Privacy Policy

Last updated: 28 April 2026

This policy explains how Luneflow collects, uses and protects personal data. Luneflow is a WhatsApp-powered AI assistant service for UK small and medium businesses.

1. Data controller

Lune Data Solutions Ltd, Company No. 16869228, registered in England and Wales. Registered office: 22 Woodlands Road, Lancaster LA1 2EN, United Kingdom.

2. What personal data we collect

• Business contact details — the name, email and phone number of the person signing up as a Luneflow customer.
• WhatsApp Business Account metadata — business display name, WhatsApp phone number, message templates and account settings for businesses that subscribe to Luneflow.
• End-customer WhatsApp messages — the content of messages a business's customers send to the business's WhatsApp number, together with the customer's WhatsApp phone number and display name as provided by Meta.
• Business knowledge-base content — the pages and documents a business gives us to train their AI assistant on.

3. Why we process it

To provide the Luneflow service: handling inbound WhatsApp messages on behalf of subscribing businesses, generating AI replies from their knowledge base, sending approved template messages (e.g. appointment reminders), and running the management dashboard their team uses.

4. Lawful basis

• Contract performance (UK GDPR Art. 6(1)(b)) — for data processed on behalf of a business we have a contract with.
• Legitimate interests (UK GDPR Art. 6(1)(f)) — for operating, securing and improving the service, balanced against the rights of data subjects.

5. Data retention

We retain personal data for as long as it is needed to deliver the Luneflow service to the subscribing business:

• Customer conversation data, business-account configuration and knowledge-base content — retained for the duration of the business's active subscription. On cancellation, this data is deleted within 30 days, unless the business has requested earlier deletion or a specific extension in writing, or unless retention is required by law.
• Erasure requests — a business client, or an end-customer via their business, may request deletion of specific conversations or contact records at any time under section 9 below; we action verified requests within 30 days.
• Billing records — retained for 6 years as required by UK tax law.

We do not currently operate an automatic time-based purge of conversation data; retention is tied to the subscription lifecycle and to erasure requests as set out above.

6. Who processes the data

We use the following processors strictly to deliver the service. Each is bound by UK GDPR / EU GDPR equivalent processor obligations:

• Meta Platforms Ireland Ltd — WhatsApp Business Platform, message transport.
• Anthropic — large-language-model inference for AI replies.
• OpenRouter — model-routing layer in front of language-model providers.
• Firecrawl — website scraping for building a business's AI knowledge base from its own public site.

We do not sell, rent or share personal data for third-party advertising.

7. International transfers

Some processors listed above are based outside the UK/EEA. Where personal data is transferred outside the UK we rely on the UK International Data Transfer Agreement or equivalent safeguards.

8. Cookies

luneflow.co sets no advertising or analytics cookies. See our cookie policy for the small number of strictly-necessary session cookies used by the Luneflow admin app.

9. Your rights

Under UK GDPR you have the right to access, rectification, erasure, restriction, portability and objection. You can also withdraw consent where processing is based on consent. To exercise any of these rights, see Data deletion instructions or email us (below).

10. Complaints

If you believe we have mishandled your data you have the right to complain to the UK Information Commissioner's Office: ico.org.uk, 0303 123 1113.

11. Contact

Data protection enquiries: privacy@luneflow.co
General enquiries: ben@luneflow.co
Lune Data Solutions Ltd, 22 Woodlands Road, Lancaster LA1 2EN, UK.