Privacy Policy

1. Who we are

The service is operated by the team behind Lunara ("we"). Lunara is in early access (beta), and these details will be updated as the service matures.

For any privacy question or request — including to access, correct, or delete your data — contact us at hello@lunarabot.io, or directly in the chat.

2. What we collect

Identifiers: your WhatsApp phone number and profile display name. Your phone number is your identifier with us, so use of the service is not anonymous.

Cycle information (sensitive health data): period dates, cycle length and duration, symptoms (pain, bloating, skin, etc.), mood, energy and sensations you report, and personal preferences.

Conversation content: the messages you send the bot. Message content is stored and used to hold a personalized conversation with you (see §5). If you send a voice note, we transcribe it to text and keep only the text — we do not store the recording itself (see §6).

Consent and usage records: the time consent was given and the policy version, plus basic technical logs needed to operate.

We do not embed any third-party advertising or analytics tools (Meta Pixel, Google Analytics, AppsFlyer, etc.). There is no advertising SDK in the path of your data.

Our website: the Lunara website sets no cookies and does not identify its visitors. We count only how many times each page was opened and from what kind of source (for example, a link on Instagram or a Google search), and how many times each button was pressed, as daily totals with no IP address, identifier or any other detail about who visited.

3. Why we use it

To calculate your cycle phase and send updates, reminders and tailored content; to learn your patterns over time and improve guidance; and to let you converse with the bot. We do not use your data for advertising and we do not sell it.

4. Legal basis — explicit consent

Information about your health is "information of special sensitivity" under Israel's Protection of Privacy Law (including Amendment 13) and "data concerning health" under the GDPR. Processing it relies on your explicit consent, given separately when you start using the service.

You may withdraw consent at any time (see "Your rights"). Withdrawal does not affect the lawfulness of processing carried out beforehand.

5. The AI assistant

To converse with you, we send your message content to an AI provider to generate a reply. The provider acts as a data processor on our behalf only, on our instructions. Our current provider is OpenAI (GPT models). For service continuity we may also use Google (Gemini models) as an alternate provider.

We work to ensure your data is not used to train the providers' models, and to put a data-processing agreement (DPA) in place with each provider we use.

AI replies are general information only, are not medical advice, and are not an automated decision producing legal or similarly significant effects on you. They may be inaccurate — do not rely on them as a substitute for a professional.

6. Who we share with

Meta Platforms (WhatsApp): operates the messaging pipeline; content passes through WhatsApp servers to send and receive messages.

Cloudflare: hosts the service and the database (D1) where data is stored.

OpenAI: provides the AI model that holds the conversation with you (see §5).

Google: an alternate AI provider we may use for service continuity (see §5).

Soniox: transcribes voice notes to text. If — and only if — you send a voice note, the audio file is sent for transcription and deleted there as soon as the transcription completes; we keep only the text, and never store the recording itself.

These are the only infrastructure providers. We do not sell your data, do not share it with advertisers, and do not transfer it to any other third party — except where required by law.

6a. Sharing with a partner (Lunaro)

If you choose to — and only if you choose to — you can connect your partner to Lunaro, a separate character with its own WhatsApp number that talks to him. You start it, you confirm it explicitly in the chat before it exists, and you can end it at any moment with one word. Until you do, no sharing exists.

What he receives: which stage of your cycle you are in and what that means day to day, an update when your period starts (only after you confirm it to us — never from a prediction), and an explanation or tip suited to the stage. In addition, general patterns accumulated over time — for example that your periods tend to be more painful — shape what he is told, so that what he hears fits you rather than being generic advice. This is always phrased as a tendency, never as a report about today.

What he never receives: your conversations with us, what you logged on any given day, your words, exact dates, or any other field of your profile. This is structural, not merely promised: that information is never sent to him.

What travels from him to you: one thing only, and only when he explicitly sends it — a "heart" that reaches you attributed to him. What he tells us about the two of you is used to help him alone, is never stored in your profile, and never changes what Lunara says to you.

About him we store his WhatsApp number, the name you gave him, his answers to two intro questions, and his messages for up to 30 days, as with yours. He consents to this himself before anything begins, and can stop or delete his data whenever he wants. Full details from his side: partner privacy policy.

Deleting your data also ends the sharing.

7. Transfers outside Israel

Our infrastructure providers (Cloudflare, OpenAI, Google, Meta, Soniox) store and process data outside Israel, including in the United States. By consenting to the service you also consent to your data being transferred and stored abroad.

We work to protect such transfers through contractual arrangements obliging providers to an adequate level of protection and to no onward transfer.

8. How long we keep it

We keep your data while your account is active. If you request deletion, we erase it from the database immediately and from backups within 30 days.

Conversation content is kept for a rolling window and then deleted, to minimize the amount of sensitive data retained over time.

9. Your rights

At any time, directly from the WhatsApp chat, you can: access your data ("what do you know about me"), correct it, delete it ("delete me"), and withdraw consent. You may also contact us by email.

If you believe we have infringed your privacy, you may complain to the Israeli Privacy Protection Authority.

10. Security

Data is encrypted in transit and at rest, and access is restricted. We apply security measures appropriate to sensitive data under the Protection of Privacy (Data Security) Regulations. No system is perfectly secure, but we treat security as a priority.

11. Minimum age

The service is intended for adults 18 and over. We do not knowingly collect data from anyone under 18.

12. Changes

We will update this policy from time to time. For a material change — especially regarding sensitive data or AI — we will ask for your consent again before you continue.

13. Contact

For any privacy question: hello@lunarabot.io.