Privacy policy

Who we are and the law this policy follows

Lunobel ("we", "us") provides websites and AI services to businesses in the UK. We are the data controller for the personal information described on this page, which means we decide why and how it is used. You can contact us about anything here at hello@lunobel.com.

This policy follows the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, which together set out how personal information must be handled in the UK, and the Privacy and Electronic Communications Regulations 2003 (PECR), which cover cookies and electronic marketing. The Information Commissioner's Office (ICO) is the UK regulator for all of these.

What we collect, and where it comes from

When you complete our enquiry form we collect your name, business name, industry, email address, phone number, anything you write in the message box, the time you sent it and the fact that you ticked the box accepting this policy. You give us all of this yourself; we do not buy or add information about you from other sources.

If you become a client we also hold the details needed to deliver your services: your business address, invoicing details, the logins you share with us, the content of your website and the information you give us to configure your AI assistants.

Our hosting provider records the IP address, browser type and pages requested for every visit in its server logs, as almost all websites do. We use these logs only to keep the site secure and working.

Why we use it, and our lawful basis

UK GDPR (Article 6) says we must have a lawful basis for each use of your information. Ours are:

Replying to your enquiry, arranging your consultation and preparing a proposal: this is a step taken at your request before entering a contract (Article 6(1)(b)).

Delivering your services, invoicing you and keeping records of our agreement: performance of our contract with you (Article 6(1)(b)), and our legal obligation to keep tax and accounting records (Article 6(1)(c)).

Keeping the website secure and dealing with abuse or spam: our legitimate interest in running the business safely (Article 6(1)(f)). We limit enquiries from a single address to prevent automated abuse.

We do not send marketing emails or make marketing calls unless you have asked us to, as PECR requires. You can withdraw that at any time by replying "stop" or emailing us. We do not sell your information, and we do not use it to make automated decisions about you.

Who we share it with

We share your information only with the suppliers we need to run the service, each under a written contract that meets Article 28 of UK GDPR: Resend (resend.com), which delivers your enquiry to our inbox and sends you our reply; Netlify, which hosts this website, our chat assistant and their server logs; Cloudflare, which runs the security check on our forms and chat; Anthropic, whose AI writes the chat assistant's replies from the messages you type; Neon, which stores chat conversations and details left in the chat on servers in London; Microsoft, which provides our email; and our accounting providers.

Resend, Netlify, Cloudflare, Anthropic, Neon and Microsoft are based in, or may process data in, the United States. Transfers there are protected by the UK International Data Transfer Addendum to the EU standard contractual clauses, as Chapter V of UK GDPR requires, or by the UK extension to the EU-US Data Privacy Framework where the supplier is certified under it.

We may also disclose information where the law requires it, for example to HMRC, a court or the police, and to our professional advisers where needed to protect our legal rights.

How long we keep it

Enquiries that do not lead to work are deleted 12 months after your last message to us. Chat conversations are deleted automatically after 90 days. Client records, including invoices and our correspondence, are kept for the length of our agreement and for six years afterwards, which is the period HMRC requires for business records and the limitation period for contract claims under the Limitation Act 1980. Server logs are kept by our hosting provider for a short rolling period, typically 30 days.

Cookies

This website sets no tracking, analytics or advertising cookies, so under PECR there is no cookie banner to show you. The only data stored in your browser is strictly necessary for the site to work, such as keeping your chat open as you move between pages and the security check on our forms. If that ever changes we will update this page and ask for your consent first.

How we keep it safe

Article 32 of UK GDPR requires appropriate security. Your enquiry travels over an encrypted connection (HTTPS), is checked on our server before it is accepted, and is sent to us as plain text so nothing in it can run as code. Access to our inboxes and client systems is protected by strong passwords and two-factor authentication, and only the people who need your information can see it. If a breach ever put your rights at risk we would tell you and the ICO within 72 hours, as Articles 33 and 34 require.

Your rights

Under Chapter III of UK GDPR you have the right to: ask for a copy of the information we hold about you (access); have inaccurate information corrected; have your information deleted where we no longer need it; restrict how we use it while a query is resolved; object to our use of it where we rely on legitimate interests; and receive it in a reusable format (portability). Where we rely on your consent, you can withdraw it at any time.

To use any of these rights, email hello@lunobel.com. We will respond within one month, free of charge, and may ask you to confirm your identity first. If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk, on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would appreciate the chance to resolve your concern first.

Changes to this policy

We will update this page whenever our practices or the law change, and show the date of the last change at the top. If a change affects how we use information you have already given us, we will tell you by email.