We keep your question, not your chart.

Who runs this site

Lunivexa, trading at lunivexa.us, is the controller of the data described here. Postal address: 73 Workshop Way, Büro 5, Austin, Texas 51576, Austin, Texas, United States. Email [email protected], phone +1 (530) 555-0805. The desk writes reference cards on adult sleep medicines. It does not prescribe, dispense or sell anything, so there is no account, no password, no payment and no card data anywhere on this site.

What reaches us

Four sources. Nothing else on the site records you.

• The inquiry form. It writes your name, phone, email, address (city and state is plenty), the kind of enquiry, your message, the medicine and dose you typed in the specification line, and the consent tick. With it, automatically: your IP address, your browser's user-agent string, the referring URL, the moment the form was rendered and the moment it was sent.
• The support chat. The conversation itself, plus a name, phone or email only if you give one. A token sits in your browser so you can come back to the same thread.
• Technical and log data. Our host's server logs record IP address, time, requested page and user-agent for every request.
• Cookie and click identifiers. Your consent choice is stored in the browser under site_consent_v2. If you arrive from a paid ad, the link carries a click identifier: gclid, msclkid or fbclid. Part 02 covers those.

We never ask for a diagnosis, date of birth, insurance number or a photo of a prescription label. If you send one anyway, we delete that part and answer the rest.

What each piece is for

• Form and chat content: to read your question, send the card and the prescriber question sheet, and follow up if a card you received is corrected.
• IP, user-agent, timestamps and the hidden honeypot fields: to stop spam and automated submissions.
• Server logs: to keep the site running and trace faults or abuse.
• Consent record: to remember what you chose so the banner does not ask again on every page.
• Click identifiers and ad cookies, only after you allow them: to count which paid campaigns lead to an enquiry, so money stops going to ads that bring nobody.

Legal basis for each use

Where paid visitors come from

We buy ads. Google Ads, Microsoft Advertising and Meta Ads send traffic to this site today. When you click one of those ads, the platform adds an identifier to the link:

• Google Ads adds gclid.
• Microsoft Advertising adds msclkid.
• Meta Ads adds fbclid, where a campaign runs there.

That identifier tells the platform which click led to which visit. We use it to see whether an ad produced an enquiry. It is not linked to the text of your question and it is never sent with the name of a medicine you asked about.

Consent Mode v2

Every page loads with Google Consent Mode v2 defaults set before anything else runs. Four signals start at denied: ad_storage, ad_user_data, ad_personalization and analytics_storage. They stay denied until you press Allow in the cookie banner. Press Decline, or withdraw later through "Cookie settings" in the footer, and all four go straight back to denied. While they are denied, no advertising or analytics cookie is written and the platforms receive only cookieless, aggregate pings.

The same rule applies to the Microsoft and Meta tags. No choice, no ad storage.

Who receives data

• Google Ireland Ltd / Google LLC, for Google Ads. Receives gclid and the consent signals.
• Microsoft Ireland Operations Ltd, for Microsoft Advertising. Receives msclkid. Its own handling is set out in the Microsoft privacy statement at privacy.microsoft.com/privacystatement.
• Meta Platforms Ireland Ltd, for Meta Ads. Receives fbclid where a campaign runs there.
• Our hosting provider, which serves this site, keeps the server logs and stores the enquiry database.
• Our mail provider, which carries the notification of a new enquiry to the desk inbox and carries our reply back to you.

We do not sell your data. We do not hand enquiry text to any ad platform.

Data leaving the country

The desk works from the United States, so a question sent from Europe travels here. The ad platforms named above also move data between the EU and the US. Those transfers rely on the EU-US Data Privacy Framework where the recipient is certified, and on the European Commission's standard contractual clauses otherwise. You can ask us which one covers a given recipient.

How long we keep each thing

Twenty-four months for enquiries is deliberate. If a card is corrected under our accuracy guarantee, we need to know who received the old version.

How it is protected

Every page and form is served over HTTPS. The enquiry database sits behind a password-protected operator panel that is not linked from the public site. Access is limited to the people who answer the desk. Spam is filtered with hidden honeypot fields and a render-time check, not with a third-party tracking captcha. We keep what we collect small on purpose: the less we hold, the less there is to lose.

If you write from Europe: GDPR

Under the GDPR you can ask for access to what we hold on you, rectification of anything wrong, erasure, restriction of how we use it, portability in a machine-readable file, and you can object to processing based on legitimate interest. Where we rely on consent, you can withdraw it at any time; withdrawing does not undo what was lawful before.

US state privacy rights

California residents have rights under the CCPA as amended by the CPRA: to know what we collect, to delete it, to correct it, to opt out of sale or sharing for cross-context behavioral advertising, and to limit use of sensitive data. Residents of other states with privacy laws in force, including Texas, Virginia, Colorado and Connecticut, have similar rights. We don't sell personal data. Sharing a click identifier with an ad platform can count as "sharing" under the CCPA, so Decline in the banner is your opt-out, and we will not treat you differently for using it.

Global Privacy Control

If your browser sends the Global Privacy Control signal (the Sec-GPC header), we treat it as an opt-out of sale and sharing. The four Consent Mode signals stay denied and we don't ask you again.

Not for anyone under 18

Every card on this site is written for adults. The site is not meant for children and we don't knowingly take data from anyone under 18. If a message comes from a minor, we delete it and reply only to say they should speak to their own prescriber or a parent.

Complaints

Tell us first if you can; most problems are fixed in one email. You can also complain to your state Attorney General, and in California to the California Privacy Protection Agency. Visitors in Europe may complain to the data protection authority of their country.

When this policy changes

A new version gets a new version number and date at the top of this page. If the change affects what we collect or who receives it, the cookie banner appears again so you can choose afresh, and anyone with an open enquiry is told by email.

A person to talk to

Email [email protected], call +1 (530) 555-0805, or write to Lunivexa, 73 Workshop Way, Büro 5, Austin, Texas 51576, United States. The same people who answer medicine questions answer privacy ones.