privacy policy.

point luna is operated by its co-founders, leah holden and shyam sunder sriram, based in the united states. for the purposes of the eu/uk gdpr, leah holden and shyam sunder sriram are joint data controllers for personal information collected through pointluna.ai. for the purposes of the california consumer privacy act (ccpa) and the california privacy rights act (cpra), point luna is the “business” that determines the purposes and means of processing.

for any privacy question, request, or complaint, email team@pointluna.ai.

when you submit the access signup form, we receive your name, your preferred contact email address, the google account email you’d like us to grant data warehouse access to, what you’re interested in (the warehouse itself, the mcp, or both), your usage type (personal or professional) and — if professional — your organization name and organization type, and any datasets or use cases you describe in the free-text box. we also record the timestamp at which you check the privacy-policy and terms-of-use boxes, so we have a record of your consent. please don’t submit sensitive personal information through the form — that includes things like government ids, financial account credentials, health information, precise location, biometric or genetic data, race or ethnicity, religion, political opinions, sexual orientation, or the contents of private communications. we don’t need any of that to grant access, and we don’t want it.

we use the submission to (a) decide whether to grant you access to the point luna data warehouse, (b) carry out that grant by adding the google account email you provided to the iam policy of our bigquery dataset (pointluna-data) so you can read it from your own google account, and (c) follow up with you about the access — confirming receipt of your submission, confirming the grant, asking how it’s going and what would help next, telling you about dataset additions you might care about, and letting you know about new tools as they ship. you consent to these uses when you check the privacy-policy box on the signup form indicating that you have read and agree to this privacy policy. we don’t sell or share your information with third parties for advertising or cross-context behavioral advertising, we don’t add you to general marketing lists, and we don’t use it for anything beyond the purposes described in this policy.

the form posts to resend, our email delivery service. resend forwards the message to our inbox at team@pointluna.ai and also sends an automated confirmation receipt to the communication email you provided; copies of both messages sit in resend’s logs (typically 30 days). the iam grant itself is performed in google cloud, where the dataset and its iam policy live (see “who else processes your data” below). we keep the form submission in our inbox for as long as we need it to follow up with you and to maintain the iam grant we’ve issued, until you ask us to delete it (which will also revoke the iam grant), or until point luna stops operating — whichever comes first.

we use vercel web analytics on every page of pointluna.ai to understand how the site is being used. for each page view, vercel records:

• the url and dynamic path you visited
• the referrer (where you came from)
• geolocation derived from your ip — country, region, and city
• device type (desktop, mobile, tablet)
• operating system and browser, with versions
• a timestamp

vercel web analytics doesn’t use cookies and doesn’t track you across other sites or apps. as described by vercel at time of writing, vercel identifies visits using a short-lived hash derived from the incoming request (ip + user agent); that hash is automatically discarded after 24 hours, and the underlying ip address isn’t stored. we only ever see aggregated data — no individual visitor profiles. for full details, see vercel’s analytics privacy policy.

separately from analytics, vercel’s hosting layer keeps standard request logs for every request to pointluna.ai — the marketing pages, the docs, and our api endpoints. these logs include ip address, request method, response status, latency, and error details when something fails. they sit inside vercel’s own infrastructure and follow vercel’s log retention policies, not ours. we use them for debugging and monitoring our application, and we don’t join this request-level data to your access-form submission or your identity in any of our own systems.

we also enforce rate limits on the access signup form to prevent abuse. the rate-limit key is a salted hash of your ip address. these counters live in a separate redis store, expire on their own (typically minutes to an hour), and aren’t joined to anything else.

when we detect signs of abuse — attempts to overload the signup form, scrape the site, or otherwise misuse the service — we may log additional context (including the raw ip address) so we can respond. these abuse-response logs live in vercel’s function logs alongside the other operational logs above and follow vercel’s standard log retention.

we use a small set of third-party processors to run point luna. each processes your data only on our instructions and under their own privacy and security commitments:

• vercel — hosts pointluna.ai, runs our serverless functions, provides web analytics, and stores operational request logs. see vercel’s privacy policy.
• resend — delivers the access signup form to our inbox and sends an automated confirmation receipt to the communication email you provided. subsequent replies from us are sent manually from our own email; they don’t go through resend. see resend’s privacy policy.
• google cloud (bigquery) — hosts the datasets and our private usage-log table, and is where the iam grant on the dataset is performed. see google cloud’s privacy notice.
• upstash — provides the redis store we use for short-lived rate-limit counters; provisioned through the vercel marketplace. see upstash’s privacy policy.

beyond these processors, we don’t share your personal information with anyone. we don’t run ads, we don’t use remarketing or behavioral-advertising services, we don’t embed third-party analytics beyond vercel web analytics, and we don’t use captcha or session-replay tools. the only time we would disclose information to anyone else is (a) to comply with a valid legal process, (b) to protect our rights, safety, or property or those of our users, or (c) as part of a business transfer described below.

• access signup form submissions: kept in our inbox for as long as we need them to follow up with you, until you ask us to delete them, or until point luna stops operating — whichever comes first.
• resend message logs: retained by resend for approximately 30 days per their policy.
• vercel web analytics: aggregated metrics retained per vercel’s analytics policy (no per-visitor records on our side).
• vercel operational logs: retained per vercel’s log retention policy.
• usage logs in bigquery: kept for as long as point luna operates so we can study how the service is being used over time.
• rate-limit counters: short-lived; they expire on their own (typically minutes to hours) and are not retained.

everyone who uses point luna has the following rights, regardless of where they live. when you make a request, we’ll acknowledge it within 10 business days and respond within 45 days (extendable by another 45 days if the request is unusually complex, in which case we’ll tell you why and how long we’ll need). to protect you, we verify requests by replying to the email address tied to your access signup form submission; for requests where we can’t match an email on file, we may ask for additional information solely to confirm your identity.

• access: email team@pointluna.ai with the subject “what do you have on me” and we’ll send you the information we have on file from your access signup form submission and any subsequent correspondence. we don’t currently have usage-log records tied to your identity to return. site analytics is aggregate-only; operational logs sit inside vercel and aren’t structured around per-user records, but on request we can search them by ip address and return what we find.
• correction: email us if any of the information you submitted (name, email, organization, etc.) is wrong or has changed and you’d like us to rectify that.
• deletion: email team@pointluna.ai with the subject “delete my data”. we’ll remove your access signup form record from our inbox and revoke the iam grant on the dataset (pointluna-data) for the google account you registered, within seven days, and reply to confirm when it’s done. resend’s logs auto-purge on their own retention schedule (approximately 30 days) regardless — if you want, we can also ask resend’s support team to delete sooner, but we can’t guarantee they’ll be able to. usage-log rows aren’t tied to your identity, so there’s nothing for us to look up there.
• withdraw consent: you can withdraw the consent you gave by checking the privacy-policy box on the signup form at any time by emailing us. withdrawing consent stops us from contacting you further and triggers deletion of your access signup form record (which also revokes your iam grant on the dataset). withdrawal doesn’t affect the lawfulness of processing we did before you withdrew.

we don’t discriminate against anyone for exercising these rights.

this section applies to california residents and is provided to comply with the california consumer privacy act (ccpa) as amended by the california privacy rights act (cpra).

categories of personal information we collect. in the past 12 months we have collected the following categories of personal information described in cal. civ. code §1798.140:

• identifiers (name, contact email address, google account email, ip address-derived information)
• commercial information (organization name, organization type, datasets you express interest in)
• internet or other electronic network activity information (analytics page-view data, operational request logs)
• geolocation data (city/region/country derived from ip)
• inferences (only as needed to operate the service)

we do not collect “sensitive personal information” as defined under the cpra (e.g., government ids, financial account credentials, precise geolocation, race, religion, health, sexual orientation, biometric data, or contents of private communications). because we don’t collect any sensitive pi, the “limit the use of my sensitive personal information” right doesn’t apply here.

sources of personal information. directly from you (the access signup form) and automatically from your device (request headers, ip-derived geolocation, page-view metadata).

business and commercial purposes for collecting it. to evaluate access requests and grant access by adding your google account to our dataset’s iam policy; to communicate with you about your access; to operate, secure, and improve the website; to detect and prevent abuse; and to comply with legal obligations.

categories of third parties we disclose pi to. our service providers (vercel, resend, google cloud, and upstash) as listed above, each acting on our behalf under contract. we don’t disclose pi to any other category of third party for their own purposes.

sale or sharing of personal information. we do not sell your personal information for monetary or other valuable consideration, and we do not share it for cross-context behavioral advertising as those terms are defined under the cpra. we have not done so in the past 12 months. because of this, we don’t offer a separate “do not sell or share my personal information” link — there’s nothing to opt out of.

your california rights. you have the right to (i) know what pi we’ve collected about you and how we use it, (ii) request a copy of that pi, (iii) request correction of inaccurate pi, (iv) request deletion of your pi, and (v) not be discriminated against for exercising any of these rights. to exercise any of these, email team@pointluna.ai. we’ll verify your request by responding to the email address tied to your access signup form submission, and we’ll respond within 45 days. you may designate an authorized agent to make a request on your behalf; we may ask the agent for written proof of authorization and may contact you to verify the request directly.

if you’d like to know what your “shine the light” rights are under cal. civ. code §1798.83: we don’t share personal information with third parties for their direct marketing purposes, so this right doesn’t apply.

this section applies if you’re in the european economic area, the united kingdom, or switzerland and is provided to comply with the eu/uk general data protection regulation.

data controllers. leah holden and shyam sunder sriram, jointly contactable at team@pointluna.ai. we don’t currently have an eu or uk representative — we believe our processing qualifies for the article 27(2) exception for occasional, limited, low-risk processing, and we’ll appoint a representative if and when our use case grows beyond that.

legal bases we rely on.

• consent (art. 6(1)(a)): for processing your access signup form submission, granting you access by adding your google account to our dataset’s iam policy, and contacting you about access, feedback, and updates about new tools as they ship.
• legitimate interests (art. 6(1)(f)): for site analytics, operational logging, rate limiting, and abuse detection. our legitimate interest is keeping the service running, secure, and improving over time, and we believe this doesn’t override your rights given the limited and aggregated nature of the data.
• legal obligation (art. 6(1)(c)): where we have to retain or disclose information to comply with applicable law.

your rights under the gdpr. in addition to access, rectification, erasure, and withdrawal of consent (covered in “your rights” above), you also have the right to:

• restrict processing of your personal data in certain circumstances
• data portability — receive a copy of the personal data you provided in a structured, commonly used, machine-readable format
• object to processing based on legitimate interests, including profiling (we don’t do profiling, but the right exists)
• lodge a complaint with your local data protection supervisory authority. you can find your authority through the european data protection board at edpb.europa.eu; uk residents can complain to the ico at ico.org.uk. we’d appreciate the chance to address your concern first, but you don’t have to come to us before going to them.

providing your personal information through the signup form is voluntary. if you choose not to provide it, we won’t be able to grant you access — but you can still browse the marketing pages without giving us anything.