Privacy Policy

1. What data do we collect?

When you convert without an account: we process your IP address for security and rate limiting, technical logs, and the files you upload for conversion. Session identifiers may be stored in cookies to enforce free-tier limits.

When you create an account: email address, display name (if provided), authentication data (hashed password or OAuth identifiers from Google sign-in), subscription and credit usage, billing metadata via Stripe (we do not store full card numbers), and job history.

2. How do we use your data?

• Provide file conversion and download links
• Authenticate users and manage accounts
• Process payments and credit purchases (Stripe)
• Enforce usage limits and prevent abuse
• Monitor errors and improve service reliability
• Respond to support requests

3. File storage & access

Uploaded and converted files are stored in private object storage (S3-compatible, e.g. MinIO locally or cloud object storage in production). Files are accessed only by automated workers to perform conversion — not for advertising or model training.

Files are deleted after 30 minutes. Paid credit plans may retain files up to 48 hours. You should not upload content you are not allowed to share.

4. Who do we share data with?

We share data only with service providers that help us operate the platform, such as payment processing (Stripe), email delivery (when enabled), and infrastructure hosting. We may disclose information if required by law or to protect our users and systems.

We do not sell your personal data to third-party marketers.

5. Cookies

We use essential cookies and similar technologies for authentication (NextAuth session), security, and free-tier usage tracking. Without these, core features may not work. We do not use third-party advertising cookies in the MVP product.

6. International transfers

Your data may be processed in the country where our servers run. When we use cloud providers, data may be stored in regions you select for deployment. We apply technical and organizational measures (encryption in transit, access controls) regardless of location.

7. Your rights

Depending on your location, you may have rights to access, correct, delete, or export your personal data, and to object to or restrict certain processing. Account holders can manage much of this from Account or by emailing privacy@lunaconvert.com.

8. Retention

Files are deleted per our TTL policy. Account and billing records may be kept longer where required for legal, tax, or fraud-prevention purposes.

9. Children

Our service is not directed at children under 16. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this Privacy Policy as our product or legal requirements change. Material changes will be reflected on this page with an updated date.