Privacy Policy

Unsunk Productions(“Unsunk”, “we”) is an integrated creative house based in São Paulo, Brazil. This policy covers two services:

• The website unsunkproductions.com. We are the controller of the personal data processed through it, under Brazil’s General Data Protection Law (Law No. 13,709/2018, LGPD).
• Unsunk Studio (studio.unsunkproductions.com), the dashboard we use to serve our clients, which are businesses. It includes Atendimento, an inbox that connects the client’s WhatsApp Business account, Instagram professional account and Facebook Page (Messenger) through Meta’s official APIs.

Who decides about the data. In conversations between one of our clients and the people who message it, the client is the controller and Unsunk is the processor(operator under the LGPD): we handle that data on the client’s behalf and following its instructions (LGPD, art. 5, VI and VII). For the website and for conversations with Unsunk’s own Page, Instagram and WhatsApp, Unsunk is the controller.

Privacy contact: hi@unsunkproductions.com.

Data you send us directlythrough the contact form or the “Pedir Orçamento” (request a quote) modal:

• Name
• Email
• Phone (optional)
• Company / hotel (optional)
• Project type and description of the request

Application data, if you join our talent pool through the Trabalhe Conosco (work with us) page: name, email, WhatsApp, city, portfolio links and your answers to the form. We use it only for hiring processes (this one and future ones, with the consent recorded when you submit), and you can ask us to delete it at any time using the email at the end of this policy.

Data collected automatically while you browse:

• IP address (anonymized in Google Analytics)
• Device type, browser and operating system
• Pages visited, time on page and traffic source
• Interactions (clicks, scrolls, form submissions), only after you accept marketing cookies

To reply to you. When you fill in a form, we use the data only to get back to you and carry on the sales conversation (legal basis: steps prior to entering a contract, LGPD art. 7, V).

To improve the website. Aggregated traffic and behavior metrics help us decide where to invest editorial and technical effort (legal basis: legitimate interest, art. 7, IX).

For marketing and remarketing. If you accept marketing cookies, we match your behavior on the website with advertising platforms (Meta, Google) to show more relevant content and measure campaigns (legal basis: consent, art. 7, I).

This website uses first-party and third-party cookies. You control marketing cookies through the banner shown on your first visit and can change your mind at any time: the Gerenciar cookies(manage cookies) link in the footer of every page reopens that banner. If you choose “Só o essencial” (essential only) after having accepted, the page reloads without the marketing tools.

Essential (always on)

• Vercel Analytics + Speed Insights: aggregated, anonymous performance metrics. No persistent cookies and no personal identifiers.
• LGPD consent: we store your choice (accept / reject) in your browser so we don’t ask again.

Marketing and analytics (only after your consent)

• Google Analytics 4: audience, funnel and traffic source measurement. IP anonymized. Default retention: 14 months.
• Meta Pixel + Conversions API: attribution and optimization of Facebook and Instagram campaigns. The Pixel runs in your browser; the Conversions API sends data from our server when you submit the form (email hashed with SHA-256).
• Microsoft Clarity: heatmaps and session recordings to understand usability problems.
• LinkedIn Insight Tag: only loaded if we run B2B campaigns there in the future.

When one of our clients connects its WhatsApp Business account (WhatsApp Cloud API), Instagram professional account or Facebook Page (Messenger) to the Studio, the messages people send to those channels show up in the Atendimento inbox, so the client’s team (and Unsunk’s team, when it handles messages on the client’s behalf) can read and answer them. The connection is made only through Meta’s official APIs and with the authorization of whoever manages the account.

The same applies to conversations with Unsunk’s own Page, Instagram and WhatsApp.

Studio users.For people who log in to the Studio (Unsunk’s team and our clients’ teams), we keep their name, email, role and the access and activity logs needed to operate and secure the account. This data is kept while the login exists.

For connected accounts, Meta sends us:

• The sender’s identifier: the platform-scoped ID (PSID on Messenger, IGSID on Instagram) or the phone number on WhatsApp;
• The name, @username and profile photo URL, when Meta provides them;
• Message content: text, attachments and media links, story mentions and replies, and button taps (postbacks);
• Date and time of each message;
• Delivery and read status;
• When a conversation starts from an ad, the ad reference (ID and title);
• Lead Ads form responses for connected accounts: name, email, phone and the answers to the form.

We also store the replies the client’s team sends through the Studio and which team member sent each one.

• To show and answer conversationsinside the Studio, on the client’s behalf. Free-form replies are sent by a person (on the client’s team, or on Unsunk’s team on the client’s behalf), within Meta’s 24-hour customer service window. Outside that window, we only send WhatsApp message templates approved by Meta, as Meta’s rules allow. No automated messages are sent today; if we add automations, this policy will be updated before they go live.
• To organize the inbox: tags, conversation status and which team member is assigned.
• To add the contact to the client’s pipeline(WhatsApp): a new contact becomes a lead in the client’s CRM, with name, phone number and the beginning of the first message.
• AI reply suggestion (optional, on WhatsApp): the team can ask for a suggested reply. To produce it, the contact’s name, the recent messages in the conversation and the team’s notes about the case are sent to Anthropic, which processes them as a processor to generate the suggestion. A person reviews the suggestion before anything is sent.

What we don’t do:we don’t sell data, we don’t use conversations to build advertising profiles, and we don’t send messages that go against Meta’s policies.

We comply with the Meta Platform Terms and the Developer Policies.

We share data only with strictly necessary processors:

• Meta (Facebook, Instagram, WhatsApp): necessarily, to receive and deliver messages on the connected channels.
• Vercel (USA): hosting and delivery of the website and the Studio.
• Supabase (Brazil, São Paulo): database (Postgres) that stores website leads and Studio data, including conversations.
• Anthropic(USA): only when a team member asks for an AI reply suggestion on WhatsApp: the contact’s name, recent messages and the team’s notes.
• Resend (USA): transactional email provider that delivers contact form messages to our inbox.
• Google Analytics, Meta (Facebook/Instagram), Microsoft Clarity: on the website, only if you accept marketing cookies.
• Cloudflare R2 (USA): file and media storage.

None of these processors may use your data for their own purposes beyond what Unsunk contracted. International transfers rely on standard contractual clauses (LGPD art. 33, II).

Website

• Leads (contact form): up to 24 months after the last contact, or until you ask us to delete them.
• Sales conversation emails: while the relationship is active plus 5 years for legal and tax obligations, where applicable.
• Analytics data: follows the provider’s policy (14 months by default in GA4).
• Consent record: stays in your browser until you clear it.

Atendimento conversations (WhatsApp, Instagram, Messenger)

• While the client’s contract is active, each conversation is kept for 12 months from its last message and then deleted automatically.
• When the client disconnects the channel or the contract ends, that client’s conversation data is deleted within 90 days.
• A deletion request is completed within 30 days, with confirmation within 15 days. See how to ask in Data deletion.
• If someone unsends an Instagram message, its content is removed from the Studio.

The LGPD (and the GDPR, where applicable) gives you the following rights, which you can exercise at any time:

• Confirm whether we process your data;
• Access the data we hold about you;
• Correct incomplete, inaccurate or outdated data;
• Request anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law;
• Request data portability;
• Withdraw consent;
• Know which public or private entities we share your data with.

To exercise any of them, email hi@unsunkproductions.com with the subject “LGPD: [your request]”. We reply within 15 days.

If you talked to a business that is our client, that business is the controller of your data and you can contact it directly. We handle requests to delete conversations directly and let the client know; we forward any other request to the client or handle it following its instructions.

We take reasonable technical and organizational measures to protect your data, such as HTTPS across the website and the Studio and role-based access restrictions.

In the Studio, access to conversations is separated per client: only that client’s authorized users and Unsunk’s team can see its data. Meta access tokens are stored on the server and are never sent to the browser.

If a security incident significantly affects personal data, we will notify you and the ANPD (Brazil’s data protection authority) within the legal deadlines.

This website is not directed at people under 18, and we do not knowingly collect data from children or teenagers. If you notice improper processing, let us know and we will remove it immediately.

We may update this policy to reflect changes in the law or in our services. The date at the top shows the latest revision. Material changes will be announced with a prominent notice on the website.

Until we appoint a formal DPO, the contact point for data protection matters is:

Luis Pollon
Unsunk Productions
hi@unsunkproductions.com