Privacy Policy

LunarSEO is operated by Jure Zlak (sole proprietor), reachable at hello@lunarseo.io. For purposes of EU/UK data-protection law, we are the data controller for the personal information described below.

Account data. Name, email address, organization name, profile picture (if provided), and authentication identifiers. Collected when you sign up via Clerk.

Site and content data. Domains, sitemaps, page content, brand-voice descriptions, keyword lists, and any text you paste into LunarSEO. Used to operate the service.

Connected service data. When you connect Google Search Console, Google Analytics, or a CMS (WordPress, Webflow, Shopify, Ghost), we store OAuth tokens encrypted at rest and the minimum metadata needed to publish on your behalf.

Billing data. Stripe processes your payment method and stores card details on their systems (we never see your full card number). We retain only your customer ID, subscription status, and invoice history.

Usage data. Server logs, error reports, the time and outcome of agent runs (article generation, audits, publishing). Used to operate, debug, and improve the service.

We use your data to run the service you signed up for: to research and write articles, score them, publish them to your CMS, send you the weekly briefing, and answer your support requests. We rely on contractual necessity for service operation, legitimate interest for product improvement and security, and your explicit consent where required (e.g. some marketing communications).

We use the following third-party processors. Each receives only the data they need to perform their function on our behalf:

• Vercel — application hosting (US/EU regions).
• Supabase — managed Postgres + storage (Frankfurt, EU).
• Clerk — user authentication and session management.
• Stripe — payment processing.
• Inngest — durable background-job execution.
• Resend — transactional email delivery (account notifications, weekly briefings).
• Anthropic, OpenAI, Google (Gemini), Replicate, Perplexity— AI inference for content generation, embeddings, fact-checking, and image rendering. We do not train these models on your data; we use the providers' standard commercial APIs with zero-retention or short-retention settings where available.
• DataForSEO — search-engine results pages and keyword volume data.
• Google APIs — Search Console + Analytics, used only with the OAuth scope you explicitly grant.

Our primary database is hosted in Frankfurt, Germany (Supabase eu-central-1). Application servers run on Vercel's global edge. AI inference, email delivery, and payment processing are performed by the subprocessors named above, which may be located outside the EU. We rely on the European Commission's Standard Contractual Clauses (SCCs) for transfers outside the EEA.

Account, site, and content data is retained for the lifetime of your subscription plus 90 days after cancellation, after which it is permanently deleted. Logs are retained for 30 days. Billing records are retained for the period required by tax law (typically 7 years).

If you are in the EU, UK, or another jurisdiction with similar laws, you have the right to access, correct, export, and delete your personal data, to restrict or object to certain processing, and to lodge a complaint with your local data-protection authority. To exercise any of these rights, email hello@lunarseo.io and we'll respond within 30 days.

LunarSEO uses essential first-party cookies for authentication and session management. We do not run third-party advertising trackers or fingerprinting scripts. Our marketing site does not use analytics cookies at this time; if we add them, we'll show a banner first.

LunarSEO is not directed at people under 16. We do not knowingly collect data from children. If we learn we have, we'll delete it.

We'll update this page when our practices change. If the change is material, we'll email account owners at least 14 days before it takes effect.