Privacy Policy

Stash Technologies Inc. ("Luun," "we," "our," or "us") values and respects your privacy. This Privacy Policy describes how we collect, use, share, and safeguard your personal data when you use our websites, applications, integrations, products and services (collectively, the "Services").

By using our Services, you agree to the terms described in this Policy.

We comply with the following data protection frameworks where applicable:

• General Data Protection Regulation (EU) 2016/679 (GDPR)
• UK GDPR & Data Protection Act 2018
• California Consumer Privacy Act (CCPA) as amended by CPRA
• Turkish Law on the Protection of Personal Data No. 6698 ("KVKK")
• Other global privacy regulations where we operate

Information you provide

• Name, surname, job title and company information
• Email address, phone number and contact preferences
• Store addresses and e‑commerce platform data (Shopify, WooCommerce, ikas, etc.)
• Billing and payment details (processed securely via Stripe or other payment processors)

Information collected automatically

• Usage data (clickstream, time spent, pages viewed, referral links)
• Log data (IP address, browser, operating system, device identifiers)
• Approximate geolocation (derived from IP address)
• Chat transcripts and interaction data
• Advertising identifiers (cookies, pixels, UTM parameters)

Information from third parties

• Marketing platforms (Google, Meta, LinkedIn, TikTok, etc.)
• E‑commerce platforms (Shopify, WooCommerce, ikas, etc.) connected to your account
• Analytics and CRM providers
• Partners and resellers

We process data for the following purposes, based on lawful grounds such as contract performance, legitimate interest, consent, and legal obligation:

• Service delivery – to operate, provide, and maintain the Luun platform and chatbot features on connected merchant websites.
• Account and billing management – to create and manage merchant accounts, verify identity, process payments, and provide customer support.
• AI performance and improvement – to analyze anonymized chat interactions and system behavior in order to enhance response accuracy and overall product quality.
• Usage analytics – to understand aggregated usage patterns, monitor system performance, and improve functionality.
• Product development – to research, test, and launch new features that enhance the user and shopper experience.
• Security and compliance – to detect, prevent, and investigate fraudulent or abusive activity, enforce our Terms of Service, and comply with applicable legal or tax requirements.
• Communication and updates – to send account notices, product updates, or promotional content (only with your consent where required by law).

We use cookies, tags and similar technologies for:

• Campaign optimization and conversion tracking
• Analytics (Google Analytics, PostHog, etc.)
• Website performance and session management
• Advertising and retargeting (Google Ads, Meta Ads, LinkedIn Ads, TikTok Ads, etc.)

For EU/UK/TR users, no non‑essential cookies are placed without prior consent.

You can manage cookie settings via your browser.

We do not sell or rent personal data to any third parties. We share limited data with trusted providers, including:

• Cloud infrastructure: Microsoft Azure, Amazon Web Services (AWS), Google Cloud
• Analytics: Google Analytics, PostHog
• Advertising: Meta, Google Ads, LinkedIn, TikTok
• CRM/Marketing: folk CRM
• Automation: Zapier
• Customer Support: Whatsapp / email systems
• Payments: Stripe or other payment processors

All subprocessors are bound by confidentiality and data processing agreements.

Your personal information may also be stored and processed in any country where we have facilities or in which we engage third party service providers. As a result, to the extent permitted under applicable law, your personal information may be transferred to countries outside your country of residence, which may have different data protection rules than in your home country. While such information is outside of your country, it is subject to the laws of the country in which it is located, and may be subject to disclosure to the governments, courts or law enforcement or regulatory agencies of such other country, pursuant to the laws of such country.

We keep data only as long as necessary for the purposes described in this Policy:

• Chat logs and AI training data: anonymized or deleted within a defined period unless longer retention is required for security, legal or operational needs.
• Account and billing data: retained for 7 years (for legal compliance).
• Marketing data: retained until you opt out or withdraw consent.

We have implemented reasonable physical, organizational, contractual and technological security measures with a view to protecting your personal information and other information from loss or theft, unauthorized access, disclosure, copying, use or modification. We have taken steps to ensure that the only personnel who are granted access to your personal information are those with a business 'need-to-know' or whose duties reasonably require such information.

While we take precautions against possible breaches in our websites and customer databases, no website or Internet transmission is completely secure, so unfortunately we cannot guarantee that unauthorized access, hacking, data loss, or other breaches will never occur. Your use of our website and the Services are at your own risk. We assume no liability for disclosure of your personal information due to transmission errors, unauthorized access, or causes beyond our control, including security failures on the part of our partners and third party service providers and processors.

If you have any reason to believe that your interaction with us is no longer secure, please contact us immediately at team@luun.co

Depending on your jurisdiction, you may have the following rights:

• Access, correct, or delete your personal data
• Object to or restrict processing
• Request data portability
• Withdraw consent at any time (where consent is used)

To exercise any of these rights, contact: team@luun.co

We may disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. We also may disclose data when required by law, regulation, court order or to enforce our Terms of Service.

Our Services are not directed to individuals under 16 years of age. We do not knowingly collect data from minors. If we become aware of such data, we will delete it immediately.

Our Services may contain links to other sites and services and we are not responsible for the privacy practices or the content of such sites and services. We encourage you to read the privacy policy of linked sites and services. Their privacy policies and practices differ from our policies and practices.

We may use automated tools, including AI algorithms, to personalize recommendations, trigger marketing campaigns and assess engagement. Significant decisions impacting individuals are subject to human oversight where required by law.

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated date and the updated version will be effective as soon as it is accessible. When changes are made to this Privacy Policy, they will become immediately effective when published in a revised Privacy Policy posted on our website unless otherwise noted. We may also communicate the changes through our services or by other means. We encourage you to review this Privacy Policy frequently to be informed of how we are protecting your information.

By submitting your personal information to us, by accessing or using any of the products or services we offer, by using our Services, or by voluntarily interacting with us after we publish or communicate a notice about the changes to this Privacy Policy, you consent to our collecting, using and disclosing your personal information as set out in the revised Privacy Policy.

Stash Technologies Inc.

Dover, DE, 19901, United States