🔒 Privacy Policy

📋 1. Who We Are

KMSGems Laboratory (operating as Sun Moon Bay) is a professional gemological services provider based in Sri Lanka. We specialize in AI-powered gemstone identification, specific gravity testing, refractive index measurement, and educational resources for the gem community. Our website is https://sunmoonbay-scanner.web.app and our comprehensive guide is available at https://www.sunmoonbay.co.uk/page/gem-scanner1.

This Privacy Policy governs your use of our AI gemstone scanner, website, and related services (collectively, the "Services"). By using our Services, you agree to the collection and use of information in accordance with this policy.

📊 2. Information We Collect

2.1 Information You Provide to Us

• Account Information: When you create an account for premium features, we collect your name, email address, and payment information (processed securely through third-party payment processors).
• Gem Images: When you use our AI scanner, you upload or capture images of gemstones. These images are processed to provide identification results and are temporarily stored to improve our AI algorithms.
• Communications: If you contact us via email or contact forms, we collect your name, email address, and the contents of your message.
• Export Reports: When you generate PDF reports of gem analyses, we temporarily store the report data to facilitate download.

2.2 Information We Collect Automatically

• Usage Data: We collect information about how you interact with our Services, including:
  • Pages visited and time spent
  • Features used (scanner, calculators, guides)
  • Gem types scanned most frequently
  • Referring websites or apps
• Device Information: We collect data about the device you use to access our Services, including:
  • IP address and location (country/city level)
  • Browser type and version
  • Operating system
  • Screen resolution and color depth
  • Camera capabilities (for scanner optimization)
• Cookies and Similar Technologies: We use cookies to:
  • Remember your preferences
  • Understand how you use our Services
  • Improve user experience
  • Analyze traffic patterns

2.3 Information from Third Parties

We may receive information about you from third-party sources, such as:

• Analytics providers (Google Analytics)
• Payment processors (for premium subscriptions)
• Social media platforms (if you interact with our social media pages)

🔬 3. How We Use Your Information

We use the information we collect for the following purposes:

Purpose	Legal Basis	Data Used
Providing Gem Identification	Performance of contract	Gem images, scan parameters
Improving AI Accuracy	Legitimate interests	Anonymized gem images, scan results
Customer Support	Performance of contract	Name, email, scan history
Marketing Communications	Consent	Email address, preferences
Security and Fraud Prevention	Legal obligation	IP address, usage patterns
Analytics and Improvement	Legitimate interests	Aggregated usage data

🧠 4. AI and Machine Learning

📁 5. Data Storage and Security

5.1 Where We Store Data

• Gem Images: Temporarily stored on secure servers in the European Union and United States during processing, then deleted within 30 days unless you explicitly consent to longer storage for AI training.
• User Accounts: Stored on secure databases with encryption at rest and in transit.
• Analytics Data: Stored with Google Analytics (privacy policy: https://policies.google.com/privacy)
• Payment Information: Processed and stored by our payment processors (Stripe/PayPal) - we never store full credit card details.

5.2 Security Measures

We implement industry-standard security measures to protect your data:

• Encryption: All data transmitted between your device and our servers is encrypted using TLS 1.3 protocol
• Access Controls: Strict access controls and authentication for our team members
• Regular Audits: Weekly security audits and penetration testing
• Data Minimization: We only collect and retain data necessary for providing our Services
• Incident Response: 24/7 monitoring and rapid incident response team

📤 6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We share data only in the following circumstances:

Recipient	Purpose	Data Shared
Service Providers	Hosting, analytics, payment processing	Limited to necessary data (e.g., IP for hosting)
Legal Authorities	Compliance with laws, court orders	As required by applicable law
Business Transfers	Merger, acquisition, or sale of assets	User data may be transferred (with notice)
With Your Consent	Specific purposes you approve	As specified at time of consent

🌍 7. International Data Transfers

Your information may be transferred to and processed in countries other than your own. Our servers are located in the European Union and United States. By using our Services, you consent to the transfer of your information to these countries, which may have different data protection laws than your country of residence.

We ensure appropriate safeguards are in place through:

• Standard Contractual Clauses approved by the European Commission
• Privacy Shield compliance (for transfers to the US)
• Binding corporate rules for our service providers

🔐 8. Your Rights and Choices

8.1 Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Restriction: Limit how we use your data
• Portability: Receive your data in a structured, commonly used format
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time (without affecting lawfulness of prior processing)

8.2 How to Exercise Your Rights

To exercise any of these rights, please contact us at:

• Email: privacy@sunmoonbay.co.uk
• Contact Form: https://www.sunmoonbay.co.uk/contact
• Mail: KMSGems Laboratory, [Your Sri Lanka Address]

We will respond to all legitimate requests within 30 days. Requests that are manifestly unfounded or excessive may incur a reasonable fee.

8.3 Opt-Out Options

• Marketing Emails: Click "unsubscribe" in any marketing email
• Cookies: Adjust your browser settings to refuse cookies
• AI Training: Email us to opt out of having your gem images used for AI training
• Analytics: Install the Google Analytics Opt-out Browser Add-on

👶 9. Children's Privacy

Our Services are not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you become aware that a child has provided us with personal information, please contact us immediately. If we become aware that we have collected personal information from a child without verification of parental consent, we will take steps to delete that information.

🍪 10. Cookie Policy

We use cookies and similar tracking technologies to track activity on our Services and hold certain information. Cookies are files with small amount of data which may include an anonymous unique identifier.

10.1 Types of Cookies We Use

Cookie Type	Purpose	Duration
Essential Cookies	Authentication, security, basic functionality	Session / Persistent
Preference Cookies	Remember your settings and preferences	1 year
Analytics Cookies	Understand how visitors use our site	2 years (Google Analytics)
Marketing Cookies	Personalize ads and track campaign performance	90 days

10.2 Managing Cookies

Most web browsers allow you to control cookies through their settings. To learn more about cookie management for your specific browser, visit:

• Chrome: Settings → Privacy and Security → Cookies
• Firefox: Options → Privacy & Security → Cookies
• Safari: Preferences → Privacy → Cookies
• Edge: Settings → Cookies and site permissions

📅 11. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Data Type	Retention Period	Reason
Gem Images (scans)	30 days	Processing and quality improvement
Account Information	Until account deletion + 90 days	Service provision and legal compliance
Payment Records	7 years	Tax and legal requirements
Communication Logs	2 years	Customer service improvement
Analytics Data	26 months	Trend analysis and reporting

🔗 12. Third-Party Links

Our Services may contain links to third-party websites, including:

• Payment Processors: Stripe, PayPal
• Analytics: Google Analytics
• Social Media: Facebook, LinkedIn, Twitter
• Educational Resources: Gemology forums, research sites

We are not responsible for the privacy practices or content of these third-party sites. We encourage you to read the privacy policies of every website you visit.

⚠️ 13. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date at the top
• Sending an email notification (for material changes) to registered users
• Displaying a notice on our website for 30 days after changes

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

📞 14. Contact Information

⚖️ 15. Legal Compliance

15.1 GDPR (European Union)

For users in the European Union, we comply with the General Data Protection Regulation (GDPR). Our lawful bases for processing are outlined in Section 3. You have the rights specified in Section 8, including the right to lodge a complaint with a supervisory authority.

15.2 CCPA (California)

For California residents, we comply with the California Consumer Privacy Act (CCPA). You have the right to:

• Know what personal information we collect, use, share, and sell
• Request deletion of your personal information
• Opt-out of the sale of personal information (we do not sell data)
• Non-discrimination for exercising your CCPA rights

15.3 Sri Lanka Data Protection

As a Sri Lankan laboratory, we comply with applicable Sri Lankan data protection laws and regulations regarding gemological services and commercial operations.

📋 16. Specific Service Policies

16.1 AI Scanner Specific

• Image Processing: All gem images are processed in real-time and not permanently stored unless you explicitly save them to your account
• Scan History: Your scan history is private and only accessible to you when logged into your account
• Results Accuracy: AI results are provided as estimates with confidence scores; we recommend professional certification for high-value transactions

16.2 Specific Gravity Calculator

• Calculations are based on standard gemological formulas
• Results should be verified with physical testing for critical applications
• No personal data is collected during calculator use

16.3 Blog and Educational Content

• Comments may collect display names and email addresses
• Educational content is for informational purposes only
• Always consult certified gemologists for professional decisions

🔍 17. Data Breach Notification

In the unlikely event of a data breach affecting your personal information, we will:

1. Notify affected users within 72 hours of discovery
2. Provide details of what information was affected
3. Explain steps taken to mitigate the breach
4. Offer guidance on protecting yourself
5. Report to relevant authorities as required by law

✅ 18. Your Acceptance of These Terms

By using our Services, you signify your acceptance of this Privacy Policy. If you do not agree to this policy, please do not use our Services. Your continued use of the Services following the posting of changes to this policy will be deemed your acceptance of those changes.