XEROSPH3RE runs a marketing site, the Lunara CRM web app, and provides custom build services (automation, websites, AI integrations). Most of your data lives on your own device, not our servers — that's a deliberate design choice. We collect the minimum we need to operate, never sell your data, and use industry-standard tools (Google, Stripe, Web3Forms) to do things we can't do alone. You can export or delete your data anytime. Questions: beardedai.net@gmail.com.
This Privacy Policy describes how XEROSPH3RE ("XEROSPH3RE," "we," "us," or "our") collects, uses, shares, and protects your information when you visit or use:
Together, these are the "Services." XEROSPH3RE is operated by Jesse Heiserman, based in Bethlehem, Pennsylvania, United States. You can reach us at any time at beardedai.net@gmail.com or (610) 735-6163.
This policy applies to information we receive about three distinct groups of people:
Where the policy says "you," we generally mean visitors and tenants. Where we mean tenant end-users and contacts, we'll say so explicitly.
This policy does not apply to data you collect on your own systems outside of our Services, or to third-party websites we link to. Each tenant is responsible for their own privacy practices regarding the contacts and clients they manage in Lunara.
Lunara is a local-first application. The bulk of your business data — clients, jobs, invoices, schedule, automation rules — is stored in your browser's localStorage on your device, not on our servers. We literally cannot see it. This is by design, and it materially reduces your privacy exposure compared to typical SaaS products.
| Category | Examples | Where it goes |
|---|---|---|
| Contact form submissions | Name, email, phone, business name, message | Sent via Web3Forms to our inbox; not stored on a server we control |
| Account credentials (when backend auth is enabled in a future release) | Email address, password (hashed), company name | Currently stored in your browser's localStorage; future releases will store hashes via Supabase |
| CRM data you enter | Client names, contact info, job details, invoices, notes, schedule events, crew records | Your browser's localStorage only. Never transmitted to our servers in the current architecture. |
| Payment information (when Stripe is enabled) | Card number, billing address | Sent directly to Stripe. We never see, store, or transmit raw card numbers. |
| Customer reviews | Name, rating, review text, optional company | Sent via Web3Forms to our inbox for manual approval before publication |
localStorage to make the apps work. This data does not leave your device unless you explicitly export it.Tenants of Lunara may enter contact information about clients, prospects, crew members, subcontractors, and other third parties into the application. This data lives in the tenant's local browser storage and is never sent to our servers. Tenants are responsible for having a lawful basis to collect, store, and process this information under applicable privacy laws.
We use the information we collect for the following purposes:
We do not sell your personal information, and we do not share it with third parties for their independent marketing purposes.
If you are in the European Economic Area, the United Kingdom, or another jurisdiction with similar laws, we rely on these legal bases:
We share information in these limited circumstances:
We do not sell or rent personal information to third parties for their independent use. We do not engage in "cross-context behavioral advertising" or share personal information with data brokers.
| Provider | Purpose | Data shared | Privacy policy |
|---|---|---|---|
| Amazon Web Services (AWS) | Static site hosting (S3), CDN (CloudFront) | Standard request logs (IP, UA, URL) | aws.amazon.com/privacy |
| Web3Forms | Contact form / review form delivery to our inbox | Form fields you submit | web3forms.com/privacy-policy |
| Google (Maps, Places, Calendar, Gmail) | Maps display, address autocomplete, business lead data, optional calendar/email integration | Search queries, address inputs; OAuth tokens for Calendar/Gmail if connected | policies.google.com/privacy |
| Stripe (when paid plans enabled) | Subscription billing and payment processing | Email, billing details, payment method (card details go directly to Stripe) | stripe.com/privacy |
| Supabase (when backend enabled) | Authentication, database, optional sync layer | Email, hashed password, account metadata | supabase.com/privacy |
| Google Fonts & CDNs (cdnjs, fonts.googleapis.com) | Web font & library delivery | IP and User-Agent (per CDN provider standards) | See respective providers |
If you connect a Google account to use Calendar or Gmail features in Lunara, our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
calendar.events (create/read calendar events you authorize), gmail.send (send emails on your behalf when you click "Send"), and userinfo.email (so we can label which Google account is connected).localStorage on your device only. It never reaches our servers.The Site uses minimal tracking. We do not use third-party advertising cookies, retargeting pixels, or session-replay tools.
localStorage because that's where they store all your data. Without localStorage, the apps cannot function.Because no analytics cookies, advertising cookies, or persistent identifiers are set by XEROSPH3RE itself, no cookie consent banner is required under most jurisdictions. If we add analytics in the future, we'll update this policy and add a clear consent mechanism.
You can clear localStorage at any time via your browser's settings (Privacy → Clear browsing data → Cookies and other site data). Note: doing this will erase all your Lunara data on this device. Use the in-app "Export All (JSON Backup)" first if you want to keep it.
| Data type | Retention |
|---|---|
| localStorage app data (clients, jobs, invoices, leads, etc.) | Stored on your device until you clear it. Not retained by us. |
| Contact form / review submissions | Retained in our email inbox indefinitely unless you ask us to delete |
| Account metadata (when backend enabled) | Retained for the life of your account, plus up to 30 days after account closure to allow recovery, then deleted |
| Payment / billing records | Retained as long as legally required (typically 7 years in the US for tax purposes), held by Stripe |
| AWS server logs | Up to 90 days, then automatically deleted |
You can request earlier deletion at any time — see Section 12.
We take reasonable administrative, technical, and physical safeguards to protect your information, including:
No system is 100% secure. We cannot guarantee absolute security of information transmitted to or stored by the Services. You're responsible for maintaining the security of your own device and account credentials.
Depending on where you live, you may have the following rights regarding your personal information:
To exercise any of these rights, email beardedai.net@gmail.com with the subject line "Privacy Request." We'll verify your identity and respond within 30 days (45 in some jurisdictions). We will not discriminate against you for exercising these rights.
If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act:
Categories of personal information collected in the last 12 months: Identifiers (name, email, phone, IP), commercial information (subscription status), internet activity (server logs), geolocation (general from IP), professional information (company name).
Categories of sources: directly from you, automatically when you use the Site, from third-party services you connect (Google).
Categories disclosed to service providers: as listed in Section 7.
Categories sold or shared: none.
To submit a CCPA request, email beardedai.net@gmail.com with the subject "CCPA Request." Authorized agents may submit requests on your behalf with verifiable proof of authorization.
For users in the European Economic Area, United Kingdom, and Switzerland, the legal bases listed in Section 5 apply. You also have the right to lodge a complaint with your supervisory authority. If you need an EU representative for GDPR purposes, contact us and we will make appropriate arrangements before serving EU customers at scale.
International data transfers: our service providers (AWS, Stripe, Google, Supabase) may process your data in the United States. These transfers are protected by Standard Contractual Clauses (SCCs) and equivalent safeguards.
The Services are not directed to, and we do not knowingly collect personal information from, children under 13 (or under 16 in the EU). If you believe a child has provided personal information to us, contact beardedai.net@gmail.com and we will promptly delete it.
XEROSPH3RE is based in the United States. By using the Services, you consent to your information being transferred to and processed in the United States, where data protection laws may differ from your home jurisdiction. For users in the EEA, UK, and Switzerland, transfers are made under appropriate legal mechanisms including Standard Contractual Clauses.
We do not currently respond to "Do Not Track" browser signals because there is no industry consensus on how to interpret them. We don't engage in cross-site tracking regardless. The Global Privacy Control (GPC) signal is treated as a valid request to opt out of sale/sharing of personal information under CCPA.
If we discover a security incident affecting your personal information, we will notify you and applicable regulators as required by law — typically without undue delay and within 72 hours of becoming aware of a breach (per GDPR), and as soon as practicable under US state laws. Notice will describe the nature of the breach, the data involved, what we're doing about it, and what you can do to protect yourself.
XEROSPH3RE uses automation and AI in the following ways:
You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. None of our current automations meet that bar — they're either advisory (scores) or executing tenant-defined rules (automation engine).
We may update this Privacy Policy from time to time. When we make material changes:
For minor clarifications, typo fixes, or restructuring (no substantive change), we may update without separate notice.
Questions, concerns, or requests about this policy or your data:
For privacy-specific requests (access, deletion, correction, etc.), please use the subject line "Privacy Request" so we route it correctly. We'll acknowledge receipt within 5 business days and respond substantively within 30 days (or 45 days if we need an extension under applicable law).