Your brand and data, protected.
What a security or procurement reviewer can verify about this site and about how the studio handles a client's data, creative and ad account. Every statement names a control that exists; none is a certification.
Last reviewed September 29, 2026
What is in place
Transport and headers
Every page is served over HTTPS with HTTP Strict Transport Security, a Content Security Policy, X-Frame-Options set to deny, a strict referrer policy and a permissions policy that disables camera, microphone, geolocation, payment and USB access. These headers are set in the deployment configuration and can be read on any response.
What a brief submission touches
A brief or press enquiry is stored in the studio's own database and delivered to its internal CRM. Name, company and the brief are not sent to an analytics or advertising platform. Email is sent to Google as enhanced-conversion data only when ad user data is granted. The Privacy Policy names what is collected and why.
Consent before measurement
Google's tags load on every page with advertising and analytics storage denied until a visitor accepts. Accepting grants that storage. Meta and TikTok load only after that accept. A browser's Global Privacy Control signal keeps ad user data and ad personalization denied. What can load is listed by name in the Privacy Policy.
Client assets and rights
Delivered and in-progress assets sit in private storage behind account-scoped access, and one client's material never crosses to another. Deliverables, source-file access, reuse and usage rights follow the written engagement agreement, and every delivery includes a rights record.
Your ad account stays yours
The studio never logs in to a client's ad account and never manages budgets, targeting or campaigns. Where reporting access is part of an engagement it is read-only and revocable by the client at any time.
Responsible AI
Synthetic performers are disclosed as synthetic on this site, in the work library and in the delivered rights record. A real person's likeness, voice or identity is used only under a written rights agreement. Claims, rights and product accuracy are checked by a person before delivery.
Services this site can involve
Named here so a reviewer does not have to infer them from network requests. The Privacy Policy describes what each receives.
- Vercel
- Hosting and delivery of the website
- Supabase (Postgres)
- Storage of brief and enquiry submissions in the studio's own project
- Google Analytics 4, Meta pixel, TikTok pixel, Google Ads
- Measurement and advertising. Google tags load with storage denied until cookie consent, so a Book a call request through /qualify is recorded without cookies until then. Email is sent only when ad user data is granted. Meta and TikTok load only after consent.
What the studio can provide
For a procurement or security review of an engagement, on request.
- A written description of the data flow for a brief, from the form to the CRM, with retention and deletion handling.
- The engagement agreement's clauses on rights, confidentiality, data handling and the read-only reporting access rule.
- The rights record format delivered with every batch, including synthetic-performer disclosure.
- Answers to a vendor security questionnaire, scoped to what the studio actually operates. No certification is claimed.
Report a security concern
Found a vulnerability, or reviewing the studio for procurement? Write to the security address with the page or system involved and the steps to reproduce. Privacy requests (access, correction, deletion) go to hello@theunrealcompany.com, as the Privacy Policy sets out.
The written record behind this page: the Privacy Policy, the Terms of Service, and the editorial standards that govern what this site claims.