Privacy policy

1. Who is responsible for your data

The controller of personal data processed by Onun be AI is Pires & Martins Comércio e Serviços Ltda., trading as Unkern Studio, CNPJ 53.349.300/0001-47.

For privacy and data protection questions or requests, write to [email protected]. This is also Unkern Studio's support channel for Onun.

2. Data and purposes

• Registration and authentication: name, email, hashed password, email verification, sessions and temporary tokens to create and protect your account.
• Profile and preferences: display name, optional description, saved items and experience settings to personalize the features you request.
• Creations and posts: prompts, images, descriptions, declared AI and video links you choose to publish. The Feed is public; drafts and the local library are separate.
• Integrations: your OpenRouter key is encrypted in the backend and linked to your account. The server uses it for your generation requests. The browser receives only connection status and the key's last characters.
• Security and operation: technical request information, including IP, time, route, device and errors, needed for operation, abuse prevention and diagnostics.
• Preferences and records: date and version of terms acceptance and policy acknowledgment; categories, date, version and random identifier of cookie choices.
• Newsletter: the email you provide when subscribing, to send requested updates. Subscription is separate from account creation.

3. Legal bases

Data needed for accounts, requested generations and platform features is processed to perform the service and related procedures. Security and abuse prevention measures may rely on legitimate interest with respect for your rights; legal obligations and the exercise of rights may justify specific retention.

Optional analytics and session replay cookies require specific, freely given and revocable consent. The newsletter depends on your subscription request. Registration does not require accepting optional tracking.

4. Providers and sharing

We use hosting infrastructure and PostgreSQL for the application, Cloudflare R2 and CDN for file storage and delivery, and Resend for email verification and account recovery.

When you request a generation, the prompt, any references and necessary parameters are sent to OpenRouter and the selected model provider. These services have their own policies and terms. Do not include unnecessary personal or confidential information in prompts.

Feed videos use YouTube or Vimeo. Players load only when you choose to play them; from that point, the provider receives necessary technical information and applies its own policies. Following third-party links takes you to another service.

We may provide data when needed to meet a legal obligation, a valid authority order or to protect rights. We do not sell personal data. International providers may process data outside Brazil, subject to applicable LGPD mechanisms and safeguards.

5. Cookies and browser storage

Essential cookies maintain your session and record privacy choices. Sessions last up to 7 days; cookie preferences last up to 180 days and may need renewal when integrations change. The preference cookie is shared between the Onun website and app; the session cookie is restricted to the app domain. Your language choice is saved for up to one year and shared between the website and app. Without a manual choice, the country supplied by Cloudflare determines the initial language; Portuguese is the fallback.

Drafts, history and the local library use browser storage for requested features. Clearing it may delete local materials. Posts and account data are stored in the backend.

Visit measurement — Google Analytics 4: when enabled by Onun and authorized by you, it measures page visits and general usage and device characteristics. Cookies configured by Onun last up to 180 days.

Browsing analysis — Microsoft Clarity: when enabled and separately authorized, it creates heatmaps and session replays on public pages. Text and fields are masked. Provider cookies follow their own expiration periods; Onun stops the integration when your choice expires or is revoked.

These integrations do not load on login, admin, account, PromptGen or Feed pages. Scripts remain blocked before consent and after rejection. You may reject optional categories without losing essential platform features or review your choice using the Cookies button.

6. Retention and security

We keep data for as long as needed for the stated purposes, account operation and applicable legal obligations. Tokens have limited validity and sessions can be terminated. Cookie choice records expire after 180 days and are removed during the cleanup routine associated with new choices.

When you close an account or request deletion, we assess what can be removed and what must be retained to meet obligations or protect rights. We will explain any retention requirement. Backups and caches may follow a different removal cycle from active data.

We use HTTPS, access controls, hashed passwords and encrypted API keys. No system is infallible; if an incident presents significant risk, we will take the notification measures required by law.

7. Your rights

Under the LGPD, you may request confirmation of processing and access, correction, sharing information, anonymization, blocking or deletion of unnecessary or unlawfully processed data, portability where regulated and applicable, review of automated decisions in legally specified cases, and withdrawal of consent.

Send requests to [email protected]. We may ask for the minimum information needed to verify your identity and protect your account. We respond within applicable legal deadlines and conditions. You may also petition Brazil's National Data Protection Authority.

Avoid publishing children's data, sensitive data or third-party information in the Feed or prompts. If you identify content that violates someone's rights, send the post address through the same contact.

8. Updates

This policy follows Onun's features. The current version and date appear on this page. Significant changes will be announced, and new uses requiring consent will need a new choice.