PRIVACY NOTICE – LUNA AI 

Last updated: 17/12/2025

This Privacy Notice describes how Smart Media Internet Marketing Ltd. (“Tap Mobile”, “Smart Media”, “we”, “us”, “our”) processes personal data in connection with the Luna AI mobile application (the “App”) and related services (together, the “Services”).

This Privacy Notice is part of, and supplements, our End User License Agreement (“EULA”) and/or Terms of Service. By installing, accessing, or using the App, you acknowledge that you have read and understood this Privacy Notice.

If you do not agree with this Privacy Notice, do not use the App.

Data Controller

Smart Media Internet Marketing Ltd. (Tap Mobile) is the data controller for personal data processed under this Privacy Notice.

Contact: [email protected]

Mail: Smart Media Internet Marketing Ltd., Attn: Legal – Privacy, Sderot hayahasut 11, Beer Sheva, Israel 

1. DATA THAT WILL BE PROCESSED

Your use of the App and Services may involve the collection and processing of personal data. Some information is provided directly by you, and some is collected automatically when you use the App.

We aim to collect only what is reasonably necessary to provide, secure, maintain, and improve the Services.

1.1 Account and Profile Data

Depending on how the App is configured and how you sign in, we may process:

  • Email address and basic account details (including details received from Apple/Google sign-in where you choose to use them)

  • Username, profile display information, preferences, and settings

  • Authentication and account status information

1.2 Conversation and User Content Data

When you use the App, we process the content you provide, including:

  • Chat messages, prompts, and conversation history with AI characters/companions

  • Content you create in the App (e.g., characters, descriptions, prompts, titles, metadata, and related inputs)

  • Any information you choose to share during chats (which may include sensitive information if you decide to provide it)

Important: Please avoid sharing sensitive personal information (for example: health data, financial account details, government identifiers) or third-party personal information unless it is strictly necessary.

1.3 Image and Facial Feature Data (If You Use These Features)

If the App includes image/camera features and you choose to use them, we may process:

  • Images you upload or capture in connection with an App feature

  • Facial feature/facial mapping information generated to enable a feature (e.g., face detection or face-related effects)

Where required by law, we will obtain any additional consent needed for processing biometric information. You can typically disable access through your device permissions and/or App settings.

Deletion practice for images: Where an image is processed on our servers to deliver a feature, we delete it promptly after completing the relevant processing, unless longer storage is necessary for a feature you request or for security/fraud prevention.

1.4 Voice Data (If You Use Voice Features)

If the App offers voice features (e.g., voice calls), we may process voice-related data as needed to provide that functionality. Where the App states voice processing occurs on-device, we do not transmit raw voice audio off your device for that function.

1.5 Notifications

If you enable push notifications, we may process:

  • A push token/device notification identifier

  • Notification preferences and delivery events

Push notifications are enabled only with your permission (you can disable them in device settings).

1.6 Support and Communications

If you contact us, we may process:

  • Your contact details and the content of your request

  • Attachments or information you provide voluntarily

1.7 Subscription and Purchase Data

If you purchase a subscription, payments are handled by the relevant app store/provider. We may receive and process:

  • Subscription status (active/expired), plan/tier

  • Purchase confirmation and transaction identifiers

  • Renewal/cancellation signals needed to administer access

We do not receive your full payment card number from the app stores.

1.8 Usage, Device, and Log Data (Collected Automatically)

We may automatically collect technical and usage data such as:

  • IP address, device model, OS version, language, time zone

  • Device identifiers (as permitted by your OS settings), app instance identifiers

  • App events (e.g., screens viewed, features used), timestamps, crash reports

  • Security logs and diagnostic logs to detect abuse, troubleshoot, and keep the Services stable

1.9 Cookies/SDKs and Similar Technologies

The App may use SDKs and similar technologies (including those from service providers) for essential operation, analytics, attribution, and (where applicable) advertising. These may collect device and usage signals as described above.

2. PURPOSES AND LAWFUL BASIS OF PROCESSING (GDPR / UK GDPR)

Where the GDPR / UK GDPR applies, we process personal data under one or more of the lawful bases described below.

2.1 Registration and Account Management

Purpose: Create and manage your account; authenticate you; maintain your profile and settings.

Lawful basis: Performance of a contract / pre-contract steps (Art. 6(1)(b)).

2.2 Providing the Services

Purpose: Enable you to use the App (including chat, character interactions, feature delivery, subscription gating, and core functionality).

Lawful basis: Performance of a contract (Art. 6(1)(b)).

2.3 Support and Customer Assistance

Purpose: Respond to inquiries, provide help, and resolve issues.

Lawful basis: Contract (Art. 6(1)(b)) and/or legitimate interests (Art. 6(1)(f)).

2.4 Safety, Security, Fraud Prevention, and Enforcement

Purpose: Maintain security; prevent abuse, spam, fraud, and policy violations; comply with platform rules; investigate suspicious activity.

Lawful basis: Legitimate interests (Art. 6(1)(f)) and/or legal obligation (Art. 6(1)(c)).

2.5 Product Analytics and Service Improvement (Including “Anonymous” / De-Identified Data)

Purpose: Understand how the App is used, troubleshoot, improve performance, develop features, and analyze user flows.

Lawful basis: Legitimate interests (Art. 6(1)(f)).

To support these activities, we may create and use de-identified and/or aggregated datasets derived from usage events and interaction patterns (for example: feature usage counts, latency metrics, crash statistics, and aggregated behavioral analytics). We do not use de-identified/aggregated datasets to attempt to identify you.

2.6 Model Training and Improvement

Purpose: Improve the AI/ML systems that power the App (including quality, relevance, safety, and overall user experience).

Lawful basis: Legitimate interests (Art. 6(1)(f)), and where required, consent (Art. 6(1)(a)).

De-identification for training: Before using conversation-derived data for model improvement, we apply measures intended to remove or reduce direct identifiers (for example: removing account identifiers such as email/IDs). However, the content of a conversation may still contain personal information if you include it in your messages. Please avoid including personal identifiers in chats if you do not want them processed for these purposes.

Where applicable, you may object to processing based on legitimate interests (see Section 6).

2.7 Marketing and Advertising; Attribution

Purpose: Promote the App, measure campaign performance, and (where applicable) show ads in free tiers.

Lawful basis: Consent (Art. 6(1)(a)) where required (e.g., certain ad/marketing contexts), and/or legitimate interests (Art. 6(1)(f)) for campaign measurement and fraud prevention.

If you installed the App after engaging with an advertisement, we may share limited device/usage signals with advertising and attribution partners to measure campaign effectiveness and detect fraud.

2.8 Legal Compliance and Legal Claims

Purpose: Comply with applicable laws and enforce or defend legal rights.

Lawful basis: Legal obligation (Art. 6(1)(c)) and/or legitimate interests (Art. 6(1)(f)).

3. WHO CAN ACCESS YOUR DATA

We restrict access to personal data to:

  • Authorized personnel who need access to operate, support, or secure the Services

  • Service providers/processors acting on our instructions (e.g., cloud hosting, analytics, crash reporting, customer support tooling, subscription infrastructure, attribution/marketing partners as applicable)

  • Authorities or other third parties where required to comply with law or valid legal process

  • Professional advisors (e.g., legal, accounting) where necessary

  • Transaction parties in connection with a merger, acquisition, restructuring, or sale of assets (with appropriate safeguards)

We do not sell your personal information.

4. DURATION OF DATA PROCESSING (RETENTION)

We retain personal data only as long as necessary for the purposes described in this Privacy Notice.

Unless a longer period is required by law or for legal claims:

  • We generally retain account-related data for the duration of your account and up to five (5) years after account deletion for compliance, dispute resolution, and enforcement needs.

  • Logs and security records may be retained for shorter or longer periods depending on operational needs and legal requirements.

  • De-identified/aggregated analytics may be retained longer where it no longer reasonably identifies a person.

You may request deletion as described in Section 6.

5. INTERNATIONAL DATA TRANSFERS

The Services may process and store data in the United States and other jurisdictions where we or our service providers operate.

Where the GDPR / UK GDPR applies and personal data is transferred internationally, we rely on recognized transfer mechanisms as applicable, such as:

  • Standard Contractual Clauses and the UK IDTA/Addendum, and/or

  • other lawful mechanisms that provide an appropriate level of protection.

6. DATA SUBJECT RIGHTS

6.1 EU / UK Rights (GDPR / UK GDPR)

If you are in the EEA or the UK, you may have the right to:

  • Access your personal data

  • Rectify inaccurate data

  • Request erasure (“right to be forgotten”) in certain cases

  • Restrict processing in certain cases

  • Data portability

  • Object to processing based on legitimate interests

  • Withdraw consent at any time (where processing is based on consent)

  • Lodge a complaint with your local supervisory authority

6.2 California (and Other U.S. State) Rights

Depending on your state of residence, you may have rights to:

  • Know/access the personal information we collected

  • Request deletion

  • Correct inaccurate information

  • Opt out of certain targeted advertising “sharing” (as defined by applicable law)

  • Not be discriminated against for exercising privacy rights

To exercise rights, contact us as described below. We may need to verify your request.

7. CHILDREN’S PRIVACY / AGE REQUIREMENT

The Services are not directed to children under 13, or under 16 in certain jurisdictions (including EU member states where applicable). We do not knowingly collect personal information from children in these age groups. If you believe a child has provided personal information, contact us and we will take steps to delete it.

8. LINKS TO THIRD-PARTY SITES AND SERVICES

The Services may contain links to third-party sites or services. Their privacy practices are governed by their own policies. We are not responsible for third-party privacy practices.

9. SECURITY

We implement appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

10. CHANGES TO THIS PRIVACY NOTICE

We may update this Privacy Notice from time to time. We will post the updated version and revise the “Last updated” date. Where required, we will provide additional notice (e.g., in-app notice).

11. CONTACT US

For questions, requests, or to exercise your rights:

Email: [email protected]

Mail: Smart Media Internet Marketing Ltd., Attn: Legal – Privacy, Sderot hayahasut 11, Beer Sheva, Israel 

12. CONSENT / ACKNOWLEDGEMENT

By using the App, you acknowledge this Privacy Notice and agree that we may collect, use, and share information as described above. Where we rely on consent for specific processing (e.g., certain notifications or advertising contexts), you may withdraw consent at any time through device/app settings or by contacting us.