Privacy Policy

NEXOLUNA is the controller responsible for the personal data described in this policy. Our service is operated from Turkey and offered to customers internationally. You can reach us at:

• Email: [email protected]

Depending on how you interact with us, we may process the following categories of personal data:

• Contact and identity details you submit through our forms, such as your name and email address.
• Store details you provide, such as your Shopify store URL and any notes you choose to share when you request a Health Scan or get in touch.
• Technical and usage data, such as your IP address, browser and device information, the pages you view, and cookie identifiers.

We collect this data when you complete a form on our site, contact us by email or messaging, or simply browse the site (through cookies). Please do not include special categories of data (for example health, religion, or ethnicity) in free-text fields; we do not knowingly collect such data through this site.

We process your personal data to:

• respond to your Health Scan, demo, or contact requests and communicate with you,
• provide information about our products and services,
• operate, improve, and secure our website and services,
• run and measure the effectiveness of our advertising and marketing,
• meet our legal obligations and respond to lawful requests.

Where the GDPR applies, we rely on one or more of the following legal bases:

• Your consent, for example for advertising and analytics cookies (you can withdraw it at any time),
• Performance of a contract or taking steps at your request before entering into one,
• Our legitimate interests, such as running and securing our site and understanding how it is used, provided your rights do not override them,
• Compliance with a legal obligation.

We may use cookies and similar technologies to improve your experience, analyze traffic, and support our advertising. The categories we use are:

• Strictly necessary cookies, required for core functionality and security.
• Analytics and performance cookies, which help us understand how visitors use the site. We use Google Analytics and Microsoft Clarity for this; Clarity can create heatmaps and session recordings (sensitive fields are masked by default). These tools run only after you give cookie consent.
• Advertising cookies, used to measure and personalize our ads. We use the Google tag and Meta (Facebook) Pixel with the Meta Conversions API. These tools run only after you give cookie consent.

You can accept or decline non-essential cookies through the consent banner, and you can clear or block cookies in your browser at any time. Some strictly necessary cookies cannot be disabled without affecting how the site works.

Meta Pixel and Conversions API. With your consent, we share limited information with Meta (Facebook) to measure and optimize our advertising: contact details such as your email and phone number (irreversibly hashed with SHA-256 before sending), your IP address, browser (user-agent), Meta cookie identifiers (_fbp, _fbc), and the page you visited. This happens when you submit a form, contact us on WhatsApp, or view certain pages, and its purpose is to measure ad performance and report conversions accurately. The legal basis is your consent: the Pixel is not loaded and no data is sent to Meta unless you accept through the consent banner. You can withdraw consent by clearing your browser cookies or through Meta's ad preferences.

You can manage ad personalization through these links:

• Google ad settings: adssettings.google.com
• Meta (Facebook) ad preferences: facebook.com/adpreferences
• Browser-based ad choices: youronlinechoices.eu
• Google Analytics opt-out add-on: tools.google.com/dlpage/gaoptout

We may share your personal data with the following recipients to fulfil the purposes above:

• Service providers, such as email delivery, hosting, infrastructure, and technical support vendors.
• Advertising and analytics partners, such as Google and Meta.
• Authorities, where required by law.

Some of our providers host data outside your country. In particular, form notifications are delivered through Resend (a US-based email infrastructure provider), and advertising and analytics run through internationally based platforms such as Google and Meta. Where we transfer data internationally, we rely on an appropriate legal basis, such as your consent or suitable safeguards.

We keep your personal data only for as long as necessary for the purposes described here and to meet any legal retention requirements. When it is no longer needed, we delete, destroy, or anonymize it.

Subject to applicable law, you have the right to access, correct, delete, or restrict the processing of your personal data; to object to processing; to data portability; and to withdraw consent at any time where processing is based on consent. If you are in the European Economic Area or the UK, you also have the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at [email protected]. We will respond within the timeframe required by applicable law.

We take appropriate technical and organizational measures to protect your personal data against unlawful processing and unauthorized access. Data is transmitted over encrypted (SSL) connections and access is restricted.

We may update this Privacy Policy from time to time. The current version is always published on this page, and we update the effective date when we make material changes. We recommend reviewing it periodically.

If you have any questions about this policy or how we handle your data, contact us at [email protected].