Data Processing Agreement (DPA)
pursuant to Art. 28 GDPR · Last updated: August 2026
1. What this is about — and who it applies to
When you use Luna on your website, your visitors talk and chat with her. In doing so, we — Luna Studios AI Holdings Ltd., 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom (“Luna Studios”, “processor”) — process personal data of your visitors on your behalf. You are the controller within the meaning of the GDPR; we are your processor.
This agreement is automatically part of every Luna contract — there is nothing extra to sign. If you would like a signed copy for your records, simply email [email protected] and we will gladly provide one as a PDF.
2. Subject matter and duration
The subject matter is the operation of the AI assistant “Luna” on your website in accordance with our Terms of Service. The duration corresponds to the term of your Luna contract; when it ends, this agreement ends as well (deletion: section 9).
3. Nature, purpose and scope of processing
Luna holds text and voice conversations with your website visitors, answers questions about your business, takes contact requests on demand and provides you with statistics and insights in your customer portal. Processing comprises the collection, storage, analysis and transmission of the data required for this — and for no other purpose.
4. Categories of data and data subjects
- Data subjects: the visitors of your website.
- Conversation data: text messages and — for voice conversations — audio recordings including transcripts. The microphone is only used after the visitor's explicit permission in the browser.
- Contact details: name, email address, phone number — only where the visitor provides them voluntarily in the conversation (e.g. for a follow-up by your team).
- Technical data: IP address, browser/device information, page visited (page context), timestamps.
- Local data: the conversation history is additionally stored locally in the visitor's browser (localStorage) so conversations can be resumed — this data never leaves the visitor's device.
5. Your instructions
We process the data exclusively on your documented instructions. Your Luna contract, your onboarding information and your configuration requests count as instructions. If we consider an instruction unlawful, we will inform you without undue delay.
6. Our obligations as processor
- All persons involved in the processing are bound to confidentiality.
- We implement appropriate technical and organisational measures (section 7).
- We support you, within our means, in responding to data subject requests (access, erasure, rectification etc.) and in fulfilling your obligations under Art. 32–36 GDPR (security, breach notification, impact assessments).
- If we become aware of a personal data breach affecting your visitors' data, we will inform you without undue delay.
- We make available the information necessary to demonstrate compliance (section 10).
7. Technical and organisational measures (TOMs)
- Encrypted transmission of all data (TLS/HTTPS).
- Access and permission concept: each customer sees exclusively their own conversations and insights (tenant separation enforced server-side); credentials are stored strongly hashed only.
- Data minimisation: Luna only asks for contact details when the visitor requests a follow-up; no advertising profiles are built about visitors.
- Careful selection of privacy-compliant sub-processors with EU Standard Contractual Clauses or recognised transfer mechanisms (section 8).
- Logging of security-relevant events and continuous improvement of safeguards in line with the state of the art.
8. Sub-processors
You grant general authorisation for the following sub-processors. We will inform you of intended changes in good time; you may object on important data protection grounds.
| Provider | Purpose | Location / transfer basis |
|---|---|---|
| ElevenLabs, Inc. | AI voice and conversation processing (speech recognition, speech synthesis, response generation — including their vetted sub-processors) | USA · EU Standard Contractual Clauses / EU-U.S. Data Privacy Framework |
| Cloudflare, Inc. | Hosting, delivery (CDN), data storage and attack protection | USA · EU Standard Contractual Clauses |
| Resend, Inc. | Transactional emails (e.g. forwarding visitor requests to your team) | USA · EU Standard Contractual Clauses |
9. Deletion after the end of the contract
After your Luna contract ends, we delete the personal data processed on your behalf within 90 days, unless statutory retention obligations require otherwise. On request, we will confirm the deletion.
10. Evidence and audits
On request, we provide the information you need to demonstrate compliance with this agreement. Audits are generally carried out by way of written information or current attestations of our sub-processors; any further reviews will be coordinated with you in a spirit of partnership.
11. Final provisions
In all other respects the Terms of Service apply; in the event of a conflict, this agreement prevails on data protection matters. The laws of England and Wales apply. Should any provision be invalid, the remainder stays in effect. How we handle data ourselves is described in our Privacy Policy.