Legal document Change Log
This page summarizes material changes to the Lunabeam Terms of Service and Privacy Policy, as promised in Section 15 of the Terms. The current documents are always at and . Institutional customers receive at least thirty days' notice of material changes at their designated contact.
27 August 2026: Terms of Service and Privacy Policy (effective 27 August 2026) verified against the documents and the 28 August drafting record
Institutional users are carved out of consumer terms. Where a college, university or postsecondary programme has an agreement with Lunabeam, that agreement governs. The binding arbitration clause, the class action waiver and the liability cap now state expressly that they do not apply to institutions, to users under an institutional agreement, or to anyone barred by law from agreeing to them (Terms 4.2, 10, 12, 13.1).
Product commitments became binding terms, not descriptions. Lunabeam does not determine disability, does not recommend accommodations, may not be used as the sole or primary basis for denying or revoking an accommodation, and may not be required by an institution as a condition of receiving an accommodation a student is otherwise entitled to (Terms 3.1 to 3.4).
FERPA school official designation. For institutional deployments Lunabeam acts as a school official with a legitimate educational interest, under the institution's direct control, with no secondary use of institutional data and a defined path for student requests (Terms 13.2 to 13.7; Privacy 6).
Age floor set at 13 with a takedown commitment. The Service is not directed to or offered to children under 13. The previous verified-parental-consent ("Email Plus") process for under-13s was removed. Users aged 13 to 17 use the Service through a parent-managed account or under an institutional agreement (Terms 5.1; Privacy 5).
Security stated as verified controls and separate commitments. Controls in place today (row-level security on every table, encryption in transit and at rest, institution-level isolation, least-privilege access) are listed separately from commitments that attach at the start of an institutional deployment (access logging with 12-month retention, annual access review, multi-factor authentication on administrative access, 72-hour incident notification). Backup and recovery are defined: daily backups, 30-day retention, 24-hour recovery point, 72-hour recovery time, annual restore testing. Both documents state that Lunabeam does not hold a SOC 2 report (Terms 13.3, 13.4; Privacy 7).
AI processing described as it actually works. First names and an age range are sent to AI providers for personalisation; email addresses and credentials are not. Date of birth is converted to an age range before use. AI providers are contractually prohibited from training on Lunabeam data (Privacy 3.B).
Subprocessor list published with change notice. The list of service providers is maintained at lunabeamlabs.com/subprocessors, with thirty days' advance notice to institutions before a new subprocessor handles institutional data and a right to object (Terms 9; Privacy 4).
Privacy rights extended to everyone. The rights available under California, Virginia, Colorado, Connecticut, Texas, Utah, Oregon and Montana law are extended to all users regardless of residence, with a 45-day response commitment and an appeal path (Privacy 9). Do Not Track and opt-out preference signals addressed (Privacy 12).
Accessibility commitment. Lunabeam targets WCAG 2.1 Level AA, publishes its conformance status at lunabeamlabs.com/accessibility, and provides a VPAT to institutions on request (Terms 13.6).
Data retention and termination. Retention periods are stated, and on termination of an institutional agreement education records are returned or destroyed as directed, with backup copies removed within ninety days (Terms 14; Privacy 8).
Housekeeping. Copyright year corrected, version and effective date added, notice callouts rewritten without emoji.
8 June 2026: Privacy Policy (previous version, superseded 27 August 2026) derived from the application commit of 8 June 2026, "Update Terms of Service and Privacy Policy with FERPA/institutional terms"
Added educational-institution and FERPA provisions for institutional deployments.
1 June 2026: Terms of Service (last updated 1 June 2026, effective 15 December 2025; superseded 27 August 2026) derived from the same commit
Added institutional and FERPA terms to the consumer Terms.
15 December 2025: Terms of Service (initial version) assumption: the Terms carry this effective date; the initial Privacy Policy date is not recorded in the documents and should be confirmed
Initial Terms of Service for the pilot programme.