Consent to processing of health and intimate-life data

Last updated: 2026-09-25

Controller

The controller is PT. TECHNO CAPITAL INDONESIA, Jalan Sunset Road No. 99D, Desa/Kelurahan Kuta, Kec. Kuta, Kab. Badung, Provinsi Bali, 80361, Indonesia; tax identification number (NPWP) 40.174.113.7-905.000. For data protection matters, write to [email protected], on Telegram to @lunnaya_care, or by post to the address above.

This document applies to accounts registered outside Russia. Accounts registered in Russia are served by a different controller under Russian law and its own documents.

The short version

1. What this consent covers

The Apple Health list above is what the iPhone app reads from Apple Health, and it is identical in the system permission prompt, the Privacy Policy and here. The iPhone asks about it in two separate prompts, and the two parts behave differently.

• Menstrual flow is requested when you connect Apple Health. It syncs with the calendar and is stored on our server as a cycle event: the tracker itself is built from it.
• Sleep, heart rate variability, resting heart rate, wrist temperature during sleep and cycle symptoms are a separate system prompt, shown once, after you accept the Lunar Oracle consent. Declining it closes nothing — neither the Oracle nor anything you paid for. These five signals are computed on the phone itself, are not stored by us, and travel only with your message to the Oracle.

There is no separate checkbox for the body signals on the consent screen: they are governed by the iPhone's own permission (Settings → Privacy & Security → Health → WooMoon), and cycle events already stored are removed when you delete your data (section 7).

About the tracker pause — and what we do not ask. When the tracker is paused, we record the moment of the pause and, if you paused it yourself from the delay check-in (the message about a delay that carries a "pause the tracker" button), that fact too: a pause you chose and a pause the automation sets on its own after 180 days without a mark must not be confused. Why there is no cycle we neither ask nor store — not pregnancy, not menopause, not treatment. The origin of the pause is derived from the delay you had already marked and is covered by this consent together with the rest of your cycle data. The question we ask after you cancel a subscription is outside this consent: none of its options says anything about your body — see section 2.2 of the Privacy Policy.

2. Why we process it

• to keep your cycle calendar and show where in it you are;
• so the morning recommendation matches your phase instead of being generic;
• so the Lunar Oracle answers you, and not a woman in the abstract;
• so that body signals from Apple Health help you understand your own state better;
• so that a tracker pause you chose yourself is not confused with one set by the automation.

And nothing else. We do not use any of these categories for advertising, marketing, profiling, or behavioural analysis in anyone's commercial interest. What the AI recipients may do with what they receive under their own terms is set out in section 3.

3. Who this data is shared with

We name the recipients plainly rather than calling them "technology partners".

AI recipients — the language model that writes the texts, and the intermediary through which the request reaches it. The morning recommendation and the Lunar Oracle use the same recipients. The model receives:

• for the morning recommendation — your cycle day and length, the phase and its description, any delay you recorded, and the day's lunar data. No name, date of birth, email, body signals or intimacy markers. This transfer, including outside your country, takes place on the basis of this consent;
• for the Lunar Oracle — the text of your message, recent turns of the conversation and the memory digest from your device, your name, age in years, cycle position and history, Apple Health body signals (if you allowed the iPhone to share them), intimacy markers for yesterday and today, your archetype (natal nakshatra, rashi and lunar day), a note on which birth details are filled in on your profile (without the values), the natal chart positions (lagna, the signs and houses of the planets, the Moon's nakshatra, yogas, the current dasha periods without dates), the text of today's recommendation, and — when you yourself ask for a reading of your chart — further calculations (dasha dates, transits, a chart for the moment of your question). The full list is in the Lunar Oracle consent.

Exactly who receives this data and on what terms:

Recipients as of edition 5 (2026-09-25): primary recipient — kie.ai → DeepSeek; reserve, used when the primary is unavailable — Google. Within this list and on these terms the model provider may change without a new consent; a new recipient or new processing terms require a new consent.

• NEXUSAI SERVICES LLC (kie.ai) — the kie.ai API aggregator: receives the request, processes it with the DeepSeek model and returns the reply. Address: 118 Krameria St, Denver, CO 80220, USA. Country of processing: the United States of America — kie.ai does not disclose where exactly the model runs; by its public statements, on servers in the USA. Training on data: the kie.ai privacy policy does not say whether the content of API requests is used to train models. Retention: not disclosed — the kie.ai privacy policy does not state how long request content is kept. Data processing agreement: not confirmed — we have no separate agreement with kie.ai. Capacity: if it uses the data beyond relaying it to the model, it processes it for its own purposes as an independent controller, not on the controller's behalf; there is no contract with kie.ai.
• Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (DeepSeek) — developer of the DeepSeek model that writes the primary recipient's reply; a possible recipient: kie.ai does not disclose where exactly the model runs, and it cannot be ruled out that request content is passed to DeepSeek in the PRC, so the controller assumes the worst case. Address: Room 1201, Building West 1, Huijin International Mansion, No. 169 Huancheng North Road, Gongshu District, Hangzhou, Zhejiang, People's Republic of China. Country of processing: possibly the People's Republic of China — if request content is passed to DeepSeek. Training on data: DeepSeek's Open Platform terms do not describe the use of data received for training; the controller assumes that DeepSeek may use it to train its models, and this cannot be opted out of through the app. Retention: not disclosed — DeepSeek's Open Platform terms do not describe how long data is kept. Data processing agreement: not confirmed — we have no separate agreement with DeepSeek. Capacity: may process the data it receives for its own purposes as an independent controller, not only on the controller's behalf; there is no contract with DeepSeek.
• Google LLC (Google) — owner of the Gemini model that writes the reply (paid Gemini API tier). Address: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Country of processing: the United States of America and any other country where Google operates capacity: Google processes and may temporarily cache data wherever its infrastructure runs. Training on data: under the paid Gemini API terms Google does not use prompts and replies to train models or improve its products, and does not have them reviewed by people for that purpose. Retention: prompts and replies are logged for a limited period — solely to detect policy violations and for legally required disclosures. Data processing agreement: confirmed by the controller on 19 September 2026 (Gemini API Paid Services terms). Capacity: processes the data on the controller's behalf under the paid Gemini API terms.

The history of this list is on the AI recipients page.

The full list of what is sent is in sections 5 and 7 of the Privacy Policy. In short: under the paid-tier terms Google does not use this data to train models or improve its products, but logs it for a limited period to detect abuse; kie.ai does not disclose where the model runs (by its own account, in the USA) or how long it keeps request content; a transfer to DeepSeek in China cannot be ruled out, and DeepSeek's terms describe neither retention nor training — we assume DeepSeek may use the data to train its models, and this cannot be opted out of through the app. We have no data processing contract with kie.ai or DeepSeek, so they may process what they receive for their own purposes as independent controllers. This is an international transfer — to the USA and possibly to the People's Republic of China. For the morning recommendation it rests on this consent; for the Lunar Oracle, on the separate consent to international transfer, accepted by the same tick as the rest of the Oracle consent. The legal bases per recipient are in section 8.

Where this data does not go: nothing listed in section 1 is sent to advertising or analytics services (AppsFlyer, Google Analytics, Meta, Google Ads).

What is recorded about the consent itself. Every tap — grant and withdrawal alike — is stored as its own row: the consent scope, the action, the version of the text you saw, the surface, the language, the time, and your IP address. The IP is part of the evidence that it was you who consented, and when. That row outlives account deletion, but on deletion both the account number and the IP are scrubbed from it: what remains is "someone consented to scope X of version Y at time T".

These rows are written by the consent screen before the Lunar Oracle — section 6. And plainly, about what does not reach that journal: "the screen was shown" and "she closed it without accepting" are neither consent nor its refusal, they are never written there, and they do not affect your access. But they do not vanish either: we record them as an ordinary product analytics row tied to your account, like other events in the app, so we can see whether the screen reads clearly. Not one of your ticks and not one of your words is in that row: only which areas the screen displayed, and which version of the text. It is erased along with your account.

4. Where this data is stored

• Cycle data and intimacy markers — on our server, until you delete your account.
• Apple Health measurements other than menstrual flow — nowhere. They are computed on the phone and travel with one specific question to the Oracle; no server-side copy exists. Menstrual flow is stored as a cycle event (section 1).
• Oracle conversations — on your device only. We do not have them. If you erase them, they are gone for good.

One caveat, without which the line above would read wider than it is: every message passes through our server — it assembles the context, calls the model and returns the reply. In that moment the server sees and processes the text; it does not save it. "On your device only" is about storage. The fact that a message was sent (when, from which surface, never its text) we do record in our event log.

5. What is voluntary, and what declining costs

The Lunar Oracle — one indivisible consent. It consists of three documents, one per legal basis — processing and transfer to the model, international transfer, and special categories of data — and is accepted by a single tick. There are no switches for its parts, and that is a decision, not an omission: either you agree and use the Oracle, or it is not available to you. Every message carries the whole context listed in section 3 — cycle data, intimacy markers, your name, age in years and the natal-chart positions included; you cannot switch any part off and keep using the Oracle, and we will not pretend you can. Declining means only "I do not want to use the Oracle": cycle, calendar, moon and recommendations keep working as before.

Body signals from Apple Health — separately, at the iPhone level. They are sent only if you allowed them in the iPhone's system prompt. Declining closes nothing — neither the Oracle nor anything you paid for: the Oracle will simply know less about your body.

The calendar and the morning recommendation are built on the cycle data you enter yourself. If you do not want it processed, you can delete it with your data (section 7) — the tracker does not work without it.

No consent box is pre-ticked. There is no "accept all" button.

6. How consent is given

Consent to the Lunar Oracle is given by a distinct affirmative action: before your first conversation a screen rises — what goes to the model, links to the three documents, one tick and an "I accept" button. The box is not pre-ticked, and without "I accept" there is no conversation. We record when you accepted and which version of the text you saw (section 3).

Where that screen exists. In the web app, and in the iPhone app from version 1.0.28. Version 1.0.27 has the earlier form of the screen, with separate switches; older versions have no such screen at all, and there the Oracle answers without it until you update the app. A withdrawal made in any version closes the Oracle everywhere (section 7).

About registration, separately and honestly. From 25 September 2026, at the last step of registration — in the Telegram bot, the web app and the iPhone app — you give two separate ticks: one for the Terms of Service and the Privacy Policy, the other for this health data consent. Which documents are shown is decided by the country of registration, not by the interface language; we record the time of consent. Nothing changes for accounts registered earlier, and we do not ask again: back then separate ticks existed only in the English-language versions, and for anyone who registered in Russian we will not invoke a tick that was never given.

7. Withdrawal

Consent to the Lunar Oracle is withdrawn where it is given: Settings → Consents (in the iPhone app and in the web app). There is one button, "Withdraw": the consent is indivisible, so it is withdrawn whole. Accepting again is a single tap with no follow-up question — giving must never be cheaper than taking back.

It takes effect everywhere, not only where you tapped it. Consent lives on the server, so withdrawing in one version of the app closes the Oracle in all of them — including older iPhone versions without the consent screen.

What will happen after withdrawal:

• withdrawing the Oracle consent closes the Lunar Oracle — and nothing else: cycle, moon, calendar and recommendations keep working as before;
• Apple Health access is revoked at the system level: Settings → Privacy & Security → Health → WooMoon. From your next message the body signals are no longer assembled, and menstrual flow stops syncing; cycle events already stored remain until you delete your data;
• the conversation on your device is erased by you, with "Clear conversation". We do not store it, so there is nothing on our side left to erase.

An honest caveat: what you can withdraw is future transmission. What has already gone to the model cannot be recalled — including where a recipient has already used it to train its model. That is true of any service, and we will not pretend otherwise. Withdrawal does not make processing before it unlawful.

To stop the processing of your health data altogether — for the calendar and the morning recommendation too — delete your data: the app has a delete-my-data button; what it does and does not do is in section 12 of the Privacy Policy.

8. Legal basis

Health data and data concerning your sex life are special categories of personal data under the GDPR (Art. 9). We process them on your explicit consent (Art. 9(2)(a)): for the calendar and the morning recommendation — this consent; for the Lunar Oracle — the consent to processing of special categories, accepted with the Oracle's single tick. You can withdraw consent at any time (Art. 7(3)).

International transfers: for Google LLC the transfer relies on the EU-US Data Privacy Framework, under which Google LLC is certified. For kie.ai and DeepSeek there is no adequacy decision and no standard contractual clauses or data processing agreement, so the transfer to them rests on your explicit consent under Art. 49(1)(a), given after being informed of the risks described in section 3 — for the morning recommendation, this consent; for the Lunar Oracle, the consent to international transfer.

You also have the right to lodge a complaint with a supervisory authority — in the EU/EEA, in the member state of your habitual residence, place of work or place of the alleged infringement (GDPR Art. 77); in the United Kingdom, with the Information Commissioner's Office.