PRIVACY NOTICE
What we do with what you tell us
The short version. Two people read your application. We keep it so we can run the community. We don't sell it, publish it, or hand it to anyone who isn't helping us operate the site. You can ask us to delete it and we will. Everything below is the same thing said precisely, because it has to be.
1. Who is responsible for your data
Lunar Startup Community is operated by Melange Space Technologies ("Melange", "we", "us"), a company registered in Japan. Melange is the data controller for the personal data described here — meaning we decide what is collected and why, and we are the ones you can hold to this notice.
Contact: hello@lunarstartups.space. Our postal address is available on request from that address.
The community is hosted and administered by Melange's founders, Yuki Hatakeyama and Russell Boyer. They are the only people who see applications.
2. What we collect, and only when you give it
There is no analytics, no advertising, no tracking pixel and no third-party script anywhere on this site — nothing on these pages reports back to anyone. We collect nothing ourselves until you submit the join form.
One thing happens without us asking, and you should know about it: like every website, ours runs on a server, and our hosting provider keeps short-lived technical logs of requests, which include IP addresses. We do not use those logs to build any picture of you, and we cannot search them by person. They exist so the site can be kept running and defended against attack, which is our legitimate interest in doing so, and the provider discards them on its own schedule.
When you submit the form, we receive:
- Name and email address — required.
- Age — required.
- Gender — optional, blank by default, and free text if you choose to describe it yourself.
- Country or city, and the time zone your browser reports — optional and automatic respectively.
- Company or organisation, your role, and any link you give us — required except the link.
- The Moon Tech areas you selected, and why you want to join — required.
- A Discord username, or a connected Discord account — optional. See section 6.
- Whether you asked for meetup emails, and the fact and time of your consent.
Alongside those answers the form records the time of submission and a one-way hash of your IP address, scrambled with a secret key so it cannot be turned back into an address. It exists only to stop one machine from submitting the form fifty times. We do not keep the address itself, your browser's user-agent, or the page you arrived from.
If we approve you, we also keep the private note an organizer wrote when deciding, and the date you were added to Discord.
All of this comes directly from you. We do not buy data, enrich it from other sources, or look you up anywhere.
You are under no legal obligation to give us any of it. There is no statute and no contract requiring it. But the required fields are required for a practical reason: without a name, an email, where you work and why you want to join, there is nothing for us to decide on, and we will not be able to consider your application. The optional fields — gender, your location, a link, a Discord username — you can leave blank with no effect on the outcome whatsoever.
3. Why we hold it, and on what legal basis
| What we do with it | Which data | Legal basis |
|---|---|---|
| Read your application and decide on it; contact you about the outcome | Everything in section 2 except gender and the IP hash | Your consent, and our legitimate interest in running a members' community (GDPR Art. 6(1)(a) and 6(1)(f)) |
| Understand who is in the room, in aggregate, and choose a meetup time that suits the membership | Age, gender, country, time zone, areas | Your consent (GDPR Art. 6(1)(a); Art. 9(2)(a) for gender, treated as explicit consent) |
| Add you to the Discord server on approval | Discord username or connected account | Your consent (GDPR Art. 6(1)(a)) |
| Send you meetup announcements | Name, email | Your consent, given by ticking that box (GDPR Art. 6(1)(a)) |
| Stop automated and abusive submissions | Hashed IP address, submission time | Our legitimate interest in keeping the form usable (GDPR Art. 6(1)(f)) |
Gender is treated with extra care. It is optional, it is blank unless you choose otherwise, we use it only in aggregate counts, and it is never shown to other members. If you would rather we did not have it, leave it blank — nothing about your application changes.
You can withdraw your consent at any time by emailing us. Withdrawing it does not make what we did beforehand unlawful, and it may mean we can no longer keep you in the community.
We do not make any decision about you by automated means alone. A person reads every application.
4. Who else sees it
The two organizers, through a password-protected admin page. Beyond them, your data passes through the companies we use to run the site. They act on our instructions and are not permitted to use your data for their own purposes.
| Who | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting the site and running the form | United States |
| Our database provider (currently Neon Inc.) | Storing applications | United States / European Union |
| Resend (Plus Five Five, Inc.) | Sending the emails we send you | United States |
| Google LLC | A private spreadsheet the organizers use to read applications, where they have one set up | United States |
| Discord Inc. | Adding you to the server, if you asked us to | United States |
That is the whole list. We do not sell personal data, we do not share it for advertising, and we have never done either. If we ever need to add a provider, we will update this notice before it starts processing anything.
We may also disclose data where we are legally required to — a court order, or a lawful request from an authority — or where it is necessary to establish or defend a legal claim. If Melange is ever acquired or merged, applications may transfer with the business, and we would tell members first.
5. Sending data outside your country
Our providers are mostly in the United States, so your data is transferred there. For people in the European Economic Area or the United Kingdom, those transfers rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) in our agreements with each provider, or on an adequacy decision where one applies. You can email us for a copy of those safeguards and we will send you what we have.
For people in Japan, this is a cross-border provision under Article 28 of the Act on the Protection of Personal Information. The information you tick the consent box for includes this transfer, and we will tell you on request what measures each provider has in place.
6. If you connect your Discord account
On the confirmation page you can connect Discord so that we can add you to the server the moment we approve you. If you do, Discord tells us your user ID and username, and gives us a token whose only permission is to add that one account to that one server. It can do nothing else — it cannot read your messages, your other servers, or your email.
We delete that token as soon as your application is decided, whichever way it goes. You can also revoke it yourself at any time in Discord's settings. Once you are in the server, what happens there is governed by Discord's own terms and privacy policy, not this one.
7. How long we keep it
These are not aspirations. A job runs every night and deletes what is past its date, whether or not anyone remembers to.
- If you are a member — for as long as you are one. When you leave, tell us and we delete it; otherwise we clear it out when we notice.
- If we did not approve you — twelve months from the decision, then deleted automatically.
- If nobody ever decided — twelve months from your application, then deleted automatically.
- The hashed IP address — cleared automatically after twelve months.
- Our internal record of what happened to an application — twenty-four months.
- At any time — ask, and we delete it, normally within thirty days.
We may keep correspondence where we genuinely need it to bring or defend a legal claim, for as long as that claim could be brought, and no longer.
8. Your rights
Wherever you live, you can email us and ask to:
- see a copy of what we hold about you;
- correct anything that is wrong;
- have it deleted;
- restrict or object to what we do with it;
- receive it in a portable format;
- withdraw a consent you gave.
We will not ask why, and we will not charge you. We answer within one month, and will tell you if a request is genuinely complex and needs longer. We may need to check you are who you say you are before acting.
If you are in the EEA or the UK, these are your rights under Articles 15 to 22 of the GDPR and the UK GDPR, and you can complain to your national supervisory authority (or, in the UK, the Information Commissioner's Office) if you are unhappy with how we handled a request.
If you are in Japan, these correspond to your rights of disclosure, correction and suspension of use under the Act on the Protection of Personal Information, and you may contact the Personal Information Protection Commission.
If you are in California, you may request disclosure and deletion, and you may not be discriminated against for doing so. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not process sensitive personal information for the purpose of inferring characteristics.
9. Cookies
This site sets two cookies, both strictly necessary and neither used to follow you anywhere:
- A short-lived cookie set only if you press Connect my Discord. It holds a random value for ten minutes so that we can tell your return trip from Discord apart from a forged one. It is deleted as soon as you come back.
- A signed session cookie set only for organizers signing in to the admin page, which expires after eight hours.
There are no analytics, advertising or preference cookies, which is why you are not being asked to accept anything.
10. Security
Applications are held in a database that is not reachable from the public internet. The admin page is protected by a password, sessions are signed and expire, and repeated wrong passwords lock the page. Traffic to and from this site is encrypted. Discord tokens are deleted once used.
No system is perfect, and we do not claim otherwise. If a breach affects your data and is likely to put you at risk, we will tell you and the relevant authority as the law requires.
11. Children
This community is for people working in or around the lunar economy, and the form is not directed at children. Discord's own terms set a minimum age of 13, higher in some countries. If you are under 18, please speak to a parent or guardian before applying. If we learn we hold data about a child who should not have given it to us, we delete it.
12. Changes to this notice
If we change how we use your data in a way that affects you, we will email members before the change takes effect, and update the date below. Minor wording changes we will simply make.
13. Getting in touch
Email hello@lunarstartups.space for anything on this page — a copy of your data, a correction, a deletion, or a question. A person reads it.