1. Who is responsible
L’Una Music Group LLC is the primary operator and controller for personal information handled through designs.lunaxstudios.com. For operations in Brazilian territory, L’Una Studios LTDA, CNPJ 44.160.583/0001-93, is the responsible regional entity for local processing and privacy requests. Responsibilities follow the actual service and processing activity; a client agreement may specify processing performed on a client’s behalf. Registered contact details for both entities are in the Imprint. Send all privacy requests to [email protected] so we can route them to the responsible entity.
2. Information you provide
Contact and quote requests may contain your name, email, company or brand, website address, service choice, budget, subject and project message. If we work together, we may also receive briefs, files, billing information and correspondence needed for the project. Only provide information relevant to your request and authorized information about other people.
In the current version, submitting a form opens a prepared message in your email application; it does not send the form through a website database. We receive the message only if you send it. Your email provider handles the draft and delivery under its own policies. A later server-based form will require this notice to be updated.
A protected PHP delivery option has been prepared but is not enabled until its server credentials are configured. When enabled, contact and quote fields are submitted to our server, checked with Cloudflare Turnstile, and sent using Google Workspace SMTP from [email protected] to the [email protected] alias. The visitor’s address is used for replies. Cloudflare receives the security token and necessary technical information; the form message is not sent to Cloudflare for validation. Google handles the email contents and delivery. SMTP acceptance does not guarantee inbox delivery. The website does not save inquiry bodies to its own database.
3. Technical data and preferences
Hosting systems can receive IP addresses, request times, page paths, browser information and error or security logs when serving the site. The browser stores your selected language and cookie preferences. These functions differ from advertising tracking. See the Cookie Policy for the current storage inventory.
The production site is delivered through Cloudflare’s existing proxy/CDN and security settings. Cloudflare can receive technical connection information and apply automated-traffic challenges. These settings also inject a Cloudflare Web Analytics beacon that measures page views and page-load performance. It is supplied by the hosting layer and is separate from the Google Analytics and Meta Pixel consent controls. The form-specific Turnstile widget remains unconfigured.
4. Analytics, advertising and security
Google Analytics 4 is configured through the Google tag with measurement ID G-DWNWKXLQZV. It loads on designs.lunaxstudios.com only after you allow analytics in Cookie settings; no Google analytics tag or measurement request is sent before that consent. It can process page visits and technical browser/device information, including network information received by Google. Local previews do not send analytics data. Google Signals and advertising personalization are disabled in this integration.
Meta (Facebook) Pixel is configured as LUNAXSTUDIOS Pixel, ID 719471049083365. On designs.lunaxstudios.com, its script and PageView event load only after marketing consent; local previews do not send pixel events. It can provide Meta with visited page URLs, referrers, browser/device and network information, cookie identifiers and advertising-click information for campaign attribution and remarketing. This integration disables automatic configuration, inferred events, page microdata and automatic matching, and adds no Lead, Purchase or form-submission events. Withdrawing marketing consent revokes Pixel consent and removes accessible first-party _fbp and _fbc cookies; it does not delete data already received by Meta. Global Privacy Control keeps marketing disabled. Meta may process received data under its own policies.
TikTok Pixel and a Google Tag Manager container are not configured. Turnstile and server email delivery are prepared but need private credentials before activation. The Google Analytics integration omits query strings and fragments from its initial page URL and referrer. Neither integration is supplied with form messages, email addresses, passwords or confidential project files as custom event parameters. Provider account settings and future events must be reviewed before use.
Cloudflare Turnstile is planned to help distinguish legitimate visitors from automated abuse. Once enabled, Cloudflare may process IP addresses, browser/device signals and challenge results for security. This is not an advertising purpose. Its use will be disclosed at the form and is subject to Cloudflare’s Privacy Policy and Turnstile Privacy Addendum.
5. Purposes and legal grounds
We use inquiry data to respond and prepare requested proposals; project data to perform agreements; relevant records to meet legal obligations and handle claims; and proportionate technical data to maintain security. Under applicable law, grounds may include requested pre-contractual steps, contract performance, legal obligations and legitimate interests balanced against your rights. Optional analytics and advertising rely on your consent.
7. Retention and security
We keep inquiry and project records while needed for the request, relationship and applicable legal, tax or claim-retention obligations, then delete or anonymize them as appropriate. Browser preference periods are stated in the Cookie Policy. We use proportionate safeguards, but no system is completely secure. Do not send confidential credentials through public forms; request a secure transfer method for project files.
8. Your choices and rights
Subject to applicable law, you may request confirmation of processing, access, correction, portability, information about sharing, deletion or anonymization, and review of qualifying automated decisions. You may also withdraw consent or object to processing where applicable. We do not use this website to make automated decisions that approve or reject client projects.
Use Cookie settings to change optional choices, or email [email protected] for other requests. We may verify identity proportionately and respond within the applicable legal deadline. Withdrawal does not undo lawful earlier processing. You may complain to the ANPD or another competent supervisory authority. Where relevant, you may also exercise rights relating to targeted advertising or sale/sharing under your local law.
9. External links, Instagram and AI tools
Portfolio links and social buttons take you to independent sites. Our Instagram feed displays public posts from @lunaxmarketingx through an authorized server-side API connection. Up to six public posts and captions are cached for 15 minutes; API credentials stay on the server. When the feed enters view, preview images load from Instagram/Meta media servers, which can receive technical connection information such as your IP address and browser request data. The feed does not itself load a Meta Pixel or an Instagram tracking embed. Following a post opens Instagram under its own policies.
For client work, AI-assisted development or design may involve third-party tools. Any sharing of client personal information or confidential files must be covered by the project arrangement, appropriate safeguards and the tool’s settings; the public website does not upload your form message to these AI tools.
10. Children and updates
The website markets professional services and is not directed at children. A minor’s project must involve an authorized parent or guardian. Tell us if a child has provided information without appropriate involvement so we can assess deletion. We will update this notice when our forms, providers or data practices materially change.