Privacy Policy.

„ЛЕВЕЛ 8" ЕООД collects personal information when you place an order, subscribe to our newsletter or contact us. This information may include:

• First and last name
• Email address
• Phone number
• Shipping address

We use your information to:

• Process and ship your orders
• Communicate about your orders
• Send marketing messages (only with your consent)
• Improve our products and services
• Personalize recommendations in LURA Navigator

On your first successful order we automatically generate your personal referral code (e.g. "MARIA") you can share with friends. We use this code for:

• Applying a 5% discount for a customer who orders with your code
• Crediting your account on a successful referral
• A 30-day session cookie that records visits via your shared link

What the referrer sees: You only see how many times your code was used — never other customers' names, email addresses or orders.

Fraud prevention: We store the phone number only as a salted SHA-256 hash to prevent self-referrals from a secondary account. Plain phone numbers are not matched across accounts.

You can deactivate your referral code at any time — email us at support@luralab.eu.

To run the service we use trusted providers that process data on our behalf. Each of them processes data only for the stated purpose and under a data processing agreement:

• Supabase — database hosting (EU/US)
• Stripe — payment processing (US/EU)
• Resend — email delivery (US)
• Vercel — hosting and content delivery (US/global edge)
• Clerk — account authentication (US)
• Google (GA4) — traffic analytics, only with consent (US)
• Meta Platforms (Pixel) — ads/remarketing, only with consent (US)
• euShipments and the couriers Speedy, ExpressOne and SAMEDAY — delivery (Bulgaria/EU)

We do not sell your personal data and do not share it with third parties beyond those listed, unless required by law.

We keep personal data only as long as needed for the purpose it was collected for (Article 6 of the GDPR):

• Orders, invoices and accounting documents — up to 10 years (accounting and tax law; legal basis: legal obligation, Art. 6(1)(c)).
• Account data — while the account is active (performance of a contract, Art. 6(1)(b)).
• Newsletter email — until you unsubscribe (consent, Art. 6(1)(a)).
• Health data in LURA Navigator — locally on your device; if synced — until the account is deleted (explicit consent, Art. 9(2)(a)).
• Analytics and advertising data — only with consent; until it is withdrawn (for GA4 — up to 14 months).
• Security and fraud-prevention data — legitimate interest (Art. 6(1)(f)).