Last updated: 11 April 2026

This Privacy Policy explains how Lunava ("we", "us", "our") collects, uses, shares, and protects personal information when you use our website at lunava.web.id and the hosting, domain, and email services we provide. We take privacy seriously and we try to say what we mean in plain language.

1. Who we are

Lunava is a web hosting service operated online from Indonesia. The data controller for the information described in this policy is Lunava. For any privacy question, contact us at admin@lunava.web.id.

2. What data we collect

We collect only what we need to operate your account and comply with applicable law:

• Account data: your name, email address, hashed password, and preferences.
• Billing data: invoice history, payment confirmations, and the identifier of the payment method you used. We do not store full card numbers on our systems — those are handled by our payment processor.
• Service data: the domains and hosting plans on your account, configuration changes, and usage metrics (storage, bandwidth, email volume) required to operate the service.
• Support data: the content of tickets and messages you send to us, so we can respond and keep a record of the conversation.
• Technical data: IP address, browser user-agent, and event logs associated with your account, used for security, fraud prevention, and troubleshooting.

3. How we use your data

We use personal data for the following purposes:

• To create and operate your account, provide the services you purchased, and process payments.
• To send transactional emails: account verification (OTP), password resets, login alerts, invoices, receipts, renewal reminders, service activation, DNS and domain confirmations, maintenance notices, and replies from our support team.
• To investigate abuse, protect the platform from fraud and unauthorised access, and enforce our Terms of Service.
• To comply with legal obligations (for example, retaining billing records for tax purposes).

We do not use your data for marketing campaigns, advertising profiles, or bulk promotional email. Lunava does not run marketing mailing lists.

4. Legal basis for processing

We rely on the following legal bases:

• Contract: processing necessary to provide the service you signed up for.
• Legal obligation: processing required to comply with applicable law, such as tax and accounting rules.
• Legitimate interest: protecting the platform from abuse, fraud, and security threats.
• Consent: for any optional processing that goes beyond the above, we ask for your explicit consent and you can withdraw it at any time.

5. Sharing your data

We never sell your personal data. We share it only in these limited cases:

• Payment processors: to settle invoices you have chosen to pay.
• Domain registries and registrars: when you register, transfer, or renew a domain, we forward the required contact details to the registry, as required by the registry's own policies.
• Email delivery providers: transactional messages from Lunava are delivered through reputable email service providers (such as Amazon SES). These providers process the minimum data needed to deliver the message on our behalf.
• Legal requests: if compelled by a valid legal process, and only to the extent required by law.

All third parties we use are bound by their own data protection commitments and are only permitted to process your data to perform the service we have asked them to perform.

6. Data retention

We keep personal data only as long as needed for the purposes it was collected, or as required by law:

• Account and service data: for as long as your account is active. If you close your account, we delete personal data within 90 days, except for records we are legally required to keep (such as invoices and tax records).
• Support tickets: retained for 24 months after the ticket is closed, then deleted.
• Security logs: retained for 12 months, then deleted.

7. Your rights

Depending on your jurisdiction, you have rights over your personal data, including:

• The right to access a copy of the data we hold about you.
• The right to correct inaccurate data.
• The right to delete your data, subject to our legal retention obligations.
• The right to export your data in a portable format.
• The right to object to, or restrict, certain processing.
• The right to withdraw consent where we relied on it.

To exercise any of these rights, email admin@lunava.web.id from the address on your account. We will respond within 30 days.

8. Security

We take reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS) for all pages, hashed passwords, access controls on internal systems, and regular backups. No system is perfectly secure, but we work to reduce risk and respond promptly if something goes wrong.

9. Cookies

The Lunava website and client area use strictly necessary cookies (session and CSRF tokens). We do not use tracking cookies, advertising cookies, or third-party analytics that profile individual visitors.

10. Children

Lunava services are not directed at children under the age of 13, and we do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will remove it.

11. International transfers

Some of our service providers (for example, email delivery) may process data outside of Indonesia. Where this happens, we rely on appropriate safeguards — standard contractual clauses, the provider's data protection framework, and data minimisation — to make sure your data is protected to a comparable standard.

12. Changes to this policy

We may update this policy from time to time. Significant changes are announced on this page and, where appropriate, by email. The "last updated" date at the top tells you when the current version took effect.

13. Contact us

For any privacy question, data request, or concern, email admin@lunava.web.id. We take these messages seriously and will respond in good time.