Privacy notice

Who is responsible for your data

The data controller is Promptica di Lorenzo Talamucci, a sole proprietorship registered in Italy (VAT IT02656770977), operating the Lunovant Foundry brand. Contact: info@lunovant.com.

No Data Protection Officer has been appointed, because the law does not require one for this activity. Any question about your data goes to the address above.

This notice covers both sides of the same product: the application form on this website, and the Lunovant app that people use once they are in.

What we collect when you apply

Everything you type into the application form: name, email, city and country, optional links (LinkedIn, portfolio), your answers about work, skills, behaviour, ambition and the signal questions, your weekly availability, and your optional choice to be contacted about other opportunities.

We also record a device class (mobile, tablet or desktop), the language of your browser, the time of submission and, for abuse prevention only, a short-lived counter tied to your IP address. We do not use fingerprinting, advertising cookies or a consent banner.

While you fill in the form, an anonymous draft is stored under a random identifier kept in a cookie on your device (lf_draft, 30 days). The draft only contains what you typed and is deleted when you submit.

What we collect once you have an account

Your account: the email address you sign in with, the display name carried over from your application, an optional short bio you write yourself, and the sign-in history kept by our authentication provider. Passwords are never visible to us: they are stored hashed by the provider.

Your work in the app: the missions you take, the date you took them, the proof you deliver (the text you write, any link you paste and any image you upload), the outcome of each review and the note written by the person who reviewed it.

Your standing: the level you hold in each venture, the history of every level change with the reason written by the person who made it, and a record of each email we send you (type of message, subject, date, whether it went out).

Other people in the same venture as you can see your display name, your bio and your level. They never see your email address, your deliveries or your application.

Why we process it and on what legal basis

To evaluate your application and take steps at your request before any agreement (Article 6(1)(b) GDPR). You do not need to give consent to apply: processing your answers is necessary to handle the application you chose to send. Fields marked as required are needed to assess the application; without them we cannot review it.

To run the app for you once you are in: your account, the missions you take, the proof you deliver and the levels you hold exist because you asked to take part, and the arrangement cannot work without them (Article 6(1)(b) GDPR).

To keep the service safe and prevent abuse (rate limiting, duplicate detection, private storage of uploaded files) and to understand how the application form performs, using aggregated analytics without cookies (Article 6(1)(f) GDPR, our legitimate interest in running a reliable service).

To contact you about other Lunovant opportunities beyond the application you sent, only if you tick the separate optional box (Article 6(1)(a) GDPR, consent). You can withdraw it at any time by writing to info@lunovant.com; withdrawing has no effect on your application.

How long we keep it

Applications and related notes are kept for 24 months from submission, then deleted. An application we did not take forward can be deleted earlier if you ask us: write to info@lunovant.com.

Drafts that are never submitted expire with the cookie (30 days) and are removed.

Account data, deliveries, levels and the record of emails we sent you are kept while your account exists. If you ask us to close it, we delete the account and everything attached to it, including the files you uploaded. Deletion is permanent and cannot be undone.

Encrypted backups of the database are kept for 30 days, so data you asked us to delete can survive in a backup for up to that long before it is overwritten.

Who can see it

The founder and the people who review applications and deliveries on behalf of Promptica. We use service providers that process data on our instructions: hosting and analytics (Vercel), database, authentication and private file storage (Supabase, hosted in the European Union, eu-west-1), transactional email (Resend), and encrypted database backups held as private build artifacts (GitHub). Backups are encrypted before they leave our infrastructure and the key is not held by the backup provider.

Some of these providers may process data outside the European Economic Area under the safeguards set out in Chapter V of the GDPR (adequacy decisions or standard contractual clauses).

We do not sell your data and we do not share it with third parties for their own marketing.

Cookies

Technical cookies only, and no consent banner because none of them are used for advertising or cross-site tracking: the draft identifier on the application form (lf_draft, 30 days) and, in the app, the session cookies that keep you signed in. Removing them signs you out and loses an unsent draft; nothing else.

Automated evaluation

AI tools may help us summarise or organise applications. No decision that affects you is taken solely by an automated system: every acceptance, hold or rejection, every review of a delivery and every level change is made by a person, and the reason is written down.

Your rights

You can ask for access to your data, correction, deletion, restriction of processing, portability of the data you provided, and you can object to processing based on legitimate interest. Write to info@lunovant.com; we answer within one month, as the law requires.

You also have the right to lodge a complaint with the Italian supervisory authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority of the country where you live.

Changes

If this notice changes in a way that matters to you, we will publish the new version on this page with a new date.