SecureLunaSecureLuna

Privacy Policy

Effective date: 2026-09-29

1. Information We Collect

We collect only the information necessary to operate the service:

  • Account information: email, name, phone, company name (you provide these at signup).
  • Asset metadata: server label, host/IP, SSH user, port, environment tag — what you enter when registering an asset. For agent servers: hostname, agent version and last report time.
  • Configuration check results: per-rule outcomes (met / not met / not checked), system metrics (CPU/RAM/disk/network usage) and basic server info (OS, kernel, CPU count, memory, disk, internal IP) collected from servers you registered — over SSH, or sent by the agent (daily check; resources recorded every 10 minutes and sent hourly).
  • Usage data: login timestamps, IP address at login, audit logs of actions taken in the dashboard (for security & debugging).
  • Payment information: handled by Polar (Merchant of Record). We do not store or process card numbers — Polar provides us only with subscription status and metadata.

2. Server Access & How It Is Used

  • Agent: we hold no credential to your server. The agent authenticates to SecureLuna with a per-server token, stored by us only as a SHA-256 hash plus an AES-256-GCM encrypted copy (so the install command can be shown again). It only sends results; it never receives commands to run.

SSH:

  • You install a public SSH key generated by SecureLuna onto your own server (or register an SSH password). We store the private key or password encrypted with AES-256-GCMusing an encryption key held only on our application server; it is decrypted in memory only at connection time and never shown again.
  • The key is used only to connect to servers you have explicitly registered and only to run read-only commands defined by published checklists.
  • We never use the key to access systems you have not registered, modify your system, execute exploit code, or transfer files off your server.
  • You may revoke access at any time by removing the public key from your server.

3. How We Store Data

  • Data is stored in PostgreSQL on infrastructure we operate.
  • Configuration check results are retained for 30 days by default.
  • Audit logs are retained for 1 year for security investigation purposes.
  • SSH credentials (keys and passwords) are encrypted at rest with AES-256-GCM.
  • Backups (if you opt-in to the Backup add-on) are uploaded to a cloud storage provider you connect via OAuth tokens you provide. We do not store backup contents on our servers.

4. How We Share Data

We do not sell or rent your data. We share data only with the following service providers strictly to operate SecureLuna:

  • Polar — payment processing (subscription metadata, your billing email).
  • Cloud storage provider — only if you enable the Backup add-on, with the OAuth scope you grant on the provider you choose.
  • Email delivery provider — to send daily reports to your inbox.
  • OpenAI (AI analysis provider) — only when AI Security Analysis is on (default on, can be turned off in Settings). We send anonymized server state for analysis: IP addresses, account names and hostnames are replaced with irreversible pseudonyms, and passwords, tokens and keys are removed beforehand. OpenAI does not use API data for training and deletes it after at most 30 days of abuse monitoring.
  • Legal compliance — we may disclose data if required by law or valid legal process (court order, subpoena).

5. Your Rights

  • You may request access to, correction of, or deletion of your personal data.
  • You may export your data (assets, results, reports) from the dashboard.
  • You may delete your account at any time. Deletion is permanent within 30 days.
  • For requests, contact wndudgns2001@gmail.com.

6. Cookies

We use a small number of cookies strictly for service operation (authentication session, language preference). We do not use third-party advertising or behavioral tracking cookies.

7. International Transfers

SecureLuna is operated from the Republic of Korea. By using the service from outside Korea, you consent to the transfer of your information to Korea for processing. We apply the same protection regardless of where the data originates.

8. Compliance

  • Korea: Personal Information Protection Act (PIPA) Article 29 — technical & managerial safeguards.
  • EU: GDPR-aligned data minimization & user rights (we will respond to data requests within 30 days).

9. Changes to This Policy

Material changes will be communicated via email at least 14 days before taking effect.

10. Contact

Data Protection contact: wndudgns2001@gmail.com.

한국어 요약

본 정책은 영문 원본을 기준으로 하며, 아래 한국어 요약은 편의상 제공되는 참고 번역입니다.

  • 회원가입 시 이메일·이름·연락처·회사명 수집. 자산 등록 시 호스트/SSH 사용자/포트 등 메타데이터.
  • 점검 결과, 시스템 메트릭(CPU/RAM/디스크/네트워크) 및 서버 정보(OS·커널·CPU 수·메모리·디스크·내부 IP) 수집 — SSH 접속 또는 에이전트 전송(매일 점검, 리소스는 10분마다 기록해 1시간마다 전송). 30일 보존.
  • 에이전트 방식은 서버 접속 정보를 보관하지 않습니다. 서버별 토큰은 SHA-256 해시와 AES-256-GCM 암호문으로만 저장하며, 에이전트는 결과를 보내기만 하고 명령을 받지 않습니다.
  • SSH 개인키·비밀번호는 AES-256-GCM 으로 암호화 저장하고, 접속할 때만 메모리에서 복호화합니다. 읽기 전용 명령만 실행.
  • 등록하지 않은 시스템엔 접근하지 않으며, 고객 서버를 변경하지 않습니다.
  • 결제는 Polar (Merchant of Record) 가 처리. 카드 정보는 SecureLuna 가 저장하지 않습니다.
  • AI 보안 분석(기본 켜짐, 설정에서 끄기 가능) 시 익명화한 서버 상태만 OpenAI 에 분석용으로 전달합니다. IP·계정명·호스트명은 되돌릴 수 없는 가명으로 바꾸고 비밀번호·토큰·키는 지운 뒤 보내며, OpenAI 는 API 데이터를 학습에 쓰지 않고 남용 감시 목적으로 최대 30일 보관 후 삭제합니다.
  • 백업 부가서비스 사용 시 데이터는 고객이 연결한 외부 클라우드 저장소에 직접 업로드.
  • 개인정보보호법 제29조 안전성 확보 조치 준수, GDPR 사용자 권리 준용.
  • 문의: wndudgns2001@gmail.com