Privacy Policy
Last updated: March 2026
Effective and last updated: 4 September 2026.
This notice explains how Luna's Circle handles personal information on lunascircle.com and in connected service features. Contact [email protected] for privacy questions or requests.
1. Information we handle
- Account and security data: email address, optional display name, password hash, sessions, verification and reset status, and security events. Current public signup and newsletter forms do not ask for a birth date or zodiac sign. If an older account still contains a legacy preference, it can be reviewed or removed from Account settings.
- Content you choose to provide: prompts, questions, randomized card results, generated responses, journal entries, saved notes, feedback, and support messages, depending on the feature.
- Purchase records: product, order, subscription, fulfillment, refund, and Stripe customer, checkout, or payment references. Stripe processes payment-card details; Luna's Circle does not receive or store the full card number.
- Newsletter records: email address, optional name, coarse signup source, confirmation time, and unsubscribe status. A request remains pending until its confirmation link is used; it receives no marketing newsletter while pending.
- Device and operational data: IP address, user-agent and request information, cookie or browser-storage choices, rate-limit signals, and diagnostic or security logs.
- Optional analytics: page and interaction measurements load only after an explicit Accept All choice and remain disabled for Essential Only or an enabled Global Privacy Control signal.
2. Why we use it and our legal bases
Where data-protection law requires a legal basis, we use:
- Contract: to create and secure an account, provide a requested feature, process and fulfill a purchase, manage a subscription, and respond about an order.
- Consent: for optional analytics and confirmed marketing email. You can change cookie choices in the footer and unsubscribe from any newsletter. Withdrawing consent does not change the lawfulness of earlier processing.
- Legitimate interests: to prevent abuse and fraud, diagnose failures, secure the service, maintain reliability, and understand aggregate operations, when those interests are not overridden by your rights.
- Legal obligation: to keep records or respond to valid requests when the law requires it.
We do not use service content to make solely automated decisions that produce legal or similarly significant effects about you.
3. AI processing
When you request an AI-assisted feature, the prompt and relevant context needed for that request may be sent to Anthropic or another configured AI-model provider to generate a response. Depending on the feature and your choices, the prompt and response may also be stored in your account history. AI output can be wrong. Do not provide sensitive or third-party information that is unnecessary for the request.
4. Providers and disclosures
We disclose limited information to providers that operate the service on our behalf or when legally required. Provider categories currently include hosting and storage; configured AI-model providers, including Anthropic; Stripe for payment and billing; Brevo or configured email delivery services; and Google Analytics and Brevo measurement only after analytics consent. If you choose to interact with a connected Telegram feature, Telegram also processes that interaction under its own terms.
We do not sell personal information for money. Some privacy laws define targeted advertising or certain analytics disclosures as a “sale” or “sharing.” Optional analytics is disabled without Accept All, and an enabled Global Privacy Control signal is honored as Essential Only. You can reopen Cookie settings in the footer at any time.
TikTok advertising measurement
With your advertising consent through Accept All, selected public pages and neutral conversion confirmation pages load TikTok Pixel (ID DAJ1HOBC77UC8FLK3VKG). TikTok receives technical browser and network information, cookies, page visits and completed registration, checkout-start and verified purchase events, including purchase amount and currency. This helps measure and improve advertising and may be used by TikTok for ad personalization under its own privacy policy. We do not enable automatic advanced matching or enhanced page-content postback, and do not send email addresses, phone numbers, private readings, journals or chat through this integration. TikTok Pixel is excluded from private tool and account pages.
Choosing Essential Only disables this integration. Prior analytics permission alone does not enable it. Global Privacy Control overrides advertising consent. You can withdraw through Cookie settings in the footer; withdrawal prevents future measurement and does not recall data already received by TikTok. TikTok may process data outside your country. See TikTok's Privacy Policy.
5. Retention
| Data | Retention approach |
|---|---|
| Account, sessions, and account content | Kept while needed to provide the account or until you delete the content or account, subject to limited security, dispute, and legal exceptions. Expired sessions and reset records are removed through lifecycle controls. |
| Pending newsletter request | No marketing is sent. An unconfirmed request becomes eligible for deletion after 7 days and is removed during routine newsletter lifecycle cleanup. |
| Confirmed newsletter and suppression status | Kept until unsubscribe; a limited suppression record may remain as needed to honor the opt-out. |
| Purchase and payment references | Kept as needed for fulfillment, accounting, tax, fraud prevention, disputes, and legal obligations. Stripe keeps its own records under its policy. |
| Operational and security logs | Kept only as long as reasonably needed for security, debugging, reliability, and legal requirements; the period depends on the event and risk. |
| Optional analytics | Controlled by the configured provider settings and your consent. Choosing Essential Only stops future optional collection on this site; provider-held records follow provider controls. |
| De-identified or aggregate information | May be retained when it no longer reasonably identifies a person. |
6. Your choices and rights
Depending on where you live, you may have rights to know or access personal information; correct it; delete it; receive a portable copy; restrict or object to processing; withdraw consent; and opt out of certain sale, sharing, targeted advertising, or profiling. We do not discriminate against you for using a privacy right.
Account controls provide access to saved data and account deletion where available. You can also email [email protected]. Describe the request and the account email, but never send a password or full payment-card number. We may need to verify the request and may retain information when an exception applies. You may complain to the data-protection or consumer-privacy regulator where you live.
7. International processing
Luna's Circle and its providers may process information in the United States and other countries. Where applicable law requires a transfer safeguard, we rely on the provider's recognized contractual or legal transfer mechanism.
8. Security
Safeguards include HTTPS, Secure and HttpOnly session cookies on HTTPS, same-origin and anti-forgery controls for authenticated changes, rate limiting, access controls, and versioned PBKDF2-SHA256 password hashing. No online service can promise absolute security. Contact [email protected] if you suspect account misuse.
9. Children
The service is not directed to children, and purchases require age 18 or older. If you believe a child provided personal information, contact the privacy address so the report can be reviewed and appropriate deletion steps taken.
10. Changes and contact
Material changes will be posted here with an updated date, and additional notice or consent will be provided when required. Privacy questions and rights requests: [email protected]. General support: [email protected].