Privacy Policy
This policy explains what personal data we collect through this website, why we collect it, who we share it with, and the rights you have over it. We have written it to be read, not to be survived — if anything here is unclear, write to us and we will explain it.
1 Who we are
Kunavv is the trading name of a Brazilian company. The company is the data controller for the personal data described in this policy, which means it decides why and how that data is used.
Wherever this policy says "we", "us" or "Kunavv", it means the company named above.
2 Which laws apply
We are based in Brazil and we offer our services to organisations in the United Kingdom. That means two data protection regimes apply to us at the same time, and we comply with both:
- the UK GDPR and the Data Protection Act 2018, because we offer services to people in the United Kingdom;
- the Lei Geral de Proteção de Dados (LGPD, Law 13.709/2018), because we process personal data in Brazil.
Where the two regimes differ, we apply whichever gives you the stronger protection. This website and our services are aimed at businesses and the people who work in them. They are not directed at children, and we do not knowingly collect data from anyone under 18.
3 Data protection contact
Our data protection contact — the encarregado required by Article 41 of the LGPD — handles every question, request or complaint about your personal data.
4 The data we collect
We only collect what we need. There is no hidden collection anywhere on this site.
| Where | What we collect |
|---|---|
| AI readiness assessment | Your name, company name, your role, company size, industry, region, your answers about how AI is used at your company, your timeframe for acting, two free-text answers about your processes and obstacles, and your work email address. |
| Contact form | Your name, company name, work email address, phone number, and an optional message. |
| Automatically, when you visit | Your IP address, browser and device type, the pages you view, the page that referred you, and timestamps. These are standard web server logs kept by our hosting provider. |
The assessment includes free-text questions about your processes. Please do not include personal data about other people, or confidential information belonging to your clients, in those answers — we do not need it, and you should not have to trust us with it.
Data we obtain from other sources
Not everything we hold comes from a form. We are telling you this here because you have a right to know where your data came from, even when you did not give it to us yourself.
- Public professional sources. Before we contact someone, we may look at professional profiles such as LinkedIn and at their employer's website, to understand their role and make the conversation relevant. We use only professional information that the person has published about themselves, and we record only what matters commercially.
- Colleagues at an organisation that contacted us. If someone at a company asks us for an assessment and we cannot reach them, we may contact a colleague whose role suggests they are the right person. In that case we use only work contact details — name, job title, work email address and employer — found through the sources above or the company's own website.
If you are in the second group, you did not come to us and we know it. The first message you receive from us will say who we are, where we found your details, why we are writing, and how to tell us to stop. If you object, we stop immediately and permanently, and we keep the minimum record needed to make sure we do not contact you again by mistake.
We only do this where a colleague at your organisation has already approached us. We do not build prospect lists of companies that have had no contact with Kunavv, we do not buy personal data from data brokers, we do not use scraping tools, and we never telephone anyone who has not given us their number.
We do not collect special category data (such as health, biometric or political data), and we do not collect payment card details on this website.
5 Why we use it, and our legal basis
Under both the UK GDPR and the LGPD we must have a specific, lawful reason for every use of your data. Here they are, in full.
| Why | UK GDPR basis | LGPD basis |
|---|---|---|
| To produce and send you the free assessment report you asked for | Art. 6(1)(b) — steps taken at your request before entering into a contract | Art. 7, V — preliminary procedures related to a contract |
| To reply to an enquiry you sent us through the contact form | Art. 6(1)(b) | Art. 7, V |
| To follow up with you about our services after you request an assessment, and to understand which organisations find our work relevant | Art. 6(1)(f) — our legitimate interests in developing a business-to-business relationship | Art. 7, IX — legitimate interests |
| To research your role and your organisation using public professional sources, so that what we say to you is relevant | Art. 6(1)(f) — legitimate interests | Art. 7, IX — legitimate interests |
| To contact a colleague at your organisation when the person who requested an assessment does not reply | Art. 6(1)(f) — legitimate interests | Art. 7, IX — legitimate interests |
| To send you marketing emails, where you have asked to receive them | Art. 6(1)(a) — your consent | Art. 7, I — your consent |
| To keep this website working and secure, and to block spam and automated abuse | Art. 6(1)(f) — legitimate interests | Art. 7, IX — legitimate interests |
| To meet our legal, tax and accounting obligations | Art. 6(1)(c) — legal obligation | Art. 7, II — legal obligation |
Where we rely on legitimate interests, we have assessed and documented the balance between our interest and your rights, and we keep that assessment under review. You can object to this use at any time — see your rights — and you can always ask us for a copy of the assessment.
We do not sell your personal data, and we never will. We do not share it with advertising networks or data brokers.
6 Automated analysis
Your assessment report is produced and sent to you automatically. Your answers are scored across the maturity dimensions we measure, and an AI model then writes the analysis in the report from your answers and that scoring. Nobody at Kunavv reviews the report before it reaches you.
The AI model receives your answers and your company's size and industry. It does not receive your name, your email address or your company's name.
The report is advice for you to read, not a decision about you. We do not make decisions that produce legal effects for you, or that similarly significantly affect you, on a solely automated basis. If you want a person at Kunavv to look at your answers and at how your report was produced, just ask — we will do it at no cost.
7 Cookies and tracking
This website sets no cookies at all. There is no cookie banner because there is nothing to consent to.
We do not use Google Analytics, advertising pixels, social media trackers, session recording, heatmaps, or any third-party analytics. We do not store anything in your browser's local storage or session storage. No third-party script runs on this site.
If we ever introduce analytics or any other non-essential cookie, we will ask for your consent before it is set — as the Privacy and Electronic Communications Regulations (PECR) require — with a refusal option as prominent as the acceptance one, and we will update this policy first.
8 Who we share data with
We keep the list of companies that touch your data deliberately short. Each one acts on our instructions under a written data processing agreement, and none of them may use your data for their own purposes.
| Who | What they do | Where |
|---|---|---|
| Vercel Inc. | Hosts this website and keeps standard server access logs | United States |
| Cloudflare, Inc. | Carries form submissions securely from your browser to our application server, and protects it from attacks. Also stores the encrypted backups of our application server, which Cloudflare cannot open | Global network, with its main operations in the United States. Backups are stored in the European Union |
| Our application server | Stores assessment and enquiry submissions | Brazil |
| OpenRouter, Inc. | Routes your assessment answers to the AI model that writes your report | United States |
| OpenAI, L.L.C. | Provides the AI model that writes your report | United States |
| Resend, Inc. | Delivers your assessment report and other automated emails we send you | United States |
| Google LLC (Google Workspace) | Our business email, used when a person at Kunavv writes to you directly, and the spreadsheet where we keep a working copy of assessment and enquiry submissions | United States |
We may also disclose personal data where the law requires it, or to establish or defend legal claims. If Kunavv is ever sold or reorganised, your data may transfer as part of that, and this policy will continue to apply until you are told otherwise.
9 Where your data is stored
When you submit a form on this site, your answers are stored on our own server in Brazil. On the way there they pass, encrypted, through Cloudflare's network, which protects our server. To produce and deliver your report, and to follow up with you, copies of some of that data go to the suppliers in section 8, several of them in the United States.
Every day we also make a backup of that server. The backup is encrypted on the server itself, before it leaves, and is then stored with Cloudflare in the European Union. Only Kunavv holds the key that opens it; Cloudflare does not have it and cannot read what is inside. The United Kingdom recognises the European Union as providing adequate protection for personal data, under UK adequacy regulations.
Brazil is not currently covered by UK adequacy regulations. Brazil does, however, have its own comprehensive data protection law — the LGPD — enforced by a national authority, the ANPD, and we comply with it as described in this policy. Where our suppliers move data across borders on our behalf, we put appropriate safeguards in place, including the UK's International Data Transfer Agreement or Addendum where that is the right mechanism.
You can ask us at any time for details of the safeguards that apply to your data.
10 How long we keep it
We do not keep personal data indefinitely. When a retention period ends, we delete the data or irreversibly anonymise it.
| What | How long |
|---|---|
| Assessment submissions and reports | 24 months from your last interaction with us |
| Contact form enquiries | 24 months from your last interaction with us |
| Marketing contact details | Until you withdraw consent or ask us to stop |
| Details of people we approached who never engaged with us | 12 months from our last attempt to make contact |
| Our suppression list — the minimum record of people who told us to stop | Kept for as long as we operate, because it is the only way to honour your objection permanently. It holds nothing beyond what is needed to recognise you and leave you alone. |
| Server and security logs | Up to 12 months |
| Records we must keep by law (accounting, contracts) | For the period Brazilian law requires, currently 5 years |
Backups of our application server, both the copy on the server itself and the encrypted copy with Cloudflare, are deleted automatically after 30 days. So when we delete your data, at the end of a retention period or because you asked us to, it also disappears from every backup within 30 days.
You can ask us to delete your data sooner — see below.
11 Your rights
You have real, enforceable rights over your data. Exercising them is free, and we will never treat you differently for doing so. To use any of them, email privacy@kunavv.com.
If you are in the United Kingdom
- Access — get a copy of the personal data we hold about you.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — have your data deleted, where there is no overriding reason for us to keep it.
- Restriction — have us pause our use of your data while a dispute is resolved.
- Portability — receive the data you gave us in a structured, machine-readable format.
- Object — object to processing based on legitimate interests. If you object to direct marketing, we must stop; there is no balancing test.
- Withdraw consent — at any time, without affecting anything done before you withdrew it.
If you are in Brazil
Article 18 of the LGPD gives you the rights to confirmation that we process your data; access to it; correction of it; anonymisation, blocking or deletion of data that is unnecessary, excessive or unlawfully processed; portability; deletion of data processed with your consent; information about who we share your data with; information about the consequences of refusing consent; and withdrawal of consent.
We answer requests within one month under the UK GDPR, and within 15 days under the LGPD — in practice, whichever deadline is shorter for your request. We may need to verify who you are before we act, so that nobody else can obtain your data by pretending to be you.
12 How to complain
Please come to us first at privacy@kunavv.com — most issues are quickest to fix directly. But you can go to a regulator at any time, and you do not need our permission or our involvement.
13 Security
We protect your data with measures appropriate to a company of our size and to the sensitivity of what we hold:
- everything you send through this site travels over an encrypted connection (HTTPS/TLS);
- backups of your data are encrypted before they leave our server, and only Kunavv holds the key;
- access to submitted data is limited to the people at Kunavv who need it to do their work, and is protected by strong authentication;
- our forms include anti-spam protection that discards automated submissions;
- we keep the number of systems that hold your data deliberately small, because the smallest attack surface is the one that does not exist.
No system is perfectly secure. If a breach ever affects your data and puts your rights at risk, we will notify you and the relevant authority as the law requires.
14 Changes to this policy
When we change this policy we update the version number and the date at the top. If a change materially affects your rights or how we use your data, we will tell you directly before it takes effect, where we have a way to reach you.
Version 1.3 — 28 September 2026. We now keep daily encrypted backups of our application server. Section 8 adds that Cloudflare stores those backups, in the European Union. Section 9 explains that they are encrypted before they leave our server and that Cloudflare cannot read them. Section 10 says that backups are deleted after 30 days, and section 13 adds the encrypted backups to our security measures. Nothing about why we use your data changed.
Version 1.2 — 25 September 2026. Section 6 now says plainly that your report is written by an AI model and sent to you automatically, without a person reviewing it first, and what the model does and does not receive. Section 8 adds Cloudflare, OpenRouter and OpenAI, and the spreadsheet we keep in Google Workspace. Section 9 no longer says that your answers do not pass through any third party, because they pass through Cloudflare.
Version 1.1 — 19 August 2026. Added the explanation in section 4 of data we obtain from sources other than you, the two matching entries in section 5, and the retention periods in section 10 for prospect details and for our suppression list. Nothing we had already described about how we use your data changed.
Kunavv is expanding into the United Kingdom, and we expect to establish a UK entity. When that happens, the controller details in section 1 will change and this policy will be reissued.