PRIVACY NOTICE
What we do with what you tell us
The short version. You give us your details so we can put you in the community. The organizers are the only people who read them. We do not sell them, publish them, share them for advertising, or hand them to anyone who isn't helping us run the site. You can ask us to delete them and we will. Everything below is the same thing said precisely, because it has to be.
1. Who is responsible for your data
Lunar Startup Community is operated by Melange Space Technologies ("Melange", "we", "us"), a company organised under the laws of the State of Delaware, United States of America. Melange is the data controller — and, where United States state privacy law uses the term, the business and the controller — for the personal data described here. That means we decide what is collected and why, and we are the ones you can hold to this notice.
Contact: hello@lunarstartups.space. Our postal address is available on request from that address.
The community is administered by Melange's organizers. They are the only people who see member records.
2. What we collect, and only when you give it
There is no analytics, no advertising, no tracking pixel and no third-party script anywhere on this site — nothing on these pages reports back to anyone, and every font and image is served from this domain. We collect nothing ourselves until you submit the join form.
One thing happens without us asking, and you should know about it: like every website, ours runs on a server, and our hosting provider keeps short-lived technical logs of requests, which include IP addresses. We do not use those logs to build any picture of you, and we cannot search them by person. They exist so the site can be kept running and defended against attack, which is our legitimate interest in doing so, and the provider discards them on its own schedule.
When you submit the form, we receive:
- Name and email address — required.
- Age — required.
- Gender — optional, blank by default, and free text if you choose to describe it yourself.
- Country or city, and the time zone your browser reports — optional and automatic respectively.
- Company or organisation, your role, and any link you give us — required except the link.
- The Moon Tech areas you selected, and why you want to join — required.
- A Discord username, or a connected Discord account — optional. See section 6.
- Whether you asked for meetup emails, and the fact and time of your consent.
Before it accepts a submission, the form has your browser solve a small arithmetic puzzle in the background. This is how we keep automated sign-ups out without making anybody prove they are human, and it is why there is no CAPTCHA here. It runs entirely on your own device, involves no third party, and tells us nothing about you — the answer is a number, and it is discarded once checked.
Alongside those answers the form records the time of submission and a one-way hash of your IP address, scrambled with a secret key so it cannot be turned back into an address. It exists only to stop one machine from submitting the form fifty times. We do not keep the address itself, your browser's user-agent, or the page you arrived from.
We also keep the date you were added to Discord, and — if the approval step described in section 3 is ever in use — any private note an organizer wrote when deciding.
All of this comes directly from you. We do not buy data, enrich it from other sources, or look you up anywhere.
You are under no legal obligation to give us any of it. There is no statute and no contract requiring it. But the required fields are required for a practical reason: without a name, an email, where you work and why you want to join, there is no membership record to create, and we will not be able to sign you up. The optional fields — gender, your location, a link, a Discord username — you can leave blank with no effect whatsoever.
3. Why we hold it, and on what legal basis
Joining is immediate: you fill in the form, connect Discord, and you are a member. Nobody screens you first. We reserve the ability to turn on an organizer-approval step in future, and if we do, the only change is that an organizer reads your record before you are admitted; the data itself, and everything below, stays the same.
| What we do with it | Which data | Legal basis |
|---|---|---|
| Create and run your membership; contact you about it | Everything in section 2 except gender and the IP hash | Your consent, and our legitimate interest in running a members' community (GDPR Art. 6(1)(a) and 6(1)(f)) |
| Understand who is in the room, in aggregate, and choose a meetup time that suits the membership | Age, gender, country, time zone, areas | Your consent (GDPR Art. 6(1)(a); Art. 9(2)(a) for gender, treated as explicit consent) |
| Add you to the Discord server | Discord username or connected account | Your consent (GDPR Art. 6(1)(a)) |
| Send you meetup announcements | Name, email | Your consent, given by ticking that box (GDPR Art. 6(1)(a)) |
| Stop automated and abusive submissions | Hashed IP address, submission time | Our legitimate interest in keeping the form usable (GDPR Art. 6(1)(f)) |
Gender is treated with extra care. It is optional, it is blank unless you choose otherwise, we use it only in aggregate counts, and it is never shown to other members. If you would rather we did not have it, leave it blank — nothing about your membership changes.
You can withdraw your consent at any time by emailing us. Withdrawing it does not make what we did beforehand unlawful, and it may mean we can no longer keep you in the community.
Membership is granted automatically rather than by a person, but that decision produces no legal or similarly significant effect on you within the meaning of GDPR Article 22: it admits you to a free discussion group and nothing more. You can ask a person to look at it at any time by emailing us.
4. Who else sees it
The organizers, through a password-protected admin page. Beyond them, your data passes through the companies we use to run the site. They act on our instructions under written terms, and are not permitted to use your data for their own purposes.
| Who | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting the site and running the form | United States |
| Our database provider (currently Neon Inc.) | Storing member records | United States / European Union |
| Resend (Plus Five Five, Inc.) | Sending the emails we send you | United States |
| Google LLC | A private spreadsheet the organizers use to read member records, where they have one set up | United States |
| Discord Inc. | Adding you to the server, if you asked us to | United States |
That is the whole list. We do not sell personal data, we do not share it for cross-context behavioural advertising, and we have never done either. If we ever need to add a provider, we will update this notice before it starts processing anything.
We may also disclose data where we are legally required to — a court order, subpoena, or a lawful request from an authority — or where it is necessary to establish, exercise or defend a legal claim. If Melange is ever acquired or merged, member records may transfer with the business, and we would tell members first.
5. Sending data outside your country
Melange is a United States company and our providers are mostly in the United States, so your data is stored and processed there.
For people in the European Economic Area or the United Kingdom, those transfers rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) in our agreements, together with the supplementary measures described in section 10, or on an adequacy decision where one applies. You can email us for a copy of those safeguards and we will send you what we have.
For people in Japan, this is a cross-border provision under Article 28 of the Act on the Protection of Personal Information. The consent you give on the form covers this transfer, and we will tell you on request what measures each provider has in place and what the data protection regime of the receiving country is.
6. If you connect your Discord account
Submitting the form takes you straight to Discord, where you approve the connection that lets us put you into the server. If you do, Discord tells us your user ID, username, when the account was created, and whether Discord has flagged it; and it gives us a token whose only permission is to add that one account to that one server. The token can do nothing else — it cannot read your messages, your other servers, or your email. Skipping that screen costs you nothing: you are already a member, and the email we send has an invite link in it.
We keep the account's creation date and the outcome of that check so the organizers can see why an automatic add did or didn't happen. It is never shown to other members, and a new account is never a reason to turn anybody away.
We delete that token within seconds, as soon as the add has gone through. If the add does not go through, we keep it so an organizer can try again, and it is deleted automatically within a day whether they do or not. You can also revoke it yourself at any time in Discord's settings. Once you are in the server, what happens there is governed by Discord's own terms and privacy policy, not this one.
7. How long we keep it
These are not aspirations. A job runs every night and deletes what is past its date, whether or not anyone remembers to.
- While you are a member — for as long as you are one. When you leave, tell us and we delete it; otherwise we clear it out when we notice.
- The hashed IP address — cleared automatically after twelve months.
- A Discord permission we could not use — deleted automatically within a day, as section 6 describes.
- The record that a form was submitted from a connection, kept only to make the rate limit work — deleted automatically after twelve months.
- Our internal record of what happened to a membership — twenty-four months.
- If the approval step is in use and we did not admit you — twelve months from the decision, then deleted automatically.
- If the approval step is in use and nobody ever decided — twelve months from your sign-up, then deleted automatically.
- At any time — ask, and we delete it, normally within thirty days.
We may keep correspondence where we genuinely need it to bring or defend a legal claim, for as long as that claim could be brought, and no longer.
8. Your rights
Wherever you live, you can email us and ask to:
- see a copy of what we hold about you, and know where it came from and who we shared it with;
- correct anything that is wrong;
- have it deleted;
- restrict or object to what we do with it;
- receive it in a portable format;
- withdraw a consent you gave.
We will not ask why, and we will not charge you. We answer within one month — within 45 days where United States state law sets that period — and will tell you if a request is genuinely complex and needs longer. We may need to check you are who you say you are before acting, which normally means replying from the address on your record.
If you are in the EEA or the UK, these are your rights under Articles 15 to 22 of the GDPR and the UK GDPR, and you can complain to your national supervisory authority (or, in the UK, the Information Commissioner's Office) if you are unhappy with how we handled a request.
If you are in Japan, these correspond to your rights of disclosure, correction and suspension of use under the Act on the Protection of Personal Information, and you may contact the Personal Information Protection Commission.
If you are in California, you have the rights to know, delete, correct, and to opt out of sale or sharing, under the CCPA as amended by the CPRA. In the twelve months before this notice was published we collected the categories of personal information listed in section 2 — identifiers, professional or employment information, and, where you volunteered it, the protected characteristic of gender — for the purposes in section 3, from you directly, and disclosed them for business purposes only to the service providers listed in section 4. We do not sell or share personal information, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. We do not use or disclose sensitive personal information for any purpose beyond those permitted without a right to limit, and we do not use personal information to infer characteristics. You will not be discriminated against for exercising any of these rights, and we offer no financial incentive for your data. You may use an authorised agent; we will ask for proof of their authority.
If you are in another United States state with a comprehensive privacy law — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana — you have equivalent rights of access, correction, deletion, portability and opt-out, and the right to appeal a decision we make on a request. To appeal, reply to our answer and say so; we will respond in writing within the period your state's law allows. We do not process personal data for targeted advertising, sale, or profiling that produces legal or similarly significant effects.
9. Cookies
This site sets two cookies, both strictly necessary and neither used to follow you anywhere:
- A short-lived cookie set when you are sent to Discord. It holds a random value for ten minutes so that we can tell your return trip from Discord apart from a forged one, and it is deleted as soon as you come back.
- A signed session cookie set only for organizers signing in to the admin page, which expires after eight hours.
There are no analytics, advertising or preference cookies, which is why you are not being asked to accept anything. We do not respond to Do Not Track signals because we do not track you in the first place.
10. Security
Member records are held in a database that is not reachable from the public internet. The admin page is protected by a password, sessions are signed and expire after eight hours, and repeated wrong passwords lock the page. Traffic to and from this site is encrypted in transit and the site is served over HTTPS only. IP addresses are stored as salted one-way hashes rather than as addresses. Discord tokens are deleted as soon as they have been used.
No system is perfect, and we do not claim otherwise. If a breach affects your data and is likely to put you at risk, we will tell you and the relevant authority as the law requires — within 72 hours of becoming aware, where the GDPR applies.
11. Children
This community is for people working in or around the lunar economy, and the form is not directed at children. We do not knowingly collect personal information from anyone under 13, as those terms are used in the United States Children's Online Privacy Protection Act, and the form requires you to be 16 or over. Discord's own terms set a minimum age of 13, higher in some countries. If you are under 18, please speak to a parent or guardian before joining. If we learn we hold data about a child who should not have given it to us, we delete it promptly.
12. Changes to this notice
If we change how we use your data in a way that affects you, we will email members before the change takes effect, and update the date below. Minor wording changes we will simply make.
13. Getting in touch
Email hello@lunarstartups.space for anything on this page — a copy of your data, a correction, a deletion, an appeal, or a question. A person reads it.