Privacy Policy

Who is responsible

LUNA, Madrid (“LUNA”, “we”) is the controller of your data. Contact for privacy questions and requests: privacy@lunalearnai.com.

When a school or teacher gives LUNA to its students, the school decides why the data is used and LUNA works for it as a processor under a data-processing agreement.

What we collect

• Account: name, email, password (stored only as a hash), phone number, role (student, teacher, parent), date of birth (to check age) and the version of these texts you accepted.
• What you add: documents and notes you upload, the material LUNA generates from them, study plans, your answers and scores, optional written working or photos of your work for a question, and what you ask LUNA in chat.
• Learning data: results per topic and skill, used to show progress, suggest what to study next and adapt study plans; marks and short feedback the AI suggests for written answers; reviews of a mark by a teacher.
• Classes and messages: the classes you join or run, what a teacher shares or assigns, and messages between students, parents and teachers inside LUNA.
• Usage counts: how long and how often each part of LUNA is used, added up per person per day, and how much AI each account used (for the monthly credits). We never store what you type for these counts, we do not record them for children under 14, and they are deleted after 13 months (AI use: while the account exists).
• Technical: a session cookie that keeps you logged in (strictly necessary). We do not use advertising or analytics cookies.
• Feedback you send from the beta feedback button, including a screenshot if you attach one.

Why we use it, and the legal basis

• To provide LUNA: create your account, store your material, generate quizzes, plans and summaries, grade answers, show progress (contract).
• To keep it safe: prevent abuse, secure accounts, fix bugs (legitimate interest).
• To send service emails: confirm your email, reset a password, connection and sharing requests (contract / legitimate interest).
• For children under 14: only after a parent or guardian consents (consent, Article 8 GDPR and LOPDGDD art. 7; COPPA verifiable parental consent in the US). For school accounts, the school’s authorisation.

Children

Under 14 (13 in the US) a child cannot open an account alone. Until a parent or guardian agrees, we keep only the child’s first name, birth date and the guardian’s email, and delete them after 48 hours. We store no IP address and set no cookie for that request.

When a student under 14 joins with a class code from a teacher who confirmed that the school holds parental consent, that confirmation (kept with the teacher’s name and the date) replaces the guardian’s email approval; the school is then responsible for having that consent. Once consent is given, the guardian gets a parent account and can see, export and delete the child’s data at any time. Accounts of under-18s get extra protection: they cannot sell in the marketplace or make open-network connections with people they do not know, and their content is sent to AI providers with the strictest privacy settings available. We never use children’s data for advertising or to build marketing profiles.

Who we share it with

Only service providers that run LUNA for us (processors), under contracts that limit them to our instructions:

• Hosting and database: Vercel and Supabase.
• AI: OpenAI and Anthropic process the text, images and questions needed to generate content and grade answers. We ask them not to retain data for training. Mathpix may process images of formulas.
• Email delivery: our email provider.
• Payments (when launched): our payment provider or merchant of record.

We do not sell personal data. Some providers are in the United States; transfers rely on the EU–US Data Privacy Framework or Standard Contractual Clauses.

How long we keep it

• Your account data while the account exists. When you delete your account it is erased after a 30-day grace period (you can cancel by logging in).
• Inactive accounts: if nobody signs in for 24 months we email you; if you still do not sign in within 30 days, the account is scheduled for deletion and erased after the same 30-day grace period. Signing in at any point cancels it.
• Messages between students, parents and teachers: 3 months.
• Pending guardian requests: 48 hours.
• Photos of your working are sent to the grader and not kept on your attempt record.
• Beta feedback: screenshots 90 days, the text until the beta ends.

Your rights

You can access, correct, export and delete your data from Account settings, ask us to restrict or object to processing, and withdraw consent at any time (privacy@lunalearnai.com). Parents and guardians can do this for their child from “My students”. In Spain you can complain to the Agencia Española de Protección de Datos (aepd.es); US residents may also contact the FTC.

Automated decisions

LUNA scores answers and estimates mastery with AI to help you study. AI feedback is a suggestion: it can be wrong, and your teacher decides. It is never a final grade, admission or certification on its own: a teacher decides what counts at school, and a student can ask the teacher to review any mark. See the AI notice.

Security and changes

Data is encrypted in transit, passwords are hashed, access is limited to what is needed, and we will notify the authority and affected people of a serious breach as the law requires. If we change this policy in substance we will tell you and ask you to accept the new version.