How we handle your data.

Purple Luna is a small AI studio in Brighton, UK. We build practical AI agents for service businesses. The company behind it, and the data controller for your information, is Purple Luna Ltd (company no. 13670033), run by Sam Erpik.

Purple Luna Ltd is registered in England and Wales, company no. 13670033. Registered office: Apartment 27, 4 The Furlong, Brighton BN2 4FW. VAT no. GB 416 6605 00.

If you need to talk to a real person about your data, email hello@purpleluna.co.uk. That address goes straight to a human.

If you email hello@purpleluna.co.uk, we keep:

• Your name and email address (whatever's in the From header).
• The contents of your email and our reply.
• Any attachments you send.

If you fill in one of our forms, we keep what you put in it: usually your name, business name, trade and email. That goes to our forms inbox and to us by email. Nothing more.

The website box on our homepage works differently. If you use it to try Luna on your business, we keep what she learns about it, your test chat and your email. More in Trying Luna on your business below.

If you book a call with Sam, Calendly takes your name, your email and anything you add to the booking, and passes it to us so we can hold the call.

If you pay for Luna, you pay on Stripe's secure page. We can see your name, business name, email, billing address, any VAT number you enter, what you paid and when, and your card's last four digits. We never see your full card number.

If you give us your mobile number to chat with Luna on WhatsApp (either by entering it on the site or by messaging our WhatsApp number), we keep your number, your WhatsApp display name, and what you and Luna say to each other. More on that in the next section.

If you use the “Try Luna” demo on this site, the messages you type are sent to our AI provider, Anthropic (Claude), to generate the reply. We don't store that demo chat and it isn't used to train models, so please don't type anything personal into it.

On this site, we don't fingerprint your device or set anything until you choose. If you say yes on the cookie banner, we run Google Analytics (visit stats that don't name you: which pages are read, rough region, device type). Say no and it doesn't load. We use no advertising cookies and no session recordings. More in Cookies below.

So we can reply to you. So we can remember the conversation if you come back in a fortnight and pick up where we left off. Legal basis: legitimate interest in running a small business that replies to its own customers, and where you've started the conversation by writing to us or messaging Luna.

We use your billing details to take your monthly fee and keep our tax records. Legal basis: our contract with you, and the tax law we must follow.

Luna is our AI assistant, not a person. When you message our WhatsApp number, or ask us to message you, you're talking to software.

To make that work, a few things happen to your message:

• It travels over WhatsApp, which is run by Meta Platforms Ireland. Meta carries the message and passes us your WhatsApp number and name. Meta's own handling of it is covered by WhatsApp's privacy terms.
• Our server reads it and, to write a sensible reply, sends the conversation text to our AI provider, Anthropic (Claude), which generates Luna's response. Anthropic processes it to produce the reply and does not use it to train its models.
• We keep a record of the conversation so Luna remembers the context if you come back.
• If you ask us to follow up and share your name, business, or email so we can, we keep just those details to get in touch about Luna, nothing else, and you can ask us to delete them any time.
• The first time you message our WhatsApp number, or when you leave your details, Sam gets a text alert with your number and what you wrote, so he can step in. That text goes through Twilio.

We use this only to answer you, show you how Luna works, and follow up about the product if you're interested, never to sell you to anyone else.

Want out? Reply STOP or “delete my data” in the chat, or email hello@purpleluna.co.uk. We'll stop messaging you and wipe the conversation.

This part is for anyone who presses “Show me” on our homepage or uses my.purpleluna.co.uk/start. That is usually a business owner. You give us your website, pick your business on Google Maps, or tell us about it yourself. Luna learns your business from that. Then you can message her the way a customer would, with no email needed.

What we keep:

• Your website address and what Luna learned from it: your business name, what kind of business it is, address, phone, email, opening hours, services and prices, staff names and roles, questions and answers, and policies. For each page Luna reads, we also note the page address, its title and up to five email addresses on that page. We don't keep the text of your pages. If anyone enters the same website within 7 days, we reuse this reading for them and don't read the site again.
• If you pick your business on Google Maps, the only thing we keep from Google is its ID for that place. If Google lists your website, Luna reads it as above.
• If you have no website, you fill in a form about your business, and we keep what you send. If you came from Google Maps, Google's details fill in the form for you, and we keep them too once you send it.
• Your test chat with Luna, so she remembers it. Unlike the Try Luna demo on this site, we do keep this chat: the last 16 messages (yours and hers), or the last 60 once you sign in. We only show it back to you. It isn't added to your business's real chats, it isn't in our stats, and it isn't used to train AI.
• Your email address, if you choose to keep Luna, so we can send your sign-in link. You can try Luna without it, but you need it to keep Luna and sign in. Once you sign in, it is how you log in to your account. Your sign-in link and code work once, and stop working after 15 minutes.
• When you ask for your sign-in link, we set your business up on Luna from what she learned, with its services and staff. We do this before you sign in.
• Your IP address each time you start, ask for a sign-in link or sign in. We use it to stop abuse and as part of the record of what you agreed to. When you sign in, we also note your browser and device type.
• What you agreed to: the wording you saw, when, from which IP address, and whether you said yes to marketing emails.

To read your website, we send its text (up to 20 pages) to our AI provider, Anthropic (Claude). To write Luna's replies, we send Anthropic what she learned about your business and your test chat. If you search for your business on Google Maps, we send what you type to Google. The first time you sign in, Sam gets a text with your business name. That text goes through Twilio.

We only email you about Luna's new features and marketing if you tick the box for it. That tick is your consent. Leave it unticked and we only email you what you need to use Luna, like your sign-in link. Ticked it and changed your mind? Email hello@purpleluna.co.uk and we'll stop.

Websites often name staff. We keep those names and roles, and the email addresses on the pages, only so Luna can answer as that business. That is our legitimate interest. Anyone can ask Luna to read a public website. If we hold your details and you didn't ask us to, email hello@purpleluna.co.uk and we'll delete them.

Why we use it: to show you Luna working as your business, and to set up your account if you go ahead. Legal basis: you asked us to do this before signing up with us. We also use your details to stop abuse, to keep a record of what you agreed to, and to tell Sam about new sign-ups. Legal basis: our legitimate interest.

Run a restaurant? Luna isn't ready for restaurants yet. If you leave your email so we can tell you when she is, we keep your email, whether you ticked the box for marketing, your IP address and what Luna read from your website. We email you once, when Luna is ready for restaurants, because you asked us to. After that, we only keep your email if you ticked the box for marketing.

Businesses that use Luna have her on their own WhatsApp number. When you message one of them, that business decides how your information is used (it is the data controller), and we handle it for them (we are their processor).

Appointment reminders. If the business has turned them on, Luna can message you on WhatsApp the day before your booking to remind you of it.

Follow-up reminders. If the business has turned them on and you have agreed to hear from them, Luna can message you on WhatsApp to offer a follow-up appointment, timed from your past bookings with that business. We only look at appointments from the last 12 months. For clinics, your treatment history is health information, so they must have your explicit consent first.

If the business takes deposits through Luna, you pay on Stripe's page and the money goes to that business's own Stripe account.

Want them to stop? Reply STOP to any reminder. It works straight away, and that business will not send you reminders again.

Your email is stored inside Google Workspace (Google Ireland Limited acts as our data processor under Google's standard data-protection terms).

This website is hosted by Netlify, Inc. Netlify serves the site and runs the sign-up forms; the source code lives on GitHub in a private repository.

When you talk to Luna on WhatsApp, the conversation is carried by Meta Platforms Ireland (WhatsApp), processed by Anthropic (Claude) to generate replies, and stored in a Supabase database. Our server runs on Railway. Text alerts to Sam go through Twilio, and calls you book with Sam are scheduled through Calendly. Each acts as our processor under standard data-protection terms.

If you call a Luna phone line, Twilio carries the call, Microsoft Azure turns your words into text, Anthropic writes the reply and ElevenLabs reads it out.

Payments for Luna go through Stripe. Stripe works for us on the payment itself. It also uses your details for its own fraud and legal checks, under its own privacy policy. Stripe may handle your details in the US too, under data transfer terms the UK approves. If you pick Klarna, Revolut Pay or Amazon Pay at checkout, that company handles your payment as well.

If you say yes on the cookie banner, Google Analytics (Google Ireland) gives us visit stats that don't name you (page views, rough region, device type). It loads only after a yes, never after a no.

If you try Luna on your business, we send your sign-in email from our Google Workspace mailbox. If you search for your business on Google Maps, Google handles that search under its own privacy terms.

Anthropic is based in the US, and our server on Railway runs in the US. So your WhatsApp chats with Luna, and what you give us when you try her on your business, pass through the US. Twilio, which sends Sam's text alerts, is a US company too. Each of them works for us under data-protection terms the UK approves for sending data abroad.

What you give us when you try Luna on your business, and your WhatsApp chats with her, are stored by Supabase in London.

We don't sell your data or hand it to data brokers, and we don't use advertising cookies.

This part is for businesses that use Luna. When we set Luna up, you connect your Google Calendar. We use it only to check when you're free and to add, move and cancel the bookings Luna makes. We also see the email address of the Google account you connect, so we know which calendar it is.

We don't use your calendar for anything else, we never sell it, and we never use it for advertising. Our use of Google data follows the Google API Services User Data Policy, including its Limited Use requirements. You can disconnect any time in your Google account settings, or ask us to do it.

We sometimes email businesses that could recommend Luna to their customers, such as suppliers, trade bodies, training academies and agencies.

What we use: the name, work email and company details that a business publishes on its own website, or that someone gives us. We also keep short notes about our conversation.

Why: our legitimate interest in telling businesses about a partnership that may help their customers.

How long: up to 2 years after our last contact, or until you ask us to stop.

Who sees it: only Purple Luna. We don't share or sell it.

Your rights: you can object at any time by replying “no thanks” to our email, and we will stop straight away. You can also ask to see or delete what we hold. You can complain to the Information Commission (ico.org.uk).

We also sometimes email small limited companies that may want Luna for themselves. We use the same kind of details, checked against Companies House, because we have a legitimate interest in telling a business about a product that may help it. The same time limit and rights apply.

While you're a customer, or a business that's shown interest. If we've had no contact for 12 months, we delete what we hold: emails, form entries and WhatsApp conversations alike. Records we're legally required to keep, like anything tied to an invoice, stay for 6 years.

If you give us your email but never sign in, we delete it within 8 days. Our records of the sign-in emails we send are deleted within 8 days too. A copy of the sign-in email stays in our mailbox, like any email we send. We keep the rest, like what Luna learned about your business and your test chat, and delete it after 12 months with no contact, like everything else.

Don't want to wait? Ask, and we'll delete it within a week. Usually within a day.

You can ask us to:

• Show you everything we hold on you.
• Correct anything that's wrong.
• Delete it all.
• Take it elsewhere (we'll send you what we have).
• Stop us using it.

Email hello@purpleluna.co.uk and we'll handle it within a week. Usually within a day.

If you think we've handled this badly, you can complain to the Information Commission (the ICO) at ico.org.uk. We'd much rather you complained to us first.

On this site, we don't set any cookies until you say yes. If you tap Sure on the banner, Google Analytics (Google Ireland) loads and sets two cookies, _ga and _ga_ followed by our ID. They last up to 2 years and only count visits: which pages are read, rough region and device type. Google may also process this data in the US. We use no advertising cookies and no session recordings. Tap No thanks and nothing loads.

We also keep a few small settings in your browser so the site works the way you left it: your cookie answer (we ask again after 6 months), light or dark mode, your language choice, and whether you hid the chat button (for 30 days). Only if you said yes, we also keep a note for this visit so the chat button doesn't repeat itself. None of this leaves your device.

On my.purpleluna.co.uk, where you try Luna on your business and sign in, we only set the cookies it needs to work. One remembers the Luna you started in this browser, for 7 days. Another keeps you signed in, for 30 days. They don't track you, so we don't ask first.

Changed your mind? Cookie choices in the footer forgets your answer, deletes the analytics cookies and shows the banner again, so you can switch any time. We don't sell the data we collect.

If we change anything material, we update this page and the “last updated” date at the top. We don't silently backdate.