Privacy — Privacy policyPrivacy

Who is responsible

Lunosat is the controller of the data processed on this site and in the dashboard where it is stored: it decides what is processed and why. The registered company name, CNPJ (Brazilian company number) and address are in this page's summary.

Requests about your data: contato@lunosat.com. This policy covers the lunosat.com website and the contacts that come through it, by form or by WhatsApp.

The site is made for businesses and is not aimed at minors. In the message field, please do not write health data or other sensitive data: we do not need it to reply.

What we measure on this site

We measure how the site is used, to learn what works, what confuses, and what brought each visit:

• the pages you open, how long you stayed and where you came from. The page address is kept without its parameters, except the campaign ones and the ad click IDs (utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, gbraid, wbraid, fbclid and msclkid), and without anything after #. For where you came from, only the site is kept, such as https://www.google.com, or, if you came from one of our pages, only its path;
• clicks, with the position on the page, the address of the link clicked, trimmed the same way (for a WhatsApp link, without the ready-made message), and up to 60 characters of the visible text of what was clicked, such as a button, a link or a passage of the page (never from a form field); scrolling and which sections appeared on screen; and, if you leave through a link and come back within 10 seconds, how long you were away;
• text copies: only the kind of thing copied (an email, a phone number or other text), never the content;
• how you interact with the form: which fields got focus and for how long, how many times they were edited, whether they ended up filled and whether they showed an error. Never what you type; the only exception is the sector picked from the list. The ads authorization box is left out of this measurement;
• page speed and technical errors, with the error message the browser records and the file and line where it happened. Addresses inside the message and the file's address are kept without parameters;
• browser, operating system, device type, screen size, window width, pixel density, language and time zone;
• approximate location (city, state and country), derived from your IP address by a database that runs on our own server. Measurement does not keep the IP address: it is used for that lookup and discarded. Separately, the law requires us to keep it for 6 months in the access log (see Access log);
• if you came from an ad, the click ID the platform adds to the address (gclid, gbraid or wbraid, from Google; fbclid, from Meta; msclkid, from Microsoft). It is kept so we know which campaign brought the visit, but it only goes to a platform if you authorize it (see Ads).

The legal basis is legitimate interest (Brazil's LGPD, art. 7, IX): measuring the audience of our own site, as far as needed, without selling or transferring the data, with the opt-out explained under Your choices. Visitors in the European Union, the EEA, the United Kingdom or Switzerland have their own rules, further down.

Visits by our team are flagged as internal and do not count as audience.

What is stored in your browser

No other company stores anything in your browser through this site: there are no third-party cookies, pixels, scripts or fonts, and Meta and Google do not run here. What is stored belongs to the site itself, on this device only:

• luno:vid (local storage): a random identifier, to count visitors and not just visits. It does not contain your name or email. It stays until you stop measurement or clear the site's data;
• luno:sid (session storage): the visit identifier and the time of the last activity, with the address of the first page and where you came from, trimmed as in measurement, a marker of the campaign that brought you and this visit's WhatsApp code. It disappears when the tab closes, and the visit ends after 30 minutes idle;
• luno:rp and luno:rs:<visit> (session storage): the draw that decides whether this visit is recorded, and the count of the recording's parts. They disappear when the tab closes;
• luno:consent (local storage): your answer about ads, when you gave it, the version of the text you saw, where you answered (the form's box or Your choices) and the page's language. It stays until you change your mind, stop measurement or clear the site's data; a yes given to wording that has since changed is deleted from here;
• luno:optout (local storage): your request not to be measured. It stays until you undo it or clear the site's data;
• luno:internal (local storage): only in our team's browsers, so their visits do not count as audience;
• lunosat:scheme (local storage): the light or dark theme you picked;
• lunosat:intro (session storage): whether the site's opening animation already played in this tab, so it does not repeat;
• luno_medicao (cookie, only for visitors who see the measurement notice): your answer to the notice, with the date and the version of the text. It is kept for 6 months, whether you accepted or rejected.

Session recording

We record about one in five visits, chosen at random: movement on the page, clicks and scrolling, to replay like a video and find where the site confuses people.

Every field you can type in is masked in your own browser, before anything is sent: what you write is not recorded, nor is the sector you pick. The page's text appears as it is, and its address is trimmed as in measurement. Checkboxes are not masked, and the only one on the site, the ads authorization box, is left out of the recording entirely.

Recordings are kept for 30 days and then deleted automatically. Only members of our team with the tracking read permission can watch them, on the dashboard screen. Tools and artificial intelligence agents connected to the dashboard cannot open recordings (see Artificial intelligence).

The basis is legitimate interest (LGPD, art. 7, IX), with these safeguards: sampling, masking in the browser, a short retention period and access only with permission. Stopping measurement also stops recording, immediately.

Access log

Brazilian law requires businesses that run an internet application to keep an access log for it for 6 months (Marco Civil da Internet, Law 12,965/2014, art. 15). So, for each measurement or form call the site passes on to our dashboard, we keep the IP address, the date and time (in UTC) and the kind of call: a measurement batch, a piece of a recording or the form submission.

The log sits in its own table, separate from measurement. It does not hold the browser identifier, the visit, the contact or your browser's identification (user agent). On its own, it does not say who you are.

It also applies if you stopped measurement or are in Europe and did not accept it: the form submission goes through the dashboard and creates an entry. Only measurement and form calls are logged; the page itself, served by the hosting, is not.

No one on the team sees it through the dashboard: no screen, connected tool or artificial intelligence assistant reads the log. It is only looked up directly in the database, to comply with a court order, and handed over only that way (Marco Civil, arts. 10, § 1, and 22).

It is kept for 6 months (183 days) from the access; the daily cleanup deletes whatever is past that period. It is not part of the copy of your data and is not removed by deletion: keeping it for that period is a legal obligation (LGPD, art. 16, I), and it is not linked to you. The basis is compliance with that obligation (LGPD, art. 7, II).

When you fill in the form

We receive your name, email, company, phone number, sector and message, if any. We use them to reply to you by email, phone or WhatsApp, and to keep the history of the business conversation.

Your request is also linked to what you viewed on this site, through the browser and visit identifiers, so the conversation starts with context and without repeating what the site already said. With it we keep your browser's identification (the user agent), the address of the page you sent it from, without parameters, and where you came to that page from: from another site, only its main address; from one of our pages, only the path. If you stopped measurement, or are in Europe and did not accept it, the request is not linked to your browsing, and where you came from is not sent.

The contact travels two ways: an email to our inbox, delivered by Resend, and a copy in our dashboard. If both fail at the same time, the whole request stays in the hosting's technical log so it is not lost; we recover it from there, and it is deleted with the log. If only one fails, the log keeps only the reason for the failure. To prevent abuse, the site accepts up to 5 submissions every 10 minutes per IP address. That count lives only in our servers' temporary memory and disappears when they restart. The submission also goes into the access log, with the IP address, date and time (see Access log).

Our team is notified of each new contact in an internal WhatsApp group, with only your name, company, whether it came through the form or WhatsApp, the source of the visit (channel, source and campaign) and the link to the dashboard. Your message, the pages viewed and the time on the site stay in the dashboard only. If your contact already has an owner in the dashboard, that person gets a notice there with your name, company and source.

The basis is legitimate interest (LGPD, art. 7, IX): replying to someone who reached out on behalf of a company. When the contracting party is you yourself, as a self-employed professional or sole trader, the basis is the pre-contractual steps you requested (art. 7, V).

When you message us on WhatsApp

The site's WhatsApp button opens the chat with a ready-made sentence and a short code at the end, such as (ref K7Q2M). The code is visible in the message and has one job: linking the conversation to the visit it came from, if it arrives within 7 days.

If the message arrives without the code and is the first from a new number, we may link it to a click on the WhatsApp button in the previous 15 minutes, as long as the clicks in that window come from a single visit. Clicks by our team, by bots and from visits that already became contacts do not count. That is an inference, not a certainty: the link is recorded as probable, the notice to the team says so, and it is never used to send data to ad platforms.

From the conversation we keep the profile name, the phone number, the first message (up to 300 characters) and the history of messages exchanged. The conversation goes through WhatsApp, under its own terms, because that is the channel you chose. The first reply may come from an automated assistant (see Artificial intelligence).

The basis is legitimate interest (LGPD, art. 7, IX). To keep the conversation from being linked to the visit, use Stop measuring this browser, under Your choices, before or after clicking. The site tells our dashboard, with only this browser's identifier, and no conversation that arrives afterwards is linked to it, either by the code or by the time of the click. With measurement off, the click is not recorded either and the link goes out without a code. Deleting just the code is not enough, because we may still link the conversation by the time of the click.

Ads, only with your authorization

We advertise on Meta (Facebook and Instagram) and on Google. If you came from an ad on one of them and you authorize it, we tell that platform when a contact happens and as it moves forward, so it can measure which ads bring contacts and optimize delivery, that is, choose whom to show the next ones to. If you came any other way, nothing is sent to either of them, even if you authorized it.

There are two ways to authorize: the box on the form, and the I agree button under Your choices, which shows the full request. The box applies to that submission and, with measurement on, also to a conversation you later start on WhatsApp through the site's button, in this browser. The I agree button applies to that WhatsApp conversation. The box starts unticked, and unticked it counts as no for that submission. Saying no changes nothing on the site or in the reply you get.

What goes, to whom and when:

• to Meta Platforms, Inc., in the US: your email and phone number hashed with SHA-256, the browser identifier, also hashed, Meta's ad click ID (fbclid), if any, the event name and the time. The contact-sent event from the form also carries your browser's identification (user agent) and the address of the form page, without parameters. It only goes if you came from a Meta ad: through the click ID or a campaign tagged as Facebook, Instagram or Messenger;
• to Google LLC, in the US: only the ad click ID (gclid), the conversion name and the time, and only if you came from a Google ad. Our team downloads a file from the dashboard, uploads it through Google Ads and deletes it from the computer after the upload;
• at two moments: contact sent, when you send the form or the first WhatsApp message; and conversation moved forward, when you reply to us or write again, or when the team marks the conversation as in progress. We do not tell the platforms when a contact becomes a client.

A hash is a code computed from the data. It does not hide you from the platform: Meta computes the same code from its own account data, and that is how it recognizes who you are. That is why we treat what is sent as personal data.

Meta and Google also use this data as controllers in their own right, under their own policies, to deliver ads and improve their products. Meta keeps the data from these events for up to 2 years.

The basis is your consent (LGPD, art. 7, I). The box and the request under Your choices name Meta, Google and the US because they are also your specific consent to the international transfer (art. 33, VIII). As proof, we keep with each contact your answer, when you gave it, the version of the text you saw, where you answered (the form's box, Your choices or, for a WhatsApp contact, the answer that came from the browser) and the language. If you withdraw, we also keep when and how. Withdrawal does not erase the earlier answer: it is what shows that a send made before had a basis. The proof stays with the copy of the contact, for its period, and this browser's most recent answer also stays in its record in the dashboard, for the measurement period.

To withdraw, use Ads under Your choices, on this page, with measurement on, or write to contato@lunosat.com. Withdrawal applies from then on. Through Your choices, it reaches the contacts made from this browser; by email, the ones we find by your email, your phone number or their browser, and our reply says which. Those contacts switch to not authorized, and anything not yet sent is cancelled. What was already sent does not come back, because the platforms do not accept deleting an event they received.

If you ask, we tell you what was sent. The dashboard keeps the record of each send for 90 days: for Meta, what went and when; for Google, what went into each file downloaded for upload and when it was downloaded. Uploading the file to Google Ads is done by hand, outside the dashboard.

If you authorized under the wording before this one, through the box, you agreed to a request that spoke of measuring ad effectiveness. That answer no longer applies, in this browser or in our dashboard: nothing more is sent based on it, and what had not gone out yet will not go. To authorize the current wording, use the form box or Ads under Your choices.

Artificial intelligence

We use artificial intelligence models in these places:

• lead qualification: a model gives the contact a score from 0 to 100, with a rationale, based mostly on company data (name, website, sector and city) and the evidence gathered about it. The score orders the team's follow-up queue, and a person reviews it. Contacts from the site only go through it when someone on the team asks;
• WhatsApp replies: an automated assistant may reply to messages that reach our number. Ask to talk to a person at any time. If you ask it to stop, or it concludes you are not interested, it ends the contact and we stop reaching out to you;
• WhatsApp voice messages: the voice messages you send may be transcribed by a model, so the team and the assistant can read them;
• message drafts: a model may draft the follow-up or outreach message from the contact's name and job title, company, website, sector, city, qualification score and the evidence gathered about the company. A team member reviews the draft before sending it;
• internal assistant: the team asks an assistant questions about the dashboard, and it looks up the records of contacts and visits, including name, email, phone number and message. It does not open recordings, take the full copy of a person's data or read the access log;
• agents connected by the team: team members may connect artificial intelligence agents to the dashboard, which act with their permissions and can read contacts and visits. They cannot open recordings, take the full copy of a person's data or read the access log.

The models come from Anthropic and, through OpenRouter, from other providers such as Google, all in the US, depending on the task and the configuration. Voice message transcription goes through OpenRouter.

The qualification score decides nothing on its own: it orders the queue, and a person reviews it. The WhatsApp assistant may end the contact on its own when it concludes you asked it to stop or are not interested; if it got that wrong, ask for a review at contato@lunosat.com. At the same address, you may ask for a score to be reviewed and to know the criteria used (LGPD, art. 20). The basis is legitimate interest (art. 7, IX).

Who else receives data

We do not sell or transfer data. Data is received only by the providers who work for us, each for its own task, by the ad platforms when you authorize it, and by authorities when the law or a court requires it:

• Vercel Inc. (US): hosts the site and the functions that receive the form and relay measurement. Processor. Receives IP address, browser, measurement and the form in transit, and keeps technical logs for a short period;
• Vultr (The Constant Company, LLC, US): the server for our dashboard, which holds measurement, recordings, contacts, conversations, the access log and backups. Processor;
• Resend, Inc. (US): delivers the form's email to our inbox. Processor. Receives everything you filled in;
• Hostinger (European Union): the contato@lunosat.com mailbox. Processor. Keeps the emails received and sent;
• Meta Platforms, Inc. and Google LLC (US): only with your authorization, what is described under Ads. Meta is a processor for measurement and a controller in its own right for ad use; Google is a controller in its own right;
• Anthropic and OpenRouter (US): the artificial intelligence models. Processors. OpenRouter passes the request on to the provider of the chosen model, such as Google;
• WhatsApp LLC (US): the channel you chose to talk to us. It handles the conversation under its own terms, as a controller in its own right;
• our team, in an internal WhatsApp group: the notice of each new contact, with only name, company, whether it came through the form or WhatsApp, the source of the visit and the link to the dashboard.

Approximate location comes from a database (DB-IP Lite) that runs on our server: no IP address leaves for that lookup.

International data transfer

Part of the data is processed outside Brazil, almost all of it in the US. The purposes, data and retention periods of each case are in this policy. Here are the destination and the mechanism for each transfer:

• US, Meta: your specific consent, through the form's box or the request under Your choices (LGPD, art. 33, VIII);
• US, Google: the ANPD standard contractual clauses that Google offers advertisers, controller to controller (art. 33, II, b), plus the same consent;
• European Union, Hostinger: the ANPD adequacy decision for the European Union (ANPD Resolution CD/ANPD No. 32/2026);
• US, Vercel, Vultr, Resend and the artificial intelligence providers: the US has no adequacy decision, and these providers do not yet offer the ANPD standard contractual clauses. Vercel, Resend and Anthropic commit by contract to use the data only on our instructions, with confidentiality and security;
• US, WhatsApp: the conversation goes through WhatsApp's servers because it is the channel you chose, under its own terms.

Lunosat is answerable to you for the processing and requires each provider to apply the measures described under Security. Your rights, the channel to exercise them and the right to complain to Brazil's ANPD are under Your rights.

You may ask for the full text of the clauses used in each transfer at contato@lunosat.com. We reply within 15 days.

How long we keep it

Each kind of data has its own period. When it ends, we delete the data or anonymize it so it no longer identifies anyone:

• measurement (visits, events and sessions): 13 months from the last event, including for people who became contacts;
• session recordings: 30 days;
• the dashboard's copy of the form and of the first WhatsApp contact, with the proof of your answer about ads: 24 months from the last interaction with you (the submission, a message, a call or a meeting);
• the record of each send to ad platforms: 90 days after its last status (sent to Meta, downloaded in the Google file, cancelled or failed). What has not gone out yet stays until it goes, is cancelled or the copy of the contact is deleted;
• business history (contact, company and conversations): for people who did not become clients, we review it every six months and delete what is more than 24 months past the last contact; for clients, the length of the contract plus 5 years, for the legal limitation and tax record periods;
• do-not-contact list: the email, phone number, website, Instagram and CNPJ (or a sole trader's CPF) linked to the request, with the reason, for as long as your objection stands. This is what keeps anyone on the team from reaching out to you again;
• the dashboard's internal notices with your name: 24 months from the notice. They go earlier, together with the copy of the contact, when it is deleted, at the end of its period or at your request;
• the hosting's technical logs, including the copy of a failed submission: for the provider's short period, no longer than 30 days;
• IP address to limit submissions: only in our servers' temporary memory, which is cleared when they restart;
• access log (IP address, date and time, and the kind of call): 6 months (183 days) from the access, as the Marco Civil da Internet requires;
• dashboard backups: taken before each system update. At most the five most recent ones are kept, and at each update we delete those older than 30 days. Without an update, a backup may stay past 30 days until the next one;
• in your browser: the period for each item is under What is stored in your browser.

If you are in the European Union, the EEA, the United Kingdom or Switzerland

Visitors from these places see a measurement notice before anything else. Without your acceptance, the measurement script does not run: nothing is measured or recorded, no identifier is stored in your browser, and the WhatsApp link goes out without a code. Only the cookie holding your answer and the site's functional items, such as the theme you picked, are kept. Rejecting is as easy as accepting, and you can change your mind under Measurement preferences, in the footer of every page. If you reject after having accepted, your browser sends the dashboard one last notice, carrying its identifier, only to record the rejection; the identifier is then deleted from your browser and nothing else is sent. That notice goes into the access log.

For you, ads authorization is given only through the form's box. The form submission goes into the access log, like anyone else's (see Access log).

GDPR legal bases: consent for measurement, recording and ads (art. 6(1)(a)); to reply to your contact, steps you requested before a contract or our legitimate interest (art. 6(1)(b) and (f)); for the access log, our legitimate interest in complying with the Brazilian law that requires us to keep it (art. 6(1)(f)).

The data leaves Europe straight for providers' servers in the US: Vercel, which hosts the site, and Vultr, which hosts the dashboard. Lunosat, in Brazil, controls the processing and accesses the data from here, under the European Commission's adequacy decision for Brazil of January 2026. Among the providers in the US, Vercel, Resend and Anthropic include the EU standard contractual clauses in their contracts.

You have the rights in GDPR arts. 15 to 22: access, rectification, erasure, restriction, portability, objection, and withdrawing consent at any time. We reply within 1 month. You may complain to the data protection authority of the country where you live or work; in the United Kingdom, to the ICO; in Switzerland, to the FDPIC.

Your rights

Under the LGPD (art. 18), you may ask, free of charge and at any time, for:

• confirmation that we process your data, and access to it;
• correction of anything incomplete, wrong or out of date;
• anonymization, blocking or deletion of anything unnecessary or processed unlawfully;
• portability, as a copy in a readable format (JSON or CSV), with where the data came from, the purposes and who received it;
• deletion of data processed with your consent;
• information on whom we share it with;
• information on what happens if you do not consent: for ads, nothing changes for you;
• withdrawal of consent;
• objection to use based on legitimate interest, such as measurement and linking your browsing to your contact;
• review of a score given with the help of artificial intelligence, and the criteria used (art. 20).

Write to contato@lunosat.com. To protect you, we confirm your identity before acting: the reply and the copy of your data go only to the email or phone number we already have for the contact.

A simple confirmation is immediate; the full reply comes within 15 days.

The copy of your data is generated on the dashboard screen, by a team member with the export permission, and never by a connected tool or an artificial intelligence assistant. It comes as a JSON file, with who controls the data, where each part came from and who received it, plus the conversation messages, if you ask. It lists the recordings, without the video, and does not include the access log, which is released only by court order. Deletion requires the deletion permission and the permission to add to the do-not-contact list, and cannot be undone.

When you ask for deletion, we delete the contact and the people linked to it in the business history, the company, if no other contact depends on it, the copy of the form and of the first WhatsApp contact, the browsing and recordings linked to you, the records of sends to ad platforms and the internal notices with your name. Conversations go if you ask, unless there is a legal or contractual reason to keep them, such as an ongoing contract, and we tell you which. Only the minimum on the do-not-contact list remains, so we do not reach out to you again, plus a record without contact details showing the request was fulfilled, and the access log, until its 6 months are up.

Outside the dashboard, when we handle the request, we delete the form's email from our inbox and ask the team to delete the notice that went to the internal WhatsApp group. The technical logs of the hosting and of the email delivery (Vercel and Resend) disappear within the providers' periods. What was already sent to Meta and Google cannot be recalled, and what is in the backups leaves when they are deleted (see How long we keep it). In all these cases, we say so in our reply.

If your contact from the site never reached the business history, deletion starts from the copy of the contact: we delete the copies with the same browser, email or phone number, the browsing, the recordings, the records of sends to ad platforms and the internal notices, and your email and phone number go on the do-not-contact list. Conversations go if you ask, as above. If you write to us through the site again, we receive the contact, but it does not enter the business history on its own.

If the reply does not settle it, you may complain to Brazil's National Data Protection Authority (ANPD) and to consumer protection bodies.

Security

In the dashboard, each team member sees only what their permission allows: browsing, recordings and the copies of site contacts require the tracking read permission; the business history requires the leads permission. Recordings can only be watched on the dashboard screen, never through a connected tool. Exporting a person's data, at their request, requires the export permission and is done only on screen; deleting it requires the deletion permission and the permission to add to the do-not-contact list. The access log does not appear on any screen or tool. Field masking happens in your browser, before anything is sent. Everything travels encrypted (HTTPS), and requests between the site and the dashboard are signed.

If a security incident could cause you significant risk or harm, we notify the ANPD and the people affected, within the deadlines of ANPD Resolution CD/ANPD No. 15/2024.

Changes to this policy

When we change what we do, we change this page and the date at the top. If the change touches something that depends on your consent, the site asks for your authorization again with the new wording, and we say here what happens to the ones given before.

• October 30, 2026: the policy now lists everything the site measures and stores in your browser, the providers and their countries, international transfers, the use of artificial intelligence, the retention period of each kind of data and the rules for visitors in Europe. Addresses are now kept without parameters, except campaign ones and ad click IDs, and the IP address is now kept for 6 months in the access log the law requires. The notice to our team carries less data. The ads authorization has new wording and only applies if you came from an ad; the most recent choice applies, it can be withdrawn on this page, and we keep proof of each answer. Linking your browsing to your contact now relies on legitimate interest.
• October 26, 2026: first version. The full text is available on request at contato@lunosat.com.