Privacy policy
Last updated: October 5, 2026
Luno is run by sittingonacornflake CommV, Toekomststraat 74, 9040 Sint-Amandsberg, Belgium, enterprise number 0479.620.359. For your account and the waitlist we are the controller. For the feedback your users send through Luno we are a processor: we handle it on your behalf and only to provide the service.
What we collect and why
| Data | From whom | Why | Legal basis |
|---|---|---|---|
| Email address on the waitlist | Visitors who join | To send one email when Luno opens, with early-bird pricing | Consent |
| Account: email, password (stored hashed), workspace, plan | Customers | To run your account and the service | Contract |
| Feedback: message text, optional sender email, platform, app version, device identifier | Your end users, via the widget, LunoKit or a feedback page | To sort it and show it to you | Processing on your behalf |
| Push tokens | Customers using the Luno iOS app | To send you notifications | Contract |
| Subscription status: customer and plan identifiers from Paddle | Customers on a paid plan | To give you the right plan | Contract |
| Technical logs: IP address, request time, errors | Everyone who uses Luno | Security and fixing problems | Legitimate interest |
We never see card details: Paddle handles payments as our reseller. We don't sell data, show ads or build profiles.
Processors and where your data lives
| Processor | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | EU (Frankfurt) |
| Vercel | Hosting the app and its functions | EU region (Frankfurt); US company |
| Mistral AI | Sorting feedback | EU (France) |
| Apple | Push notifications to the Luno iOS app | US |
| Paddle | Payments, as reseller and merchant of record (paid plans only) | UK |
Transfers outside the EEA rely on an adequacy decision of the European Commission (for the UK, and for US providers certified under the EU-US Data Privacy Framework) or on the Commission's standard contractual clauses.
Sorting with AI
To sort feedback, Luno sends the message text to Mistral AI, an EU provider. Mistral returns a category, urgency and the group it belongs to. Mistral does not use this data to train its models. We don't send feedback to any provider outside the EU.
How long we keep it
- Waitlist emails: until we send the launch email, then within 30 days, or sooner if you ask.
- Account data: as long as your account exists, then deleted within 30 days.
- Feedback: until you delete it, the project or your account.
- Technical logs: at most 30 days.
Security
Data is encrypted in transit. Every customer's data is separated at database level, so one workspace cannot read another. Access to production is limited to the founder.
Cookies
The website at getluno.app sets no cookies and runs no analytics. The dashboard only uses the cookies it needs to keep you signed in.
Your rights
You can ask to see, correct, export or delete your data, to restrict or object to its use, and to withdraw consent for the waitlist at any time. Email luno@johanraes.be; we reply within 30 days. You can also complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit).
Are you someone who sent feedback to an app that uses Luno? That app decides what happens with your feedback. Contact them first; we help them answer you.
Changes
When this policy changes in a way that matters, we email customers before it takes effect. The date at the top shows the latest version.