For anything related to privacy, write to hello@lunora.hr.

• When you send an enquiry: your name, email address, company (optional), the type of project, a budget range (optional) and your message.
• To stop spam and abuse: a one-way hash of your IP address combined with a secret key. It can't be turned back into your IP address, and we delete it after 30 days.
• When you visit any page: our hosting provider processes technical data (IP address, browser, time of the request) to deliver the page and keep the site secure. We don't use it to identify you.

The public website uses no cookies, analytics or advertising trackers. The staff-only admin area uses strictly necessary session cookies for signed-in staff.

• To answer your enquiry and prepare an offer — steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
• To protect the form against spam and abuse and keep the site secure — our legitimate interest (Article 6(1)(f) GDPR).

We never sell your data or use it for marketing, and we won't add you to a newsletter.

• Vercel Inc. — hosts the website.
• Supabase Inc. — stores enquiries in its database.
• Resend — delivers email notifications about new enquiries to our inbox.

They process data only on our instructions, under data processing agreements. Some are based in the United States; where data leaves the European Economic Area, the transfer relies on the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

Enquiries are deleted automatically 24 months after we receive them, unless the enquiry leads to a contract — then we keep what the law requires for that contract. IP hashes are deleted after 30 days.

To find businesses that might need a new website, we look at public information: business listings on OpenStreetMap and the homepage of the business's own website. We keep only the business name, sector, city and website, plus notes about the site — for example whether it works on phones. We don't collect names, email addresses or phone numbers.

To assess a website we may use Claude, an AI service from Anthropic, to read the public text of the business's homepage (and up to two other pages of the same site) and summarise what could be improved, and to help us draft a message. Email addresses and phone numbers are removed before the text is sent. Anthropic processes the text on our behalf; we keep only the resulting notes.

If we get in touch, we do it one business at a time, through the contact channel the business publishes. Our legal basis is our legitimate interest in offering our services to businesses (Article 6(1)(f) GDPR). If you'd rather not hear from us, just say so: we record it permanently and never contact you again. Business records we haven't worked with are deleted after 24 months; the opt-out record is kept so we can keep respecting it. If we write to a business, we keep a copy of that message and the date, so we can send at most one short follow-up and don't contact anyone twice.

You can ask for access to your data, its correction or erasure, restriction of processing or a copy in a portable format, and you can object to processing based on our legitimate interest. Write to hello@lunora.hr; we reply within one month.

You can also lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, azop.hr).

If we change this policy, we'll update the date at the top of this page.