1. Controller and contact
Hypnolune (company registration in progress, India) is the data fiduciary under India’s Digital Personal Data Protection Act 2023 and, where applicable, the controller under the GDPR for the Hypnolune service. Privacy questions, grievances and rights requests can be sent to support@hypnolune.com. A registered address, grievance officer and any required EU representative will be added before launch.
2. Information we collect
- Email: the address used for a purchase, restoring access, waitlist signup or support.
- Purchase data: subscription ID, product or plan, billing status, renewal/end dates and order references supplied by Lemon Squeezy. Lemon Squeezy is our merchant of record and handles card details, billing address and supported tax obligations; Hypnolune does not receive complete card details.
- Technical and support data: ordinary request/security logs, device and browser information, IP address, timestamps, messages you send and consent records where generated.
- Listening progress: the session last opened, playback position and completed sessions are currently stored only in your browser.
- Quiz data: answers and the resulting goal are currently stored only in your browser. Hypnolune does not receive them through the quiz, and they are not sent to advertising pixels.
Please do not send diagnoses, detailed medical history or crisis information through general forms or support unless it is necessary for us to respond safely.
3. Why we use information
We use account and purchase information to provide and restore paid access, administer subscriptions, prevent fraud, respond to support and honour refunds. Those uses are necessary to perform our contract and meet legal obligations. We use essential security logs for legitimate interests in protecting the service and complying with law. Waitlist communication and any optional marketing rely on consent, which you can withdraw at any time.
The quiz applies simple answer-based rules to recommend content. It is not diagnosis, medical triage or a decision with legal or similarly significant effects.
4. Cookies and browser storage
- hypnolune_access: a strictly necessary, signed, HttpOnly, Secure cookie used to recognise paid member access. It expires after 24 hours.
- Hypnolune quiz keys in localStorage: local-only answers and recommendation used to continue the quiz experience.
- hypnolune:position:<session>, hypnolune:last-session and hypnolune:completed: local-only playback and journey progress.
Lemon Squeezy may set its own essential checkout and account cookies on its domain under its privacy notice. Hypnolune does not load non-essential advertising or analytics cookies in this implementation. If that changes, we will provide appropriate controls before they load where consent is required.
5. Who receives data
Lemon Squeezy receives checkout and billing information as merchant of record. Our hosting provider processes requests and security logs. A configured waitlist automation provider receives email, selected plan and selected goal only when you submit that form. Carefully authorised contractors and advisers may receive the minimum data needed for support, security, accounting or legal work. We do not sell personal data.
6. International transfers
Hypnolune is based in India and service providers may process data in other countries. Before launch, we will document provider locations and use contractual or other recognised safeguards for restricted transfers, including GDPR standard contractual clauses where appropriate.
7. Retention and security
We keep purchase and tax records for the period required by applicable law; support correspondence for up to two years after closure unless needed for a dispute; waitlist data until launch communication or withdrawal; and security logs according to documented security and legal schedules. Browser-only quiz and progress data remain until you clear site data. Signed access cookies expire after 24 hours.
We use proportionate access controls, encryption in transit, signed access tokens and restricted credentials. No system is completely secure. If a breach creates applicable notification duties, we will follow the DPDP and GDPR timelines and provide required information.
8. Your choices and rights
Depending on where you live, you may ask for access, correction, deletion, restriction, objection or portability; withdraw consent; nominate another person under the DPDP framework; and raise a grievance or complain to a regulator. We normally answer GDPR requests within one month. We may need to verify your identity and retain records the law requires.
Clearing this site’s browser storage removes local quiz and progress data. Privacy deletion and subscription cancellation are separate: use the account portal to stop billing. Contact support@hypnolune.com for a rights request or grievance.
9. Children
Hypnolune is for adults aged 18 and over. We do not knowingly offer the service to children or seek their personal data.
10. Changes
We will post material updates here and provide additional notice where required. The date at the top shows when this notice was last updated.