Legal & Compliance
Privacy Policy
Moontians processes your personal data in accordance with EU General Data Protection Regulation (GDPR) and applicable national laws. This policy outlines our practices and your rights.
Who is responsible
The registered company details for this controller have not yet been published on this page. Until they are, contact us at the address below for any data protection matter. Data protection enquiries: info@moontians.com.
What we collect
Account and profile data; order, delivery and payment details (card numbers are handled by Stripe and never reach our servers); support correspondence; and technical data such as IP address, device and pages viewed. Analytics and advertising data are collected only if you accept them in the cookie banner.
Why we are allowed to
Contract performance for orders, delivery and returns. Consent for newsletters, analytics and advertising cookies — withdrawable at any time on the Cookie Policy page. Legitimate interest for fraud prevention and site security. Legal obligation for invoicing and tax records.
Who else sees your data
We share data with the processors listed below, each only for the purpose stated: Stripe (payment processing); Sendcloud (shipping labels and delivery tracking); DHL (carriage and delivery); Amazon Web Services (image and file storage (s3)); Resend (transactional email); PostHog (product analytics (only with your consent)); Google Analytics (site analytics (only with your consent)); Meta (advertising measurement (only with your consent)); Intercom (customer support chat); Sentry (error monitoring); Vercel / Render (website and api hosting); MongoDB Atlas (database hosting). We do not sell personal data.
Your rights
You may access, correct, erase, restrict or port your data, object to processing, and withdraw consent at any time. Signed-in customers can export or delete their account data from the account area. Write to info@moontians.com and we will respond within one month. If you are unhappy with our response you can complain to your national supervisory authority — in Spain, the Agencia Española de Protección de Datos (aepd.es).
How long we keep it
Orders and invoices: 10 years, as required by tax law — on account deletion the identity is pseudonymised rather than removed. Usage analytics: 14 months. Abandoned carts: 90 days. Support correspondence: 2 years. Restock alerts: 180 days once fulfilled. Session records: minutes.
Who processes your data
Each of these acts on our instructions only, for the purpose shown. Transfers outside the EEA rely on the European Commission’s Standard Contractual Clauses.
| Processor | Purpose | Location & transfer basis |
|---|---|---|
| Stripe | Payment processing | US / IE — Standard Contractual Clauses |
| Sendcloud | Shipping labels and delivery tracking | EU (Netherlands) |
| DHL | Carriage and delivery | EU / global, as required to deliver |
| Amazon Web Services | Image and file storage (S3) | EU (eu-central-1) |
| Resend | Transactional email | US — Standard Contractual Clauses |
| PostHog | Product analytics (only with your consent) | EU (eu.posthog.com) |
| Google Analytics | Site analytics (only with your consent) | US — Standard Contractual Clauses |
| Meta | Advertising measurement (only with your consent) | US — Standard Contractual Clauses |
| Intercom | Customer support chat | US — Standard Contractual Clauses |
| Sentry | Error monitoring | US — Standard Contractual Clauses |
| Vercel / Render | Website and API hosting | US / EU — Standard Contractual Clauses |
| MongoDB Atlas | Database hosting | EU |
Built around EU data protection
Analytics and advertising load only after you accept them, card details never reach our servers, and you can export or delete your data from your account at any time.
Exercise Your Rights
Related: Cookie Policy • Contact Us
← Back to Home