lunado
← Back to home

Privacy Policy

Updated: 15 October 2026

This policy explains what personal data Lunado processes, why it is needed, who it may be shared with and how to exercise your rights. We do not sell personal data. Account content — clients, bookings, work photos and financial records — is never shared with advertising platforms.

Who is responsible for your data

The controller of Lunado users’ personal data is Oleksandr Abramenko, sole proprietor (FOP), Shkilna street 7, Novodmytrivka Druha, Ivanivskyi district, Kherson region, Ukraine. For privacy questions and to exercise your rights: support@lunado.com.ua.

No data protection officer (DPO) has been appointed: the scale and nature of processing do not fall under Article 37 of the GDPR. All requests are handled by the service owner at the address above.

Client data that a professional enters into their account has a different controller — the professional. See “A professional’s client data” below.

What data we process

  • Account and profile: email, name, user ID, specialty, booking page address, working schedule and settings. Passwords are never stored in plain text.
  • Work data: services and prices, bookings, tasks, comments, color labels, saved Stories and price lists.
  • Client data entered by the professional: name, phone, messenger contacts, source, birthday, notes, allergies and contraindications, before-and-after photos, visit and payment history.
  • Financial records: client payments, tips, refunds and expenses the professional keeps in Lunado. These are not bank account data and never initiate bank transactions.
  • Booking page data: the name and phone number of the person booking, their note, the chosen service and time, and the source tag from the link.
  • Subscription: plan, validity period and trial. Purchases in the iPhone app are processed by Apple — we never receive card details.
  • Technical and service data: IP address, request date and time, device or browser type, error logs, security events and a sign-in mark (one per day). We need this to run the service, protect accounts, enforce limits and diagnose problems, and, in aggregate, to count how many people use Lunado. The content of records is not analyzed.
  • Support requests: contact details, message content and attachments you choose to send.

What we use the data for

  • to provide Lunado’s features — calendar, client cards, Stories, price lists, the booking page, finances — and sync data across devices;
  • to create accounts, sign you in and protect access;
  • to show a professional’s free time to their clients and accept bookings through the booking page;
  • to provide the trial and process subscriptions;
  • to answer requests and fix bugs;
  • to count anonymized usage statistics so we can improve the product;
  • to prevent abuse and comply with the law.

A professional’s client data

Professionals enter their clients’ data into Lunado. For this data the professional is the controller: they decide whom and what to record and are responsible for the legal basis for processing. Lunado acts as a processor: it stores and shows this data only in the professional’s account and only to provide the service.

  • Allergies and contraindications are health data. Record them only with the client’s consent and only when they are needed for a safe procedure.
  • Before-and-after photos show people. Keep and show them only with the consent of the person in the photo.
  • Data of underage clients may be entered only with the consent of a parent or legal guardian where the law requires it.
  • Client photos open only with a temporary key issued to the professional’s account. A plain link will not open them.
  • We never contact a professional’s clients, never use their data for advertising or our own purposes and never share it with third parties other than infrastructure providers.

A client who wants to access, correct or delete their data should contact the professional. If the professional cannot be reached, the client can write to support@lunado.com.ua — we will pass the request on and help within the law.

The online booking page

A professional can open a public booking page. People who book through it do not create a Lunado account.

  • The page shows only the professional’s name, specialty, services with prices and free time. It never shows other clients’ names or phones, notes or payment amounts.
  • When booking, a person leaves a name, a phone number and, optionally, a note. This data goes into the professional’s account as a booking and a client card; if a card with that phone number already exists, the booking is added to it.
  • To protect calendars from bots, we temporarily process the IP address and limit the number of bookings from one address and for one phone number.
  • The controller of this data is the professional whose page was used. Requests about it can go to the professional or to us.

Who your data may be shared with

We share only the data a specific feature needs:

  • Apple — purchases and subscriptions via In-App Purchase on iOS. Reminders in the iPhone app are created on the device itself: their text is not sent to our server.
  • Google — fonts for the Story and price list makers in the app load from Google Fonts. While loading them, Google receives your IP address and browser data. Account content is not shared. The lunado.com.ua website itself serves its fonts from our own server.
  • Telegram — service alerts to the owner about security and server health. They contain no data about professionals’ clients.
  • Infrastructure providers — hosting, domain, network and backup services needed to run and protect Lunado. The app’s main data is stored on a server controlled by the owner of Lunado.

We share data only with providers that are contractually bound to protect personal data at least as well as described in this policy and to use it only for the function they provide. Providers may process data in the countries where their infrastructure is located, under their own policies and applicable data protection mechanisms.

AI features

Lunado currently sends no data to AI providers. The voice booking feature we are preparing will use third-party AI services for speech recognition. Before it launches, we will update this policy with what is sent, to whom and for how long, and we will ask for your permission before the first use.

Analytics and advertising

  • The iPhone app contains no advertising tools: it does not use the device advertising identifier (IDFA) and does not track you across other apps or websites.
  • The lunado.com.ua website currently has no advertising pixels or analytics cookies. If we add them, they will run only after you consent in a banner, and this policy and the Cookie Policy will be updated in advance.
  • Account content — clients, bookings, photos and financial records — is never shared with advertising platforms.

Retention, backups and deletion

Account content is kept while the account is active.

  • Anything deleted in the app first goes to the Trash and is erased for good after 30 days, or sooner if you erase it manually. Bookings in the Trash are never erased automatically: payments depend on them, so only the professional deletes them.
  • Work photos are erased immediately, without going to the Trash.
  • When an account is deleted, its profile, clients, bookings, services, tasks and photos are deleted. Subscription payment records are anonymized: they remain for payment reconciliation but are no longer linked to a person.
  • So that the trial is not granted twice, we keep an irreversible fingerprint of the email address, not the address itself. It remains after the account is deleted, cannot be turned back into the address and is used only for this check.
  • Technical security logs — time of action, IP address, type of operation and its result — are kept for up to 12 months. We need them to investigate abuse and disputes about access.

Some payment, security and service records may be kept longer when required for accounting, dispute resolution, fraud prevention or legal compliance. Copies of data may temporarily remain in protected backups until they are overwritten on schedule.

Your rights

  • Access and export: Settings → My data → Take everything as a file — all data as JSON or clients as an Excel file. You can also write to support.
  • Correction: edit your profile and data in the app or ask us for help.
  • Deletion: Settings → My data → Delete account, or email support@lunado.com.ua.
  • Objection or restriction: contact us and explain your request; we will review it under applicable law.

Deleting your Lunado account does not cancel a subscription purchased through Apple. Manage it in your Apple ID settings.

Legal bases for processing

  • Performance of a contract: creating the account, syncing data, the booking page, subscriptions.
  • Legitimate interest: protecting accounts, limiting abuse of the booking page, diagnosing errors, anonymized statistics.
  • Consent: AI features and advertising tools on the website, once they appear. You can withdraw consent at any time; this does not affect processing carried out before withdrawal.
  • Legal obligation: accounting and tax records, responses to lawful requests from authorities.

For a professional’s client data, the professional as controller determines the legal basis, and Lunado processes the data on their instructions.

Users in the EU, EEA and the United Kingdom

The GDPR and the Data Protection Act 2018 apply to these users’ data. In addition to the rights listed above, you have the right to data portability in a machine-readable format, the right to object to processing based on legitimate interest, and the right not to be subject to decisions based solely on automated processing with legal effects — Lunado makes no such decisions.

We respond to requests within 30 days. If you are not satisfied with our answer, you can lodge a complaint with the data protection supervisory authority in your country of residence, and in Ukraine with the Ukrainian Parliament Commissioner for Human Rights.

International data transfers

The app’s main data is stored on a server controlled by the owner of Lunado. Some providers, including Apple and Google, may process data outside Ukraine and the EEA, including in the United States. In such cases, transfers rely on the European Commission’s standard contractual clauses or other safeguards provided by law and applied by the provider.

Security

We apply technical and organizational safeguards: HTTPS, access for each account to its own data only, protected photo links and request rate limits. Still, no system can guarantee absolute security. Do not share your password and report any suspicious activity.

Children

Lunado is a work tool for professionals and is intended for users aged 16 and over. We do not knowingly create accounts for children under 16. If you believe a child has created an account, please contact support.

Changes to this policy

We may update this policy as the service evolves or legal requirements change. The current date is always shown at the top of the page. We will announce significant changes in the app.

Contact

Oleksandr Abramenko, sole proprietor (FOP)
Shkilna street 7, Novodmytrivka Druha,
Ivanivskyi district, Kherson region, Ukraine
Email: support@lunado.com.ua