Effective date: 21 October 2026
This Privacy Policy explains how personal data is processed when you visit moonrabbit.bio, its language versions and lab.moonrabbit.bio (together, the “Site”). The controller is the operator of the Moon Rabbit brand and of the Site (“Moon Rabbit”, “we”, “us”). We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable national law. We have not appointed a data protection officer, as we are not required to.
For any question about this policy or to exercise your rights, write to us through the contact form on the Site (“Contact Us”). You do not need an account. Please mention that your message concerns personal data, so that we can handle it as a privacy request.
2.1 Visiting the Site (server logs). When you open a page, our web server automatically records technical data: IP address, date and time, requested address (including any campaign parameters in the link), status, referring page and browser/user-agent. If an error occurs, we also log the IP address, the requested address and the error message (error log). Purpose: operating the Site, security and troubleshooting. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
2.2 Visit statistics (Umami). We measure how the Site is used with Umami, a privacy-friendly analytics tool that we host ourselves; data is not shared with any analytics company. Umami does not use cookies and does not store your IP address. It records pages viewed, referring page, browser, operating system, device type, screen size, language and an approximate location (country/region/city) derived from the IP address at the moment of the visit, plus a few pseudonymous events (for example, that a form was opened or sent). Purpose: understanding which content is useful. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
2.3 Cookies. See section 4.
2.4 Contact form. If you write to us, we process the data you enter — name, email address, phone number and your message (all fields are required; without them the form cannot be sent) — together with the page you wrote from and the time of sending. The message is delivered to our team as a notification in a private Telegram chat (see section 5); it is not stored in the Site’s database. Purpose: answering you. Legal basis: steps at your request (Art. 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
2.5 Sample and waitlist requests (Pepper Oil). If you request a sample or join a waitlist, we process the data in the form: name, email address, country, the products you are interested in and your comment; for a sample also phone number and delivery address. We also record the language of the page, the referral or campaign parameters of the link that brought you (if any, see section 2.8), your IP address and browser type. The request is stored in our database, and a notification with its content, including your IP address, is sent to our private Telegram chat (see section 5). Fields marked as required must be filled in; without them we cannot process your request. Legal bases: sending the sample you asked for — steps at your request (Art. 6(1)(b) GDPR); informing you about the launch — your consent, which you give by ticking the box (Art. 6(1)(a) GDPR); IP address and browser type, to prevent misuse — our legitimate interest (Art. 6(1)(f) GDPR).
2.6 Account and reviews. If you create an account, we process your name and email address. Your password is stored only as a secure hash — we cannot read it. To set or reset your password, we email you a one-time link that expires after a short time. If you publish a review, your name, the review and, if provided, your profile picture are shown publicly on the Site after moderation. Purpose: providing the account and publishing reviews. Legal basis: performance of the service you requested (Art. 6(1)(b) GDPR). We do not currently send newsletters; your account settings may show a subscription preference, but no mailing list is operated and no data is transferred for this purpose.
2.7 Sign-in with a social network. Where the Site offers sign-in with a social network and you use it, the provider transmits to us your identifier, display name, email address and profile picture; this data therefore comes from the provider, not from you directly. The profile picture is copied to our server and may be shown publicly next to reviews you publish. The provider processes your data under its own privacy policy. Legal basis: performance of the service you requested (Art. 6(1)(b) GDPR).
2.8 Referral and campaign links. If you arrive through a referral link (?ref=) or a campaign link (utm_ parameters), we keep this information in your session during the visit so that a request or registration can be attributed to the right source; if you send a request or register during that visit, it is saved together with it, also if you have not yet made a choice in the cookie banner. We store it in cookies for 30 days only if you accept cookies (section 4). If you click Decline, it is deleted and no longer recorded. Legal basis: your consent for cookies (Art. 6(1)(a) GDPR; Art. 5(3) of the ePrivacy Directive); during the visit, our legitimate interest in understanding where our visitors come from (Art. 6(1)(f) GDPR).
We do not sell personal data, do not use it for advertising profiles and do not use third-party advertising or tracking tools.
| Cookie | Purpose | Duration | Set |
|---|---|---|---|
PHPSESSID | Keeps your session working (forms, sign-in, your cookie choice) | Until you close the browser | Always — strictly necessary |
referal | Remembers a referral link | 30 days | Only after you click Accept |
utm_source, utm_campaign, utm_medium | Remember the campaign link that brought you | 30 days | Only after you click Accept |
tab_link_id | Remembers the open tab in your account | Until you close the browser | Only when you use the account page |
resolution | Records the screen resolution (currently not used by the Site) | Until you close the browser | On page load |
Umami analytics does not use cookies. When you choose Decline, the referral and campaign cookies are deleted and no longer set. Your choice is stored for the current browser session; the banner appears again in a new session, where you can change it. You can also delete cookies at any time in your browser settings.
Notifications about contact messages and sample/waitlist requests are delivered via Telegram, operated by Telegram Messenger Inc., a company based in the British Virgin Islands. There is no adequacy decision of the European Commission for that country, and we have no data protection agreement with Telegram; Telegram states that data of users in the EEA is stored in the Netherlands. This means that the protection of your data may be lower than within the EEA and that it may be harder to enforce your rights. If you do not want your data to be handled this way, please do not use these forms.
Our hosting provider and our email provider are companies based in the United States; the servers that store and send your data are located in the EU (the Netherlands and Bulgaria).
| Data | Retention |
|---|---|
| Server logs | Up to 60 days |
| Technical error logs | Until deleted during regular maintenance, at least once a year |
| Visit statistics (Umami) | 25 months, then deleted |
| Contact messages (Telegram) | Up to 24 months |
| Sample and waitlist requests (including IP address and browser type) | 24 months after the request, then deleted |
| Account data | Until you ask us to delete your account |
| Published reviews | Until you withdraw them or delete your account |
| Referral and campaign cookies | 30 days |
We may keep data longer only where the law requires it.
We protect personal data with technical and organisational measures, including encrypted connections (HTTPS), password hashing, one-time links for setting passwords, restricted administrative access and secure session cookies. No method of transmission over the Internet is completely secure.
Your right to object. Where we rely on our legitimate interests (sections 2.1, 2.2, 2.4, 2.5 and 2.8), you may object at any time on grounds relating to your particular situation; we will then stop the processing unless we have compelling legitimate grounds.
Under the GDPR you also have the right to: access your data; have it corrected; have it erased; restrict its processing; receive it in a portable format; and withdraw any consent at any time, without affecting processing before the withdrawal. To exercise these rights, use the contact form (section 1); we answer within one month, which may be extended by two further months for complex requests, in which case we will tell you. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work. Visitors from Switzerland may contact the Federal Data Protection and Information Commissioner (FDPIC), visitors from the United Kingdom the Information Commissioner’s Office (ICO).
We do not use automated decision-making or profiling.
The Site is not intended for children under 16, and we do not knowingly collect their personal data.
We may update this policy when our services or the law change. The current version is always available on this page with its effective date.