Privacy Policy

Last updated: May 24, 2026

LunaConvert explains here how we handle personal data when you use our online file conversion service. This policy is written for a global audience and aligns with common privacy principles including the EU General Data Protection Regulation (GDPR) where applicable.

Summary

We collect only what we need to run the service, convert your files, and improve reliability. We do not sell your personal data. Uploaded files are deleted automatically — files are deleted after 30 minutes on the free tier (48 hours for paid credits). See also our Security & Compliance page and Terms of Service.

Questions & answers

Q1. What data do we collect?

When you convert without an account: we process your IP address for security and rate limiting, technical logs, and the files you upload for conversion. Session identifiers may be stored in cookies to enforce free-tier limits.

When you create an account: email address, display name (if provided), authentication data (hashed password or OAuth identifiers from Google sign-in), subscription and credit usage, billing metadata via Stripe (we do not store full card numbers), and job history.

Q2. How do we use your data?

Provide file conversion and download links
Authenticate users and manage accounts
Process payments and credit purchases (Stripe)
Enforce usage limits and prevent abuse
Monitor errors and improve service reliability
Respond to support requests

Q3. File storage & access

Uploaded and converted files are stored in private object storage (S3-compatible). Files are accessed only by automated workers to perform conversion — not for advertising or model training.

Files are deleted after 30 minutes. Paid credit plans may retain files up to 48 hours. You should not upload content you are not allowed to share.

Q4. Who do we share data with?

We share data only with service providers that help us operate the platform. We do not sell your personal data to third-party marketers.

Q5. Cookies

We use essential cookies and similar technologies for authentication (NextAuth session), security, and free-tier usage tracking. Without these, core features may not work. We do not use third-party advertising cookies in the MVP product.

Q6. International transfers

Your data may be processed in the country where our servers run. When we use cloud providers, data may be stored in regions you select for deployment. We apply technical and organizational measures (encryption in transit, access controls) regardless of location.

Q7. Your rights

Depending on your location, you may have rights to access, correct, delete, or export your personal data, and to object to or restrict certain processing. Account holders can manage much of this from Account or by emailing [email protected].

Q8. Retention

Files are deleted per our TTL policy. Account and billing records may be kept longer where required for legal, tax, or fraud-prevention purposes.

Q9. Children

Our service is not directed at children under 16. We do not knowingly collect personal data from children.

Q10. Changes to this policy

We may update this Privacy Policy as our product or legal requirements change. Material changes will be reflected on this page with an updated date.

Contact

Questions about privacy: [email protected]