Lunaya Store

1.Who we are

Lunaya Store sells cameras, lenses, lighting, audio equipment and accessories online. In data protection law we are the controller of the personal data described in this policy, which means we decide why and how it is processed.

Controller: [Company legal name], [registered address], company number [number], VAT [VAT number]. You can reach us at support@lunaya.store for any question about your data.

2.What we collect

We only collect what the store needs to sell you equipment and support it afterwards. We do not buy personal data from third parties or build advertising profiles.

Account data: your email address, the name you give us, and an encrypted password handled entirely by our authentication provider. We never see your password in readable form.
Order data: the products you buy, the amount paid, your delivery and billing address, and the order history attached to your account.
Payment data: we receive a confirmation from Stripe that a payment succeeded, along with the last four digits and card brand. Full card numbers are entered on Stripe's own checkout page and never reach our servers or our database.
Equipment records: serial numbers of the items you buy, kept so we can validate warranty claims without asking you to find a receipt.
Support correspondence: the messages you send us about orders, faults, returns or warranty claims, including any photographs of damaged equipment you choose to attach.
Technical data: your browser type, approximate region and the pages you visited, generated automatically by our hosting provider's server logs for security and troubleshooting.

3.Why we use it, and our legal basis

Every use of your data falls under one of the grounds below. Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights and concluded it is not.

To take payment, dispatch your order and handle delivery problems — necessary to perform our contract with you.
To process returns, refunds and two-year warranty claims, including checking serial numbers and shutter actuation counts against our sales records — necessary to perform our contract and to meet our legal obligations to consumers.
To keep accounting and tax records of every sale — necessary to comply with a legal obligation.
To answer your support messages and give equipment advice — legitimate interests in running a functioning shop.
To detect fraudulent orders and protect the store against abuse — legitimate interests in security. Stripe performs its own fraud checks as a separate controller.
To send marketing email about new stock or offers — only with your consent, which you can withdraw at any time using the unsubscribe link.

4.Who we share it with

We share the minimum data necessary with the services that make the shop work. We do not sell personal data, and we do not share it with advertising networks or data brokers.

Stripe — payment processing and fraud prevention. Stripe receives your email, billing details and order amount, and acts as an independent controller for its own fraud and compliance purposes.
Supabase — the database and authentication service that stores your account and order records on our behalf, as our processor.
Delivery carriers — your name, delivery address, phone number where required, and a parcel description, so the courier can deliver and you can track the shipment.
Manufacturers and authorised repair centres — your name, order reference and the serial number of the item, but only when a warranty repair has to be escalated to them.
Our hosting provider — technical logs, as our processor.
Authorities, regulators or professional advisers — only where the law requires it, or to establish or defend a legal claim.

5.International transfers

Some of our providers process data outside the country where you live. Where data leaves the European Economic Area, the transfer is covered by an adequacy decision or by Standard Contractual Clauses approved by the European Commission, together with technical safeguards such as encryption in transit and at rest.

You can ask us for details of the safeguards that apply to a specific provider by emailing support@lunaya.store.

6.How long we keep it

Order and invoice records: retained for [7] years after the sale, to satisfy tax and accounting law.
Warranty and serial number records: retained for at least the full two-year warranty period, plus one further year to cover late claims and disputes.
Account data: retained while your account is open. If you ask us to close it, we delete your profile and anonymise your order history so the sales record remains valid for accounting without identifying you.
Support messages: retained for [2] years after the enquiry is closed.
Server logs: retained for [90] days.
Marketing consent records: retained for as long as you are subscribed, plus [3] years afterwards as evidence that consent was given and withdrawn.

7.How we protect it

The site runs over HTTPS, database access is restricted by row-level security policies so one customer cannot read another customer's orders, and administrative access to the store is limited to named staff accounts.

No system is perfectly secure. If a breach occurs that is likely to result in a high risk to your rights, we will notify you and the relevant supervisory authority within the time limits the law sets.

8.Your rights

Depending on where you live, you have some or all of the following rights over your personal data. We answer requests within one month and do not charge for them.

Access — ask for a copy of the personal data we hold about you.
Rectification — have inaccurate data corrected, for example a misspelled delivery address.
Erasure — ask us to delete your data, subject to records we must keep for tax purposes.
Restriction — ask us to pause processing while a dispute about accuracy or legitimate interests is resolved.
Portability — receive the data you gave us in a structured, machine-readable format.
Objection — object to processing based on legitimate interests, and to direct marketing at any time and without giving a reason.
Withdraw consent — where processing is based on consent, withdraw it at any time without affecting processing already carried out.

9.Complaints

If you think we have handled your data badly, please tell us first at support@lunaya.store so we can put it right. You also have the right to complain to the data protection authority in your country of residence or workplace, and nothing in this policy limits that right.

10.Children

The store is intended for adults. We do not knowingly create accounts for anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

11.Changes to this policy

When we change this policy we update the date at the top of the page. If a change materially affects how we use your data, we will tell account holders by email before it takes effect.

Privacy Policy