Privacy policy
Effective date: 25 October 2026
Last updated: 25 October 2026
This policy explains how Loonis handles personal data when you use app.loonis.co. For the leads and content on your own site, you are the controller and Loonis processes them for you under our data processing agreement.
1. Who we are
The controller is Loonis | Karyna Movsha, al. Kijowska 5/22, 30-079 Kraków, Poland, NIP 9542796135, REGON 540625012 ("Loonis", "we"). For any privacy question or request, write to hello@loonis.co. We have not appointed a data protection officer, as the law does not require one for us.
2. What we collect and why
| Data | Why we use it | Legal basis (GDPR) |
|---|---|---|
| Account: name, email, password (stored hashed), photo, Google login, two-factor setting | To create your account and let you sign in safely | Contract (art. 6(1)(b)) |
| Your files, answers, website pages, photos, site content, versions and chat messages | To build, edit, host and publish your site | Contract (art. 6(1)(b)) |
| Plan, status and renewal date | To manage your plan and access to publishing | Contract (art. 6(1)(b)) |
| Billing records from Lemon Squeezy | To keep accounting records | Legal duty (art. 6(1)(c)) |
| Help messages and attachments | To answer your questions | Contract (art. 6(1)(b)) |
| Security data: IP address, device, sign-in times, login email changes | To protect your account and Loonis, and send security alerts | Legitimate interest (art. 6(1)(f)) |
| Error reports from the app | To find and fix problems | Legitimate interest (art. 6(1)(f)) |
| Product analytics: the app pages you open and steps such as choosing a style or publishing, counted without cookies and without storing an identifier for you | To see where Loonis is hard to use and improve it | Legitimate interest (art. 6(1)(f)) |
| Session recordings (only if you switch them on in Account) | To learn where Loonis is hard to use | Consent (art. 6(1)(a)) |
| Product news by email (only if you opt in) | To tell you about new features | Consent (art. 6(1)(a)) |
| Site reports from visitors: reason, details, optional email, a one-way hash of the IP | To handle reports about illegal content | Legal duty (art. 6(1)(c)) and legitimate interest (art. 6(1)(f)) |
| Visit counts for published sites: one number per site per day, with no cookies and no IP addresses stored | To show owners their visits and to find inactive free sites | Legitimate interest (art. 6(1)(f)) |
You must give us your email and a password or Google login to have an account. Everything else is up to you, but we cannot build a site without some content.
3. AI
Loonis uses Anthropic's Claude AI to read your materials and write and edit your site. We send it only what the task needs. Anthropic does not use this data to train its models under its commercial terms. The AI does not make decisions about you that have legal or similarly significant effects.
4. Product analytics and session recordings
We count which pages of the app you open and steps such as choosing a style or publishing, with PostHog, in the EU. This works without cookies: nothing is stored in your browser, and no identifier for you is stored. To count visits without cookies, PostHog makes a code from your network address and browser that changes every day. The code and the address are not stored. We do this on our legitimate interest in improving Loonis. You can object at hello@loonis.co. Your public site is never counted this way.
Session recordings are off unless you switch on "Help improve Loonis" in Account. Then we also record how you use the app (clicks, pages, screens) with PostHog, in the EU. All typed text is hidden. Passwords and two-factor codes are never recorded. Leads pages are never recorded. Your public site is never recorded. You can switch recordings off at any time in Account; recordings are deleted after 90 days.
5. Who we share data with
We do not sell your data. We share it only with providers that help us run Loonis, under contracts that protect it:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, login and file storage | EU (Ireland) |
| Vercel | Hosting the app and sites | EU (Dublin); content delivered worldwide |
| Anthropic | AI that builds and edits sites | USA |
| Resend | Sending emails | EU (Ireland) |
| Lemon Squeezy | Payments, VAT and receipts (merchant of record) | USA |
| Cloudflare | Weekly backup of photos and logos | EU |
| GitHub | Running the backup job | USA |
| Sign in with Google, if you use it | USA | |
| PostHog | Product analytics without cookies, and session recordings if you switch them on | EU |
We may also share data with authorities when the law requires it.
6. Transfers outside the EU
When data goes to the USA, it is protected by the EU-US Data Privacy Framework where the provider is certified, or by the EU standard contractual clauses. You can ask us for a copy of the safeguards.
7. How long we keep data
| Data | Kept for |
|---|---|
| Uploaded documents (PDF, DOCX, PPTX) | Deleted once your site is built |
| Account, sites, versions, photos, chat | Until you delete them or your account |
| Help messages | 2 years after the last message, or until you delete your account |
| Billing records | 5 years after the end of the tax year (Polish tax law) |
| Security and error logs | 90 days |
| Product analytics | 1 year |
| Session recordings | 90 days |
| Site reports | 1 year after the report is closed |
| Visit counts | Kept while the site exists |
| Backups | Database backups 7 days; photo backups 4 weeks |
When you delete your account, we delete your data within 30 days, except billing records we must keep and copies in backups until they are overwritten.
8. Your rights
You have the right to access your data, correct it, delete it, restrict or object to its use, and get a copy in a common format. Where we rely on consent, you may withdraw it at any time; this does not affect what we did before. Write to hello@loonis.co; we reply within one month. You can also complain to the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or the authority in your country.
9. Cookies
app.loonis.co uses only cookies needed to sign you in and keep you signed in, and to remember your settings. These need no consent. Product analytics uses no cookies and stores nothing in your browser. If you switch on session recordings in Account, PostHog stores an identifier in your browser for that purpose. Published sites on loonis.app set no cookies of their own; an owner may add their own code that does.
10. Security
We use encrypted connections, hashed passwords, optional two-factor login, access rules in the database so each owner sees only their own data, and backups. We will tell you and the authority if a breach puts your data at risk, as the law requires.
11. Changes
We will email you before a change to this policy that affects you takes effect. The date at the top shows the current version.