Privacy policy

Lunora, obrt za ostale informacijske uslužne djelatnosti, vl. Marijo Mikša, Glina, Poljari 3, Croatia, OIB 22160883666, is the controller of your personal data. For anything related to privacy, write to hello@lunora.hr.

• When you send an enquiry: your name, email address, company (optional), phone number (optional), the type of project, a budget range and timeline (both optional) and your message.
• To stop spam and abuse: a one-way hash of your IP address combined with a secret key. It can't be turned back into your IP address, and we delete it after 30 days.
• When you visit any page: our hosting provider processes technical data (IP address, browser, time of the request) to deliver the page and keep the site secure. We don't use it to identify you.

The public website uses no cookies, analytics or advertising trackers. The staff-only admin area uses strictly necessary session cookies for signed-in staff.

• To answer your enquiry and prepare an offer. These are steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
• To protect the form against spam and abuse and keep the site secure, which is our legitimate interest (Article 6(1)(f) GDPR).

We never sell your data or use it for marketing, and we won't add you to a newsletter.

• Vercel Inc. hosts the website.
• Supabase Inc. stores enquiries in its database.
• Resend delivers email notifications about new enquiries to our inbox.

They process data only on our instructions, under data processing agreements. Some are based in the United States; where data leaves the European Economic Area, the transfer relies on the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

Enquiries are deleted automatically 24 months after we receive them, unless the enquiry leads to a contract, in which case we keep what the law requires for that contract. IP hashes are deleted after 30 days.

To find businesses that might need a new website, we look at public information: business listings on OpenStreetMap and the homepage of the business's own website. We keep only the business name, sector, city and website, plus notes about the site, for example whether it works on phones. We don't collect names, email addresses or phone numbers.

To assess a website we may use Claude, an AI service from Anthropic, to read the public text of the business's homepage (and up to two other pages of the same site) and summarise what could be improved, and to help us draft a message. Email addresses and phone numbers are removed before the text is sent. Anthropic processes the text on our behalf; we keep only the resulting notes.

If we get in touch, we do it one business at a time, through the contact channel the business publishes. Our legal basis is our legitimate interest in offering our services to businesses (Article 6(1)(f) GDPR). If you'd rather not hear from us, just say so: we record it permanently and never contact you again. Business records we haven't worked with are deleted after 24 months; the opt-out record is kept so we can keep respecting it. If we write to a business, we keep a copy of that message and the date, so we can send at most one short follow-up and don't contact anyone twice.

When we prepare an offer, we keep what it needs: the client's name or company name, address, OIB (or VAT number for clients abroad), and, if you give them to us, a contact person, email address and phone number. Our legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). Issued offers are kept as they were sent, because they may later support an invoice.

If we send you a link to view an offer, it works for 30 days and can be revoked at any time. When you accept or decline an offer through the link, we record your answer, the name you enter and the time.

You can ask for access to your data, its correction or erasure, restriction of processing or a copy in a portable format, and you can object to processing based on our legitimate interest. Write to hello@lunora.hr; we reply within one month.

You can also lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, azop.hr).

If we change this policy, we'll update the date at the top of this page.