Privacy Policy

1. Data controller

The controller of your personal data is [[LEGAL NAME — e.g. Firstname Lastname e.v.]] (Egyéni vállalkozó (Hungarian sole trader)), registered seat [[REGISTERED SEAT — Street, City, ZIP, Hungary]], Hungary. You can contact us at [email protected]. Full operator details are in our Imprint.

2. What we collect

• Account data — your email address and authentication data.
• Content you create — the companions you create, your chat messages, and images generated for you.
• Billing data — subscription status, your token balance and transaction records (including token purchases and spends). Your full card details are handled by our payment provider, not stored by us.
• Technical & usage data — device/browser information, IP address, and privacy-conscious analytics events used to measure and improve the service.
• Partner-referral data— if you reach LunaCat through a partner (affiliate) link, we log that click: the partner code and the partner's own campaign tag, the page you landed on, your country, the referring website, two technical request headers that tell us whether the click was a real page navigation, a flag recording that it was not where that applies, and a keyed hash of your IP address and browser user-agent. We never write your raw IP address to our database — only the keyed hash — and those hashes are erased after 12 months. A click is logged whether or not the cookie ends up being stored: a browser prefetch, for example, is logged and flagged and gets no cookie. A click whose code belongs to no partner is not logged at all. If you then create an account, the referral is recorded on it so the partner can be paid, together with your country, the campaign tag and a keyed hash of the IP address you signed up from — that hash is erased on the same 12-month schedule. See the lc_aff cookie in our Cookie Policy.

We do not deliberately collect special-category data. Because chats are free-form, they may reveal preferences of a sensitive nature; we ask you not to share real-world identifying or sensitive information you do not want stored.

3. Why we use it and our legal basis

• To provide the service (authenticate you, store your companions and conversations, power companion memory) — performance of a contract (Art. 6(1)(b) GDPR).
• To process payments and prevent fraud — contract and legal obligation (Art. 6(1)(b), (c)).
• To keep the service safe and lawful (age assurance, abuse prevention, enforcing our policies) — legitimate interests and legal obligation (Art. 6(1)(f), (c)).
• Privacy-conscious analytics (measuring traffic to improve the service, with advertising signals switched off) — legitimate interests (Art. 6(1)(f)). You can opt out at any time; see our Cookie Policy. We do not use advertising cookies, and if we introduce them we will ask for your consent first.
• Partner referrals (crediting the partner who referred you, and detecting faked clicks, self-referrals and other referral fraud before we pay commission on them) — legitimate interests(Art. 6(1)(f)). Your IP address and browser user-agent are stored only as keyed hashes, never in the clear, and are deleted on the schedule in section 6. The partner's campaign tag is stored exactly as the partner wrote it, because it is their own reporting label rather than something we generate — a partner who puts a value unique to your visit into their link will see that value again beside a purchase made from it. The cookie behind this is set without asking you first; you can object at any time and ask us to delete the click record, as described in our Cookie Policy.

We do not sell your personal data.

4. Who we share it with

We use trusted service providers who process data on our behalf under data-processing agreements: cloud hosting and database infrastructure, a content-delivery and security network, our email provider, our analytics provider, our AI model/inference providers (to generate chat and images), and our payment provider. We share only what each provider needs, and we do not authorise them to use your data for their own purposes. We may also disclose data where required by law or to protect our rights and users' safety.

Partners in our affiliate programme

If you arrived on a partner link, the partner who referred you can see, in their own dashboard, that a purchase happened and what it earned them. For each purchase that means: a pseudonymous buyer label (a keyed hash that lets the partner tell repeat purchases by one person apart, and nothing else), the country, the plan name, the amount and currency, the date, and the campaign tag the partner themselves put in the link. For a sign-up that did not buy, they see the country, the tag and the date. They never see your name, your email address, your account identifier, your IP address, or anything you write or generate on LunaCat.

Partners are notour processors: they decide for themselves what to do with what they see, and are responsible for it under their own privacy obligations. Our partner agreement forbids them from trying to re-identify you or to combine the label with data from elsewhere. If you would rather this did not happen, see your right to object below — we can delete the click record that connects you to a partner.

5. International transfers

Some providers may process data outside the European Economic Area. Where they do, we rely on the transfer safeguards those providers put in place under their own data-processing terms — such as the EU–US Data Privacy Framework (where the provider is certified), the European Commission's Standard Contractual Clauses, or an adequacy decision — to protect your data.

6. Retention

We keep your data for as long as your account is active. Removing a companion permanently deletes your chat history with her; deleting your account removes your companions, chats and generated images. Some records (for example billing and tax records, or logs kept to prevent abuse) are retained for the period required by law or by our legitimate interests, after which they are deleted or anonymised. Partner-referral click logs keep their hashed IP and browser values for 12 months, and the hashed IP recorded when a referred account is created is erased on the same schedule. The click record itself is not deleted at that point: the partner, their campaign tag, the page you landed on, your country, the referring site, whether the click looked like a real navigation, and the time it happened are kept with the rest of our commission accounting, for as long as those accounting records are kept.

7. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interests, and to withdraw consent at any time (without affecting prior processing). You can exercise many of these directly from your account settings, or by emailing us at [email protected]. You also have the right to lodge a complaint with a supervisory authority — in Hungary, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), naih.hu.

8. Security

We use appropriate technical and organisational measures — including encryption of data in transit (HTTPS), access controls and reputable hosting providers — to protect your data. No system is perfectly secure, but we work to keep your information safe and will notify you and the authorities of a personal-data breach where the law requires.

9. Children

LunaCat is for adults only. We do not knowingly process the data of anyone under 18. If you believe a minor is using the service, please contact us — see our Underage & Age Verification Policy.

10. Content & age of depicted persons

All companions are fully AI-generated and fictional; they never depict real, identifiable people, and every depicted person is an adult (18+).

11. Changes and contact

We may update this policy; material changes will be notified by a reasonable means. Questions or a data request? Email [email protected] or use our contact page.

Last updated: 19 August 2026.