Privacy Policy

This page is written in everyday language. For its legal counterpart see the KVKK Data Protection Notice; if the two conflict, the notice prevails.

In short

• The database is in Türkiye, on a server in Denizli.
• We do not sell data, do not share it for advertising and do not place advertising trackers.
• Measurement on this site runs only if you allow it.
• Every workspace is isolated from the others at the database level.
• We do not read your messages — we do not look at content for support without your permission.

What we keep

For your account: name, email, an irreversible digest of your password, your profile picture and your role in the workspace. The password itself is never stored.

For conversations:messages, the files sent, and the conversation's status and tags.

For a visitor using the chat box:the technical details and approximate location an agent needs to answer "what is this person asking, where are they coming from". Location is at city level; no address or coordinates are kept.

The full breakdown is in section 3 of the KVKK notice.

If you signed in with Google

From Google we take only what is needed to create your account and recognise you: your account identifier, email address, name and the address of your profile picture. It is not used for advertising, not sold, not passed to third parties and not processed to train AI models. We do not access your contacts, calendar, files or mail; the permission we ask for (openid email profile) does not open them in the first place.

To disconnect, set a password on your account and withdraw the permission from your Google account's third-party access page.

Cookies and measurement

We use no advertising cookies and we are not part of any network that follows you across sites. What we do use:

On this site measurement does not load without your permission: you are asked in the box at the bottom left on your first visit, and you can change your mind at any time from the Cookie Settings link in the footer. What it sees is visit-level; your name, your email and the messages you write do not enter it.

In the panel we count which screens are used so we can improve the product. Screen names are sent with identifiers stripped; which conversation or contact you opened and anything belonging to your customers stays out of that record. No cookie consent is asked in the panel; the basis is legitimate interest.

How we protect it

• Workspace isolation at the database level.Even with a bug in the application, one workspace cannot query another's data.
• Passwords are digested irreversibly.
• Connection credentials are stored encrypted and all traffic travels over TLS.
• The database is backed up automatically every day.

Who we share it with

Only with the providers needed for the service to work: hosting, traffic routing, email delivery, Google if sign-in with Google is chosen, measurement if you allowed it, Meta if a WhatsApp line is connected and Apple if the iOS app is used. The full list of providers and their locations is in section 6 of the KVKK notice.

If a competent authority makes a lawful request, we may be required to provide information. In such a case we will inform you unless we are prohibited from doing so.

Your data is yours

The data in your workspace belongs to you. When you close your account all of it is deleted; when you delete a contact, the records belonging to that person go with it. If you want a copy of your data, write to us from our contact page.

If you are a visitor

If you used the chat box on a business's site, the controller of that data is that business, not Lunachat. Send your deletion or information request to them first. If you reach out to us, we will point you to the right party.

Contact

For questions, use our contact page.