1. Who we are

galiluna ("we", "us") provides a platform where organizations generate, edit, and publish marketing and campaign landing pages with artificial intelligence. This policy explains what personal information we collect, why, and what happens to it.

2. Information we collect

Account data. Your organization's name and contact email, each user's email address and password (stored only as a salted hash), role, and whether they accepted the Terms and Conditions.

Content you upload. Campaign briefs, images, logos, brand settings, and the pages generated from them. Published pages are publicly accessible by design.

Payment data. Payments are processed by Stripe; card numbers never touch our servers. We keep a record of each payment (plan, amount, date, coupon used) for billing history.

Activity data. We keep an audit trail of actions taken in the platform (who did what, when, with which inputs, and from which IP address). It exists to support you, reproduce reported bugs, and protect the service from abuse.

Support conversations. Tickets you open and the replies exchanged with our team.

3. How we use it

To operate the service: generating your pages (your briefs and image references are sent to our AI provider for that purpose), publishing them, enforcing plan limits, processing payments, answering support tickets, sending essential emails (password resets, payment confirmations), and keeping the platform secure. We do not sell personal information, and we do not use your content to advertise to anyone.

4. Who we share it with

Only the processors needed to run the service: our AI provider receives campaign briefs to generate pages; Stripe processes payments; our email delivery providers send transactional emails; our internal messaging provider sends our own team a notification (customer email, amount, and plan) when a payment is made or a support ticket is opened, so we can respond quickly (an internal operational alert, never used for marketing); and our hosting provider stores the data. Each receives only what its job requires. If a purchase used a seller's referral code, that seller can see the sale attributed to them (plan and amount), not your content. When you ask for a content strategy, the numbers and captions of your connected account's posts are sent to our AI provider to write it (see section 5).

5. Accounts you connect (Instagram, Facebook, TikTok, YouTube)

You can connect your own social media and advertising accounts so galiluna can publish for you and show how your content performs. You choose which accounts to connect and approve the permissions on the platform's own consent screen. We then store the access tokens those platforms give us, encrypted, and use them only for what you ask for:

• Publishing. Posting the photos, videos and Shorts you choose to the accounts and channels you select, when you press publish.
• Content performance. Reading your own latest posts and their numbers (for example views, likes, comments, shares, saves, reach, watch time and where views came from), when you press Refresh or ask for a strategy, to show them to you and to write your content strategy.
• Advertising. If you connect an ad account, creating paused campaigns you request and reading their results.

This data is shown only to your organization. We do not sell it, use it for advertising, share it with other customers, or use it to develop, improve or train generalized artificial intelligence or machine learning models. To write a strategy you request, the relevant post numbers and captions are sent to our AI provider for that request only.

Disconnecting. You can disconnect any account at any time from Account and team, then Connections. We then delete its stored tokens and the cached copy of its posts and stop all access. Strategies we already wrote for you stay in your account history until your organization is deleted, or until you ask us to delete them through a support ticket. You can also remove galiluna's access from the platform's own settings.

Google and YouTube. galiluna uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. You can revoke galiluna's access at any time from your Google security settings. galiluna's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Cookies

We use a strictly-necessary cookie to keep you signed in. With your permission, we also use analytics technologies, including Google Analytics, to understand how visitors use our website, improve the platform, and measure the effectiveness of our own marketing, and advertising measurement technologies from Google Ads and Meta (Facebook) that tell those platforms when an ad they showed led to a sign-up or purchase here. These technologies use cookies or similar identifiers. They may collect the pages you view, how long you stay, your device and browser type, an approximate location derived from your IP address (we do not store the full address), and the site or ad that referred you. This is used only to improve galiluna and measure our marketing; we do not sell it or build advertising profiles of you elsewhere. Analytics data is retained according to our Google Analytics account's configured retention window. You can accept or reject non-essential cookies from the banner shown on your first visit, or any time after via the "Cookie preferences" link in the footer; you can also block cookies in your browser or use Google's opt-out add-on. Full details, including the exact cookies set and their duration, are in our Cookie Policy. If your organization attaches its own Google Tag Manager container to its published campaign pages, tracking on those public pages is governed by your organization's own policy, not this one.

7. Retention and deletion

Account data and content are kept while your organization has an account. When an organization is deleted, its users, campaigns, and published pages are removed; payment records and the audit trail are retained as required for financial and security record-keeping. You can request deletion of your organization at any time through a support ticket.

8. Security

All traffic is encrypted with HTTPS, passwords are stored as salted hashes, every institution's data is isolated at the database-query level, and password reset links are single-use and expire within an hour. No system is perfectly secure; if we learn of a breach affecting your data, we will notify your organization's contact email.

9. Your rights

You can access and correct your account details in the app, and request a copy or the deletion of your personal information through a support ticket. Depending on where you live (e.g. Canada's PIPEDA, the EU's GDPR), you may have additional statutory rights; we honor those requests.

10. Changes

If this policy changes materially, we will announce it in the app before the change takes effect.

11. Contact

Privacy questions: open a support ticket in the app or write to our support email.