Privacy Policy

# Privacy Policy **Status:** Draft pending review by a qualified lawyer. This text is not final and is not legal advice. **Version:** 2026-10-06 **Effective date:** 6 October 2026 This Privacy Policy describes how Dunkama (“Dunkama”, “we”, “us”) processes personal data in connection with dunkama.com, platform.dunkama.com, and related services (the “Service”). It is intended to support transparency under applicable privacy laws, including Brazil’s Lei Geral de Proteção de Dados (LGPD — Law No. 13.709/2018), where applicable. It is **not** a substitute for advice from a qualified Brazilian lawyer. We are publishing this draft so the Service can operate while that review is still pending. ## 1. Who we are Dunkama provides a SaaS platform for contract profitability and financial operations. **[Lawyer decision required]** Confirm the legal entity name, CNPJ/tax ID, registered address, and DPO / privacy contact details before treating this Policy as final. Privacy contact (interim): use [dunkama.com/contact](https://dunkama.com/contact) until a dedicated privacy mailbox is published. ## 2. Scope This Policy covers personal data we process as: - **Controller** of account, billing, support, and website data relating to Dunkama customers and visitors; and - **Processor / operator** of Customer Data that customers upload into the Service about their own projects, counterparties, or workforce — in which case the customer generally determines purposes and remains responsible for lawful basis toward those individuals. ## 3. Personal data we process Depending on how you use Dunkama, we may process: | Category | Examples | |----------|----------| | Account data | Name, email, password hash, locale preference, verification status | | Organization data | Company/individual legal name, country, tax/ID document numbers, currency, timezone | | Service usage | Contracts, costs, cash entries, settings, and other content you enter | | Billing | Subscription status, Stripe customer/subscription identifiers, limited invoice metadata | | Technical logs | IP address, user agent, timestamps, request IDs, security and rate-limit signals | | Country detection | Visitor IP address, sent to ipwho.is so we can infer a country code | | Communications | Messages you send via contact forms or support, delivered through Resend | | Legal acceptance | Document kind/version/locale, content hash, acceptance time, IP/user agent at acceptance | We do **not** intentionally collect special-category data unless you choose to upload it into Customer Data. Avoid uploading unnecessary sensitive personal data. ## 4. Purposes and legal bases (LGPD-oriented) We process personal data to: 1. **Provide the Service** — create and authenticate accounts, operate workspaces, process subscriptions (LGPD: performance of contract / legitimate interest, as applicable). 2. **Show a default regional price** — infer the visitor’s country from their IP address so the public website can display the default Brazil or international plan. You confirm the organization country before a subscription is charged. 3. **Secure the Service** — prevent abuse, enforce rate limits, investigate incidents (legitimate interest / legal obligation). 4. **Communicate** — verification emails, password resets, transactional notices, and responses to contact requests (contract / legitimate interest). 5. **Comply with law** — tax, accounting, or lawful requests (legal obligation). 6. **Improve the Service** — aggregated or de-identified analytics where implemented; we will update this Policy if we introduce additional analytics tools. **Marketing emails:** We will not rely on registration alone as consent for unrelated marketing. Optional marketing consent, if introduced, will be separate and withdrawable. **[Lawyer decision required]** Map each processing activity to the precise LGPD lawful basis (Art. 7 / Art. 11) for Dunkama’s final legal structure and data flows. ## 5. Service providers (processors / operators) We use providers that process personal data **on our behalf** to operate the Service. This is **not** the sale of personal data. ### Country detection — ipwho.is To choose the default regional plan and price on the public website, and a suggested organization country in the platform before you confirm it, **our servers send the visitor’s IP address** to [ipwho.is](https://ipwho.is). ipwho.is returns a country code. We use that country code only for this default. We do not send your name, email address, account identifier, or workspace contents. You can select a different organization country when you create an organization. The plan that is charged follows the country saved on the organization. ipwho.is may process that IP address outside Brazil. ### Transactional email — Resend We use [Resend](https://resend.com) to send email. Resend receives the recipient address, our sender address, the subject, and the message content. - **Platform email** (accounts and billing): your name, email address, and the text of transactional messages, including email verification, password reset, and subscription or invoice notices. Those messages may contain a one-time link. We do not send your password to Resend. - **Website contact form:** the name, email address, and message you submit, so Dunkama can read it and reply. Your email address is used as the reply-to address. We do not use Resend to send marketing mail. If we add marketing email later, we will update this Policy and request any consent the law requires. Resend may process these messages outside Brazil. ### Other providers | Category | Provider | What they process | Why | |----------|----------|-------------------|-----| | Hosting | Render | Application traffic and the systems that run the Service | Operate the Service | | Database | Managed PostgreSQL | Account, workspace, session, and related records | Store the Service | | Payments | Stripe | Subscription and customer identifiers, and payment details handled by Stripe | Charge subscriptions | | DNS | Hostinger | Domain records | Resolve dunkama.com | Providers may process data in Brazil and/or other countries. Where international transfers occur, we will use appropriate mechanisms required by applicable law. **[Lawyer decision required]** Finalize the subprocessor list, transfer mechanisms (e.g. SCCs / LGPD Art. 33), and whether a public subprocessor page is required. ## 6. Sharing with third parties We may disclose personal data: - To providers described above; - To professional advisers under confidentiality; - When required by law, regulation, or valid legal process; - In connection with a merger, acquisition, or asset sale (with notice where required); - With your direction or consent. We do **not** sell personal data. We do **not** claim that data is “never shared with anyone,” because operating the Service necessarily involves processors and, when required, legal disclosures. ## 7. Retention We retain account and Service data while your account is active and for a reasonable period afterward for security, dispute resolution, backups, and legal retention. Billing records may be kept longer as required by tax/commercial rules. **[Lawyer decision required]** Define retention schedules per data category and deletion/anonymization timelines after account closure. ## 8. Security We implement technical and organizational measures appropriate to the risk, such as encrypted transport (HTTPS), hashed passwords, access controls, and environment segregation. No method of transmission or storage is perfectly secure; we cannot guarantee absolute security. ## 9. Your rights (LGPD and similar laws) Subject to applicable law, you may request: confirmation of processing; access; correction; anonymization, blocking, or deletion; portability; information about sharing; information about consent and withdrawal; and review of automated decisions where applicable. Customers who use Dunkama to process others’ personal data should handle requests from those individuals directly when they are the controller. To exercise rights related to your Dunkama account, contact us via the published privacy/contact channels. We may need to verify your identity. You may also lodge a complaint with Brazil’s ANPD or another competent authority. ## 10. Cookies and similar technologies We use cookies necessary for authentication, CSRF protection, and locale preference. Country detection uses the IP address described above; it does not set an analytics cookie. If we add analytics or marketing cookies, we will update this Policy and implement any required consent mechanism. ## 11. Children The Service is directed to business users. It is not intended for children. **[Lawyer decision required]** Confirm minimum age and B2B positioning language. ## 12. Changes We may update this Policy and publish a new version identifier. Where legally required, we will request a new acceptance. Your account stores which version you accepted and when. ## 13. Contact / DPO **[Lawyer decision required]** Appoint and publish DPO or equivalent contact if required for Dunkama’s processing profile.