Legal
Privacy Policy
Version 1.0 · Last revised 24 October 2026
Sublunar is built on one idea: your life stays home. This policy explains what this website collects, which is very little, why we collect it, how long we keep it, and the rights you have. It is written in plain English on purpose.
The short version
- We collect your email if you join the waitlist, and what you send us if you use the contact form or apply as a sponsor.
- We use no cookies, no analytics, no advertising and no tracking. Fonts are served from this site.
- Nothing is sold or shared for marketing. Our only processors are our host (Cloudflare), our payment provider (Stripe, sponsors only) and our email provider (Resend).
- The Sublunar app runs on your own computer. Your chats, files and memory stay on your device.
- You can ask us to delete or export your data at any time by emailing dominic.s@buildablelabs.dev.
1. Who we are
This website (sublunar.ai, and sublunar.ai once it is live) is operated by Sublunar, a project of Buildable Labs, Romania (together "Sublunar", "we", "us"). Sublunar is the controller of the personal data described in this policy for the purposes of the EU General Data Protection Regulation (GDPR) and Romanian Law no. 190/2018. The company Sublunar Intelligence SRL is being registered in Romania; this policy will be updated with its registered details when that completes.
Contact for anything in this policy: dominic.s@buildablelabs.dev. We have not appointed a data protection officer because of our size; the email above reaches the person responsible.
2. What we collect, and why
| When you… | We collect | Why | Legal basis | Kept for |
|---|---|---|---|---|
| Join the beta waitlist | Your email address, the time you joined, and the country your request came from (worked out by our host from your connection; we do not store your IP address) | To invite you to the beta and tell you about Sublunar | Your consent (Art. 6(1)(a)). You can withdraw it at any time. | Until the beta invitations are complete and for 12 months after, or until you ask us to delete it, whichever is first |
| Use the contact form | Your name, email, the topic you picked, your message, the time, and the country of your request | To read and answer your message | Our legitimate interest in replying to people who write to us (Art. 6(1)(f)), or steps before a contract if you ask about a deal | 12 months after the conversation ends |
| Apply as a founding sponsor | Brand name, website, contact name and email, logo, a short description, and, if approved, payment records from Stripe (status, amounts, dates; never your card number) | To review the application, run the sponsor programme and bill it | Contract (Art. 6(1)(b)); accounting law for the payment records (Art. 6(1)(c)) | For the sponsorship and the period Romanian accounting law requires afterwards (currently 10 years for financial records) |
| Visit any page | Our host, Cloudflare, briefly processes your IP address and browser type to deliver the page and block attacks. We do not see or keep this beyond Cloudflare's short-lived security logs. | Security and keeping the site up | Our legitimate interest in running a secure site (Art. 6(1)(f)) | Cloudflare's standard log retention (days, not months) |
We do not collect anything else. We never ask for, and ask you not to send, sensitive data (health, political opinions, religion, and so on). We make no automated decisions about you and we do not profile you.
3. No cookies, no tracking
This site sets no cookies and loads no analytics, advertising, social-media or tracking scripts. Fonts are served from this site, so no third party sees you load a page. Because we use no non-essential cookies, there is no cookie banner. The only cookie-like storage is on the sponsor admin and contact inbox pages, which are internal tools that store an access key in your browser session only when you sign in to them.
4. Who we share data with
We do not sell personal data and we do not share it for anyone else's marketing. The following companies process data on our behalf, under contracts that bind them to protect it:
- Cloudflare, Inc. hosts this site and stores the waitlist, contact messages and sponsor applications (Workers and KV). Cloudflare is certified under the EU–US Data Privacy Framework and offers EU data localisation.
- Stripe Payments Europe, Ltd. processes sponsor payments. Stripe collects card details directly; we only see the payment status.
- Resend, Inc. sends our transactional emails (waitlist confirmation, contact notifications) once that feature is switched on.
We may also disclose data if the law requires it, to protect our rights or the safety of others, or, if Sublunar is ever acquired or merged, to the new owner under this same policy.
5. International transfers
We are based in Romania. Some of the providers above run infrastructure in the United States. Where data leaves the European Economic Area we rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework and, where that does not apply, on the Commission's Standard Contractual Clauses, together with technical measures such as encryption in transit and at rest.
6. How long we keep data
The table in section 2 gives the period for each kind of data. When a period ends, or when you ask, we delete the data or make it anonymous. Where something must be kept by law (accounting records), we keep only that and isolate it from any other use.
7. Security
Everything is served over HTTPS with modern security headers. Data at rest is encrypted by our host. Internal tools are protected by keys that are never in the page source. Public forms are rate-limited. No system is perfectly secure, and if we ever learn of a breach that affects you we will tell you and the authority without undue delay, as the GDPR requires.
8. Your rights
Under the GDPR you can ask us to:
- Access the personal data we hold about you and get a copy;
- Correct anything inaccurate;
- Delete your data ("right to be forgotten");
- Restrict how we use it while a question is settled;
- Transfer it to you or another provider in a machine-readable form;
- Object to processing based on our legitimate interests, including any direct marketing (we do none today);
- Withdraw consent at any time where consent is the basis, for example by replying "remove" to any waitlist email.
Email dominic.s@buildablelabs.dev. We may ask you to confirm you own the email address concerned. We answer within one month. There is no charge.
If you are not satisfied, you can complain to your local data protection authority. Ours is the Romanian authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), B-dul G-ral. Gheorghe Magheru 28–30, Bucharest, dataprotection.ro. Users in other EU countries can find their authority through the European Data Protection Board. UK users: the Information Commissioner's Office, ico.org.uk.
9. The Sublunar app
The app is in private beta. It runs AI models on your own computer. Your chats, files and memory stay on your device, encrypted on your disk. If you allow a web search, only the search question leaves your computer, after names and numbers are removed, and only when you tap Allow. The app will ship with its own short privacy notice describing exactly this; nothing in the app sends data to us.
10. Children
This website and the beta are for people aged 16 or over (the age of digital consent in Romania). If you are a parent and believe a child under 16 gave us data, email us and we will delete it.
11. Other sites
We link to Discord, Buildable Labs, Emergent Ventures and others. Their privacy practices are their own; this policy covers only this site.
12. Changes
We will update this page when our practices change and note the date at the top. If a change matters to you (for example a new purpose for your email), we will tell waitlist members by email before it takes effect.
13. Contact
Sublunar · Buildable Labs, Romania · dominic.s@buildablelabs.dev