This Privacy Policy describes how DUNA DESIGN MARKETING E TECNOLOGIA LTDA (“DunaHub”, “we”) collects, uses, stores, shares, and protects the personal information of users of the DunaHub app and website (www.dunahub.com). By using DunaHub, you agree to the practices described here.
1. Data We Collect
We collect the following categories of data:
- Account data: name, email, phone, business details (company name, tax ID, address).
- Operational data: leads, customers, opportunities, invoices, proposals, and messages (WhatsApp, SMS, email, webchat) you enter into the platform.
- Tax data (BR): CNPJ, tax regime, NFS-e records. A1 digital certificates are stored with AES-256 encryption — not even the DunaHub team can access them.
- Payment data: we never store full card details. Processing is handled by Stripe (US) or Asaas (BR — coming soon). We keep only the secure token and last 4 digits.
- Push notifications: APNs (iOS) and FCM (Android) tokens for in-app notifications. Deleted automatically when you uninstall the app or disable notifications.
- Cookies: we use essential Supabase Auth session cookies to keep you logged in. We do not use third-party advertising trackers.
- Technical data: IP address, device type, operating system, error logs, and usage — for security, fraud prevention, and product improvement.
- Social media data (Instagram / Facebook): if you connect your Instagram Business or Creator account or Facebook Page through our social media scheduling feature, we access your account profile information, media (posts, stories, reels), comments, direct messages, and performance insights (impressions, reach, engagement). We store your OAuth access tokens (encrypted with AES-256) and the content you schedule through DunaHub. We do not access your personal Facebook profile — only the Instagram Business/Creator account and Facebook Pages you explicitly authorize.
2. How We Use Your Data
- To provide, operate, and improve the CRM service.
- To process subscriptions and recurring payments.
- To send essential communications (password resets, billing notices, product notifications).
- To provide customer support.
- To comply with legal, tax, and regulatory obligations.
- To detect and prevent fraud, abuse, and terms violations.
- To schedule, publish, and manage social media content on your connected Instagram and Facebook accounts on your behalf, and to display performance analytics.
3. Sharing with Subprocessors
We do not sell your data. We share it only with providers necessary to operate the service, all under contracts requiring confidentiality and security:
- Supabase — database and authentication.
- Vercel — hosting and CDN.
- Stripe — payment processing (US and BR today).
- Asaas — BR payment processing (PIX and boleto — coming soon).
- Twilio — SMS and WhatsApp Business messaging.
- Evolution API — multi-agent WhatsApp integration.
- OpenAI / Anthropic — Conversation AI (messages are sent for reply generation).
- Apple Push Notification (APNs) / Firebase Cloud Messaging (FCM) — device notification delivery.
- Google — OAuth authentication (optional) and Google Reviews (sending review requests).
- SEFIN Nacional — NFS-e issuance (Brazil).
- QuickBooks Online (Intuit) — accounting sync (optional, if you connect it).
- Meta (Instagram Graph API / Facebook Pages API) — social media content publishing, scheduling, comment management, and performance insights. Data is transmitted to Meta's servers when you publish content through DunaHub. Meta's own data policy applies to content published on their platforms.
We may also share data if required by law, court order, or to protect our rights.
4. Your Rights (LGPD and CCPA)
Under the Brazilian LGPD (Law 13,709/2018) and the California Consumer Privacy Act (CCPA), you have the right to:
- Confirm the existence of data processing.
- Access your data.
- Correct incomplete, inaccurate, or outdated data.
- Request anonymization, blocking, or deletion of unnecessary data.
- Port your data to another provider.
- Withdraw consent and object to processing based on legitimate interest.
- Not be discriminated against for exercising these rights.
To exercise these rights, email contato@dunadesign.com.br. We will respond within 15 days.
For detailed data deletion instructions, see our Data Deletion page.
5. Security
We apply reasonable technical and organizational measures to protect your data:
- Encryption in transit (TLS 1.2+) and at rest.
- Passwords hashed with bcrypt via Supabase Auth (never stored in plain text).
- Digital certificates and tax passwords encrypted with AES-256.
- Least-privilege access and audit logging.
- Regular backups.
No system is 100% secure. We will notify you and relevant authorities as required by law in the event of an incident causing significant risk.
6. Data Retention
- Account data: kept while your account is active.
- After cancellation: deleted within 90 days, except where law requires longer retention (for example, NFS-e tax records must be kept for 5 years under Brazilian law).
- Push tokens: removed automatically when the app is uninstalled or notifications disabled.
- Logs: retained for up to 12 months for security and auditing.
7. Use by Minors
DunaHub is not intended for users under 18. We do not knowingly collect data from minors. If you are a guardian and believe a minor has provided data, contact us for deletion.
8. International Transfers
Some of our subprocessors (Stripe, Supabase, Vercel, Twilio, OpenAI, Anthropic, Google, Apple) are located in the United States. By using DunaHub, you consent to the transfer of your data to those providers, protected by contractual clauses and compliance mechanisms.
9. Changes to This Policy
We may update this Policy from time to time. Material changes will be communicated by email and in the platform, with at least 15 days' notice where required by law.
10. Contact
DUNA DESIGN MARKETING E TECNOLOGIA LTDA
Email: contato@dunadesign.com.br
Website: www.dunahub.com
See also our Terms of Service.