Privacy Policy.

„ЛЕВЕЛ 8" ЕООД collects personal information when you place an order, subscribe to our newsletter or contact us. This information may include:

• First and last name
• Email address
• Phone number
• Shipping address

If you use the LURA Navigator app (luralab.eu/app), we collect additional health-related data:

• Menstrual cycle data (length, phases)
• Self-assessed stress levels (1–10 scale)
• Sleep quality (1–10 scale)
• Symptoms (bloating, headache, fatigue, etc.)
• Optional: heart-rate measurements from a compatible Bluetooth monitor, with device name and time received. Display requires permission; saving requires a separate action and is local to the browser, without automatic server upload. Export and deletion are available in Devices and measurements. Clearing the browser removes these records. Automatic Apple Health, Health Connect, Garmin, Fitbit and Oura integrations are not active.
• Optional, only with separate explicit consent: ЛУРА AI (the coach and the weekly insight). To answer you it reads your entries (sleep, stress, symptoms, cycle) and your question and sends them, without your name or email, to an AI model through OpenRouter. You give the consent in the app and can withdraw it at any time in Profile → Data and privacy.

We use your information to:

• Process and ship your orders
• Communicate about your orders
• Send marketing messages (only with your consent)
• Improve our products and services
• Personalize recommendations in LURA Navigator

We apply appropriate technical and organizational measures to protect your personal data against unauthorized access, loss or destruction.

• Access to your personal data
• Correction of inaccurate data
• Deletion of your data
• Withdraw marketing consent

You also have the right to:

• Deletion of health data from LURA Navigator
• Data portability (Article 20 GDPR)

On your first successful order we automatically generate your personal referral code (e.g. "MARIA") you can share with friends. We use this code for:

• Applying a 5% discount for a customer who orders with your code
• Crediting your account on a successful referral
• A 30-day session cookie that records visits via your shared link

What the referrer sees: You only see how many times your code was used, never other customers' names, email addresses or orders.

Fraud prevention: We store the phone number only as a salted SHA-256 hash to prevent self-referrals from a secondary account. Plain phone numbers are not matched across accounts.

You can deactivate your referral code at any time: email us at support@luralab.eu.

Under Article 77 of the GDPR you have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP): Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., www.cpdp.bg.

To run the service we use trusted providers that process data on our behalf. Each of them processes data only for the stated purpose and under a data processing agreement:

Supabase

database hosting (EU/US)

Stripe

payment processing (US/EU)

Resend

email delivery (US)

Vercel

hosting and content delivery (US/global edge)

Clerk

account authentication (US)

Google (GA4)

traffic analytics, only with consent (US)

Meta Platforms (Pixel)

ads/remarketing, only with consent (US)

OpenRouter

passes your question and diary entries to the ЛУРА AI model, only with explicit consent (US)

Amazon Web Services (Amazon Bedrock) and Google Cloud (Vertex AI)

run Anthropic's Claude model for ЛУРА AI; we only use endpoints that neither retain the data nor train on it; only with explicit consent (EU/US)

euShipments and the couriers Speedy, ExpressOne and SAMEDAY

delivery (Bulgaria/EU)

We do not sell your personal data and do not share it with third parties beyond those listed, unless required by law.

Some processors are established outside the European Economic Area (in the US). Data transfers are protected by Standard Contractual Clauses (SCCs) under Article 46 of the GDPR and additional technical measures; where applicable, through the EU-U.S. Data Privacy Framework. This also applies to ЛУРА AI: your question and diary entries may be processed in the US by OpenRouter and the model providers, only after your explicit consent and without your name or email.

We keep personal data only as long as needed for the purpose it was collected for (Article 6 of the GDPR):

• Orders, invoices and accounting documents: up to 10 years (accounting and tax law; legal basis: legal obligation, Art. 6(1)(c)).
• Account data: while the account is active (performance of a contract, Art. 6(1)(b)).
• Newsletter email: until you unsubscribe (consent, Art. 6(1)(a)).
• Health data in LURA Navigator: locally on your device; if synced, until the account is deleted (explicit consent, Art. 9(2)(a)).
• ЛУРА AI: your question and diary entries are sent to the model only at the moment of the answer. We keep when you wrote (for the limit of 5 questions a day) and when you gave or withdrew consent. Legal basis: explicit consent, Art. 9(2)(a).
• Post-delivery survey: the answer to "Why did you try it?" is kept only with separate explicit consent (Art. 9(2)(a)), until you withdraw it by writing to support@luralab.eu. The free text may be used without your name or email when we write about LURA.
• Analytics and advertising data: only with consent; until it is withdrawn (for GA4: up to 14 months).
• Security and fraud-prevention data: legitimate interest (Art. 6(1)(f)).

For questions about this policy, please contact us: