Privacy Policy — Lunar

Effective date: 1 October 2026

Lunar is a business management platform operated by ABCDE Technologies Pvt Ltd, incorporated in India ("Lunar", "we", "us"). This policy explains what personal data we handle, why, and the choices you have.

1. Who we are

Our customers are businesses that run scheduled classes or sessions and use Lunar to manage enrolment, attendance, fees and communications.

This policy covers:

  • Customers — the businesses that subscribe, and their staff.
  • Participants — the people enrolled with a customer, who may be adults or children.
  • Parents and guardians — where a participant is a child.
  • Visitors — to websites we operate.

We use the terms of India's Digital Personal Data Protection Act, 2023 (the DPDP Act) throughout:

  • A Data Fiduciary decides why and how personal data is processed.
  • A Data Processor processes it on a Data Fiduciary's instructions.
  • A child is anyone under eighteen.

2. Our two roles

For our own customer relationships we are a Data Fiduciary. We decide how we process a customer's business details, administrator contacts, billing records, and the usage and technical data their people generate. We answer to you directly for that data.

For the data a customer puts into Lunar we are a Data Processor. Participant records, enrolment, attendance, fee ledgers and contact details belong to the customer. We process them only on that customer's documented instructions, under a written agreement, and never for our own purposes.

So, if you are a participant, or a parent or guardian, start with the business you are enrolled with — it holds the relationship and decides what happens to your data. We will help it answer you. Section 8 covers requests that come to us.

If you hold your own account in the Lunar app, we are the Data Fiduciary for that account; the records it displays about a participant still belong to the customer.

3. What we collect, and why

As a Data Fiduciary we collect business and contact details, login credentials in hashed form, subscription and billing records, app account details, device and usage data, access logs, and your correspondence with us. We use these to:

  • provide and secure the platform, and authenticate users;
  • bill and collect payment;
  • give support and send service messages;
  • prevent fraud and improve the product;
  • meet our legal obligations.

As a Data Processor we handle participant names and ages, enrolment and schedules, attendance, fees and payment status, parent or guardian contact details, messages sent through Lunar, and documents a customer uploads. We use these only for the purposes the customer sets.

What we don't collect. We do not require government identity numbers, financial account numbers, health data, biometrics, caste or religion, and we ask customers not to put such data into free-text fields. We do not store full card or bank credentials — those go directly to our payment provider.

What we never do. We do not sell or rent personal data. We do not use it for advertising or advertising profiles. We do not use customer, participant or parent data to train AI models.

4. Children's data

Some of our customers provide services to children, and we process personal data about children on their behalf. Under the DPDP Act a child is anyone under eighteen.

The customer is the Data Fiduciary and is responsible for obtaining the verifiable consent of a parent or lawful guardian. Our agreement with every customer requires it. Lunar records whether that consent has been obtained and makes its absence visible to the customer.

Our processing of a child's personal data is limited to record-keeping carried out on the customer's instruction for the delivery of that customer's service, and extends to nothing beyond it. We do not:

  • track or behaviourally monitor children;
  • direct advertising at children, or profile children;
  • undertake any processing likely to have a detrimental effect on a child's well-being.

A parent or guardian exercising rights for a child should contact the customer. If you cannot reach it, write to us using the contact details in section 14 and we will help.

5. Who we share data with

We do not sell or rent personal data. We share it with:

  • Service providers who process it on our instructions under written contract, to host our systems, store data, send messages, take payments and provide related services.
  • The customer whose data it is — that is the point of the service.
  • Authorities, where required by law or necessary to defend a legal claim or prevent fraud or harm. We check that any demand is lawful before responding.
  • A successor, in a merger or acquisition. The data stays subject to this policy or one at least as protective, and we tell affected customers first.

6. Services you connect

A customer may connect a third-party service to Lunar. We receive only what that integration's permissions allow and use it only for the feature it was connected for.

Where a customer connects a video meeting platform so Lunar can schedule online sessions, we store:

  • the connected account and host identities;
  • an encrypted access credential;
  • meeting details and join links;
  • participant join and leave times, for attendance;
  • a link to any recording.

We do not download, store or process session video, audio, transcripts or chat. We hold only the link; the recording stays on the meeting platform under its own access controls, and deleting it there removes access immediately.

When the integration is disconnected we delete the stored credentials, identifiers, links and raw event records within 24 hours and revoke the credential with the platform. Attendance records remain as the customer's own record, with the platform's identifiers removed.

7. How long we keep data

We keep your personal data for as long as you are a customer or hold an account with us, and delete it within 90 days after that account closes. We delete it sooner if you withdraw consent or ask us to, or if the purpose it was collected for is no longer being served — unless the law requires us to keep it.

Some records, financial records and security logs in particular, must be retained for longer periods set by law. We keep those for as long as the law requires and no longer.

Backups are encrypted and overwrite on a rolling 30-day cycle.

8. Your rights

You may ask us to:

  • give you a summary of the personal data we hold about you and who we have shared it with;
  • correct, complete or update it;
  • erase it, where we are not required to keep it;
  • withdraw your consent, as easily as you gave it;
  • nominate someone to exercise your rights if you die or become incapacitated.

To make a request, write to us using the contact details in section 14, from your registered address, telling us what you want and enough to identify you. The same address is where you withdraw consent. We aim to respond within 30 days and will not exceed 90.

If you are a participant, a parent or guardian, or a customer's staff member, your data is usually held by that business — ask it first. If you cannot reach it, write to us and we will route your request and act where we may.

9. Security

  • We encrypt data in transit (TLS 1.2 or higher) and at rest (AES-256).
  • We encrypt credentials for connected services with a managed key before storage — they are never logged or sent to a client.
  • We enforce role-based access and tenant isolation at the database layer, so one customer cannot reach another's data.
  • Administrative access requires multi-factor authentication, and our engineers hold no standing access to production data.
  • We log access to personal data and review it.
  • Backups are encrypted and restoration is tested.
  • Every provider handling data for us is under contract.
  • Code is reviewed before release and scanned automatically for vulnerabilities.

No system is perfectly secure, and we do not claim otherwise.

10. Data breaches

If personal data we hold is breached we will tell each affected person without delay, through their account or a registered contact detail, explaining:

  • what happened;
  • what it means for them;
  • what we have done;
  • what they can do;
  • who to contact.

We report to CERT-In within six hours as the 2022 directions require, and to the Data Protection Board once those provisions commence.

11. Cookies

We use cookies on websites we operate and in the platform to keep you signed in, remember preferences, keep the service secure, and understand usage. We do not use advertising cookies or allow third-party advertising trackers. You can control cookies in your browser; blocking essential ones will stop you signing in.

12. Transfers outside India

We host and store personal data in India. Some service providers process data outside India; where they do, they are contractually required to apply protections equivalent to those in this policy, and we transfer only what the service needs. India has not restricted transfers to any country under the DPDP Act. If it does, we will comply.

13. Changes

We update this policy when our practices change, and will tell you by email or in the product before a material change takes effect. The effective date above reflects the current version.

14. Contact and grievances

Write to the Grievance Officer if you are unhappy with how we have handled your data or a request you made. We acknowledge within 72 hours and resolve within 90 days. Once the Data Protection Board of India is operational, you may complain to it if you have raised your grievance with us first and remain unsatisfied.