Privacy policy

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data with which you can be personally identified. Detailed information on the subject of data protection can be found in our privacy policy set out below this text.

Data collection on this website

Who is responsible for the data collection on this website?
Data processing on this website is carried out by the website operator. You can find its contact details in the section "Information on the controller" in this privacy policy.

How do we collect your data?
We collect your data partly because you provide it to us, for example when you submit a dream to us for interpretation, enter your email address for delivery or contact us by email. Other data is collected automatically by our IT systems when you visit the website. This is mainly technical data (for example internet browser, operating system or time of the page view).

What do we use your data for?
Part of the data is collected to ensure that the website is provided without errors. We process further data to create and deliver the dream interpretation you requested and to handle the purchase.

What rights do you have regarding your data?
You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have a right to request the correction or deletion of this data. If you have given consent to data processing, you can withdraw this consent at any time for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have a right to lodge a complaint with the competent supervisory authority. You can contact us at any time regarding this and other questions on the subject of data protection.

2. Hosting and content delivery networks (CDN)

Cloudflare

We use the service "Cloudflare". The provider is Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (hereinafter "Cloudflare"). Our website runs entirely on Cloudflare infrastructure (among other things Cloudflare Workers to deliver the site as well as database and storage services from Cloudflare to store the interpretations and related data).

Cloudflare offers a globally distributed content delivery network with DNS. Technically, the transfer of information between your browser and our website is routed through Cloudflare's network. This enables Cloudflare to analyse the data traffic between your browser and our website and to act as a filter between our servers and potentially malicious traffic. In doing so, Cloudflare may also use technologies to recognise internet users, which are, however, used solely for the purpose described here.

The use of Cloudflare is based on our legitimate interest in providing our web offering as free of errors and as securely as possible (Art. 6(1)(f) GDPR) and, insofar as the processing serves the performance of the contract, on Art. 6(1)(b) GDPR. The data transfer to the USA is based on the standard contractual clauses of the EU Commission; Cloudflare is also certified under the "EU-US Data Privacy Framework" (DPF). Details: https://www.cloudflare.com/privacypolicy/.

Data processing agreement

We have concluded a data processing agreement (DPA) for the use of the service named above. This is a contract required by data protection law which ensures that the processor only processes the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.

3. General information and mandatory notices

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection provisions and this privacy policy. We point out that data transmission over the internet (for example when communicating by email) can have security gaps. Complete protection of data against access by third parties is not possible.

Information on the controller

The controller responsible for data processing on this website is:

blackvine GmbH
Bienenweide 1
27324 Eystrup
Germany

Phone: +49 172 4497717
Email: mail@lunessa.live

The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of the processing of personal data.

Storage period

Unless a more specific storage period is stated within this privacy policy, your personal data remains with us until the purpose for the data processing no longer applies. If you assert a justified request for deletion or withdraw consent to data processing, your data will be deleted unless we have other legally permissible grounds for storing it (for example retention periods under tax or commercial law); in the latter case, deletion takes place once these grounds cease to apply.

General information on the legal bases

Insofar as you have consented to the data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR. If your data is required for the performance of a contract or for pre-contractual measures, we process it on the basis of Art. 6(1)(b) GDPR. Insofar as processing is necessary to fulfil a legal obligation, it takes place on the basis of Art. 6(1)(c) GDPR. Processing may also take place on the basis of our legitimate interest under Art. 6(1)(f) GDPR. The relevant legal basis in each case is set out in the following paragraphs.

Recipients of personal data

As part of our business activities, we work with various external parties. In some cases this also requires the transfer of personal data to them. We only pass on personal data if this is necessary for the performance of the contract, if we are legally obliged to do so, if we have a legitimate interest under Art. 6(1)(f) GDPR or if another legal basis permits it. When we use processors, we only pass on data on the basis of a valid data processing agreement.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The lawfulness of the data processing carried out until the withdrawal remains unaffected.

Right to object (Art. 21 GDPR)

IF THE DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES TO ASSERT, EXERCISE OR DEFEND LEGAL CLAIMS (OBJECTION UNDER ART. 21(1) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of breaches of the GDPR, data subjects have a right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, place of work or the place of the alleged breach. This right to lodge a complaint is without prejudice to any other administrative or judicial remedy.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this only takes place insofar as it is technically feasible.

Information, correction and deletion

Within the framework of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing and, if applicable, a right to correction or deletion of this data. You can contact us at any time regarding this and other questions on the subject of personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data in the cases provided for by law (Art. 18 GDPR). You can contact us at any time for this purpose.

SSL and TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address bar of the browser changes from "http://" to "https://" and by the lock symbol in your browser bar. When encryption is activated, the data you transmit to us cannot be read by third parties.

4. Data collection on this website

Cookies

This website does not set any cookies of its own. For ease of use, we store certain information exclusively locally in your browser (in what is known as local storage or session storage): a draft of your dream text, your email address for re-use and a temporary identifier for the payment process. This data remains in your browser, is not transmitted to us and can be deleted by you at any time via your browser settings.

As part of the payment processing, our payment service provider Stripe may set its own cookies (see the section "Payment services"). The legal basis for the technically necessary local storage mentioned is Art. 6(1)(f) GDPR and Section 25(2) TDDDG (German Telecommunications Digital Services Data Protection Act; strictly necessary storage).

Server log files

The provider of the pages automatically collects and stores information in what are known as server log files, which your browser automatically transmits to us. These are: browser type and browser version, operating system used, referrer URL, host name of the accessing computer, time of the server request and IP address. This data is not merged with other data sources. This data is collected on the basis of Art. 6(1)(f) GDPR; the website operator has a legitimate interest in the technically error-free presentation and the optimisation of its website.

Use of AI for dream interpretation

The core of this offering is a dream interpretation supported by artificial intelligence (AI). When you submit a dream to us for interpretation, we process the dream text you enter as well as optional details (mood on waking, whether the dream is recurring, star sign or date of birth to derive the star sign) in order to generate an individual interpretation from it with the help of an AI language model.

To generate the interpretation, we transmit your input to AI language models operated by providers based in the USA. The technical integration takes place via the Cloudflare AI Gateway and via Cloudflare Workers AI (Cloudflare, Inc., USA).

This transmission involves a data transfer to the USA, which is based on the standard contractual clauses of the EU Commission. The legal basis is Art. 6(1)(b) GDPR, as the AI-supported interpretation is the contractual service you requested.

Special categories of personal data (Art. 9 GDPR): A freely worded dream text may contain sensitive information (for example indications of health, sex life or religious beliefs). We do not deliberately collect such data. Please enter only information that you wish to disclose for this purpose and, as far as possible, avoid details by which you or third parties are directly identifiable.

Storage: Your dream text and the interpretation generated are stored by us in order to provide you with the interpretation, to be able to deliver it again and to prevent misuse. Storage is limited to a maximum of 90 days; after that, the data is automatically deleted.

Nature and limits of the interpretation: The interpretation is created automatically by an AI model and may contain errors. It serves entertainment and self reflection and does not constitute medical, psychological or therapeutic advice. You can find details in our notice about the interpretation.

Enquiry by email or telephone

If you contact us by email or telephone, your enquiry including all personal data arising from it (name, enquiry) will be stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent. The processing takes place on the basis of Art. 6(1)(b) GDPR insofar as your enquiry is connected with the performance of a contract or is necessary for carrying out pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of the enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR).

5. Plugins and tools

Cloudflare Turnstile

We use Cloudflare Turnstile (hereinafter "Turnstile"). The provider is Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA. With Turnstile we check whether input on this website is made by a human or by an automated program. To do so, Turnstile analyses the behaviour of the website visitor on the basis of various characteristics (for example IP address, time spent on the site or mouse movements); the data collected in the process is forwarded to Cloudflare. Storage and analysis take place on the basis of Art. 6(1)(f) GDPR; we have a legitimate interest in protecting our web offerings from abusive automated use and spam. The data transfer to the USA is based on standard contractual clauses; Cloudflare is certified under the "EU-US Data Privacy Framework" (DPF). Further information: https://www.cloudflare.com/cloudflare-customer-dpa/.

6. eCommerce and payment providers

Processing of customer and contract data

We collect, process and use personal customer and contract data to establish, structure and change our contractual relationships. We only collect, process and use personal usage data insofar as this is necessary to enable the user to use the service or to bill for it. The legal basis is Art. 6(1)(b) GDPR. The data collected is deleted after completion of the order or termination of the business relationship and expiry of any statutory retention periods.

Where an order came from (campaign measurement)

If you reach this website through an advertisement or a tagged link, the address you open contains information about the campaign (so-called UTM parameters, and possibly a click identifier from the advertising platform). If you then complete a purchase, we store this information together with your order so that we can evaluate which advertising led to orders.

No cookies are set and no data is stored on or read from your device in this process. The information is not reported back to advertising platforms and is not combined into a profile across devices or visits. Separately, we count page views per campaign on a purely statistical basis, without any reference to individual persons.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in being able to assess whether our advertising is economically worthwhile. The information is stored with the order and deleted along with it, unless retention periods under commercial or tax law require otherwise.

Payment services

We integrate payment services from third-party companies on our website. When you make a purchase, your payment data (for example name, payment amount, means of payment) is processed by the payment service provider for the purpose of handling the payment. The respective contractual and data protection provisions of the providers apply to these transactions. The use takes place on the basis of Art. 6(1)(b) GDPR (contract processing) and in the interest of a smooth, convenient and secure payment process (Art. 6(1)(f) GDPR).

Payment processing on this website takes place via our payment service provider Stripe. As part of the Stripe payment process, depending on your selection and availability, the payment methods credit card, Apple Pay, Google Pay, Amazon Pay, Link, Revolut Pay and Klarna are offered. Depending on the method chosen, the payment data is additionally transmitted to the respective provider; its data protection provisions apply.

Stripe
The provider for customers within the EU is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (hereinafter "Stripe"). The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details: https://stripe.com/privacy.

Apple Pay
The provider of the payment service is Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA. Privacy policy: https://www.apple.com/legal/privacy/en-ww/.

Google Pay
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: https://policies.google.com/privacy.

Amazon Pay
The provider of this payment service is Amazon Payments Europe S.C.A., 38 avenue J.F. Kennedy, L-1855 Luxembourg. Privacy policy: https://pay.amazon.com/help/201212490.

Link
Link is the accelerated payment service from Stripe. Stored payment and contact data may be saved at Stripe and re-used for future payments. The privacy policy of Stripe applies.

Revolut Pay
The provider is Revolut Payments UAB, Konstitucijos ave. 21B, 08130 Vilnius, Lithuania. Privacy policy: https://www.revolut.com/legal/privacy/.

Klarna
The provider is Klarna AB, Sveavägen 46, 111 34 Stockholm, Sweden (hereinafter "Klarna"). Klarna offers various payment options (for example instalment purchase). If you choose to pay with Klarna (Klarna checkout solution), Klarna will collect various personal data from you. Klarna uses cookies to optimise the use of the Klarna checkout solution. You can read details in Klarna's privacy policy at the following link: https://www.klarna.com/international/privacy-policy/.

7. Sending of emails

Resend

For sending transactional emails (for example the confirmation or verification link, delivery of the interpretation or of the download link to the PDF) we use the service "Resend". The provider is Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA (hereinafter "Resend"). In doing so, your email address and the content of the respective message are processed. The legal basis is Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR (reliable and abuse-resistant sending). The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Privacy policy: https://resend.com/legal/privacy-policy. We have concluded a data processing agreement with Resend.