Privacy policy

1. Two different situations

There are two kinds of personal data in PontoAgendado, and our role is not the same in each.

Data about the person who subscribes, meaning the business owner and their team: here the controller is Thiago Lavandoski, reachable at pontoagendado@gmail.com, and that is what this policy covers.

Data about the end clients that the business records in its calendar: there the business is the controller and we are only a processor. Those terms are in the data processing document.

2. What data we process

• Account data: owner's name, business name, email, phone, country and language.
• Business data: address, tax details, opening hours, logo and brand colour, when you fill them in.
• Subscription data: plan status, billing dates and payment identifiers. Your card number never passes through us.
• Technical data: IP address, date and time of access, and error logs, needed for security and diagnostics.
• Contact form: name, email, phone and the message you write, used only to reply to you and kept while the conversation is open.

3. Why we use it

We do not sell personal data, we do not share it for advertising, and we do not make automated decisions with legal effects on you.

• To give you access to the service and perform our contract with you.
• To charge the subscription and issue invoices, which is a legal obligation.
• To send you operational notices, such as the end of the free period or a failed payment.
• To keep the service secure and investigate misuse, based on our legitimate interest.

4. How long we keep it

We keep account data while the subscription is active.

After cancellation we keep the information for 30 days, so the account can be recovered, and then delete it.

Invoices are kept for the period tax law requires, currently 10 years.

Technical security logs are kept for a short period, long enough to investigate incidents.

5. Who we share it with

We use suppliers to run the service. Each one processes only the data its function requires and is contractually bound to confidentiality.

• Supabase: authentication, database and file storage.
• Hetzner: application servers, located in Germany.
• Vercel: hosting for the website and the dashboard.
• Stripe: processing of subscription payments.
• Resend: delivery of the service's emails.

6. Transfers outside Europe

The application servers are in Germany. Some of the suppliers above may process data outside the European Economic Area.

In those cases the transfer relies on the standard contractual clauses approved by the European Commission or on another mechanism provided for in the GDPR.

7. Your rights

You can ask us for access to your data, correction of anything wrong, erasure, restriction of processing, portability, and you can object to processing based on legitimate interest.

• To exercise any of these rights, write to pontoagendado@gmail.com.
• We answer within one month. If the request is complex, we tell you and explain why.
• If you believe we have not handled the matter properly, you may complain to the Portuguese data protection authority, the CNPD, or to the authority in your own country.

8. Security

Connections are encrypted end to end. Passwords are never stored in readable form. Each business is isolated from the others, and that isolation is enforced on the server, not in the browser.

Access to the systems is limited to the people who need it, and it is logged.

No system is infallible. If there is a data breach that puts you at risk, we tell you and notify the supervisory authority within the legal deadlines.

9. Cookies

We do not use advertising cookies or traffic analytics tools, which is why we do not show you a cookie consent banner.

Browser local storage is used only for what the service needs in order to work: keeping you signed in, remembering your chosen language, and storing display preferences.

10. Changes and contact

If this policy changes materially, we tell you by email before the new version takes effect.

For any privacy question, write to pontoagendado@gmail.com.