Privacy Policy

1. Who we are

Luniat, enskild firma driven av Nicolas Ahlm ("Luniat", "we", "us") based in Stockholm, Sweden, is the data controller for personal data processed through our platform and website (www.luniat.com). We provide an AI-powered service that helps stores and businesses create and publish social media content automatically.

Contact: privacy@luniat.com

2. Data we collect

We collect and process the following categories of personal data:

Account information

• Name, email address and password upon registration (if you sign up with email)
• Company name, address and registration number
• Billing information and payment details

Google Sign-In (if you sign in with Google)

If you choose to sign in with Google we only receive the following minimal data from Google (so-called "basic profile scopes"): your email address, your name and your profile picture URL. We request no access to Gmail, Google Drive, Google Calendar, Google Contacts or any other Google content. The access token from Google is used only once to verify your identity at sign-in and is not stored persistently.

Social media tokens and integration connections

• OAuth access tokens from Meta (Instagram and Facebook)
• OAuth access tokens from TikTok
• OAuth access tokens from Shopify (if you connect your store)
• Associated account IDs, profile names and profile pictures

Content you create and upload

• Images and videos you upload for AI generation
• AI-generated texts, captions and hashtags
• Publishing schedules and platform settings

Technical data

• IP address, browser type and device information
• Usage statistics and activity logs
• Cookies and similar technologies (see section 7)

3. How we use your data

We process your personal data to:

• Deliver the service: Generate AI content based on your images and instructions, publish to your connected social media accounts
• Improve the service: Analyze usage patterns to improve AI models and user experience
• Communication: Send service messages, updates and customer support
• Billing: Manage payments and subscriptions
• Security: Protect against fraud and unauthorized access

Legal basis: Processing is based on performance of contract (Art. 6.1b GDPR), legitimate interest (Art. 6.1f GDPR) and where applicable consent (Art. 6.1a GDPR).

Limited Use of Google user data (Google API Services User Data Policy): Luniat's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to authenticate you at sign-in and to create/update your Luniat account. We never use Google data for advertising, never sell it, never share it with third parties for marketing purposes, and never use it to train AI models. No human reads Google user data except with your explicit consent or where required for security or compliance.

4. Data sharing with third parties (sub-processors)

We share data with the following categories of recipients, solely to the extent necessary to deliver the service. All are data processors acting on our instructions under a Data Processing Agreement (DPA):

• Google (Sign in with Google): If you choose to sign in with Google, Google receives your sign-in request and returns your email address, name and profile picture URL to us. We request no other scopes. Google is the controller for your Google account itself.
• Meta Platforms (Facebook/Instagram): We send your chosen content (images, texts, hashtags) via Meta's API for publishing to your connected accounts. Meta then processes this data according to its own privacy policy.
• TikTok (ByteDance): Same principle — content is sent via TikTok's API for publishing.
• Shopify: If you connect your Shopify store we fetch products, orders and store statistics via Shopify's API to generate relevant content. We never write to your store without your explicit consent.
• Zernio: Our publishing engine that brokers publishing and analytics against social media platforms. Zernio acts as a sub-processor and stores credentials for your connected social accounts in an isolated "profile" per customer.
• Anthropic (Claude AI): Your images and text instructions are sent to Anthropic's AI API to generate captions and text content. Anthropic processes data according to its Data Processing Agreement and does not use customer data for model training.
• Supabase: Our database and authentication provider. Data is stored in Supabase's EU region.
• Vercel: Web hosting and serverless infrastructure.
• Upstash / Vercel KV (Redis): Cache and rate-limiting.
• Resend: Delivery of transactional email (verification, password reset).
• Payment provider: Stripe or equivalent for payment processing.

We never sell your personal data to third parties and never use Google Sign-In data for advertising or to train AI models.

5. Your rights under GDPR

You have the right to:

• Request access to your personal data (Art. 15 GDPR)
• Request correction of inaccurate data (Art. 16 GDPR)
• Request deletion of your data ("right to be forgotten", Art. 17 GDPR)
• Request restriction of processing (Art. 18 GDPR)
• Request data portability — receive your data in a machine-readable format (Art. 20 GDPR)
• Object to processing based on legitimate interest (Art. 21 GDPR)
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal

Send your request to privacy@luniat.com. We will respond within 30 days. You also have the right to file a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se, or your local data protection authority.

6. Data storage and security

We store your personal data for as long as your account is active, plus 90 days after closure to enable reactivation. Billing data is retained for 7 years in accordance with Swedish accounting law.

We employ industry-standard security measures including:

• Encrypted data transfer (TLS 1.3)
• Encrypted storage of sensitive tokens
• Access controls and logging
• Regular security audits

7. Cookies and tracking

We use the following cookies:

• Essential cookies: Session management and authentication. Required for the service to function.
• Analytics cookies: Anonymous usage statistics via Vercel Analytics. No personal identification.

We do not use third-party advertising cookies or tracking pixels.

8. International transfers

Your data may be transferred to servers outside the EU/EEA (USA) for service delivery via Vercel and Anthropic. These transfers are protected by EU-approved Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework.

9. Children

Luniat is not intended for users under 18 years of age. We do not knowingly collect personal data from minors.

10. Changes to this policy

We may update this privacy policy. For material changes, we will notify you via email and/or within the service. Continued use after notification constitutes acceptance of the updated policy.

11. Contact

Questions about how we handle personal data? Contact us:

• Email: privacy@luniat.com
• Company: Luniat, Stockholm, Sweden