Privacy Policy
This policy explains what personal data Onne.link processes, why, who we share it with and how you can exercise your rights, under Brazil's General Data Protection Law (LGPD, Law 13.709/2018).
1. Who we are
Onne.link is a platform for creating link pages. The controller of the data processed on the platform is Onne.link · Loymaker Ltda · CNPJ 14.760.954/0001-07. For any privacy matter, including contacting our data protection officer, write to team@onne.link.
2. Who this policy applies to
- Creators: people who create an account and publish a page.
- Visitors: people who visit a creator's page, click its links or fill in a form on that page.
3. Data we process
If you are a creator
- Sign-up: name, username (alias), email, language and, if you create one, a password. The password is stored only in encrypted form (a hash), never as plain text.
- Sign in with Google: your name, email and Google account identifier. We never receive your Google password.
- Page content: photo, bio, social media links, blocks, images and files you publish. This content is public by nature.
- Subscription: the plan you signed up for and your billing history. Card details go directly to Stripe, our payment processor, and are not stored by us.
- Direct Pix: the Pix key you register to receive payments. It is stored encrypted and appears in the QR code and in the Pix copy-and-paste code for anyone who chooses to pay you. The payment goes straight to your bank account and does not pass through Onne.link.
- Tax and payout details: full name or company name and CPF or CNPJ, only if you provide them for features that require this identification.
- Usage and security: access logs (IP address, date and time, and browser) and technical events needed to keep your account secure.
If you are a visitor
- Page metrics: visits and clicks, with traffic source, country, device type and browser. Each visit and click is logged with IP address, date and time, and browser identification (user agent). We keep this log to comply with the law, such as Brazil's Internet Civil Rights Framework (Marco Civil da Internet), and to prevent and investigate fraud. The creator sees only the totals, never your IP.
- Creator forms: when you fill in a form on a creator's page (for example, to get a resource or to get in touch), we store the data you provided, such as name, email, phone, city, Instagram or message, together with the record of your consent.
- Direct Pix: we record that the QR code was shown, that the code was copied or that you said you sent the Pix, without asking for or storing your payer details.
- Age verification: on pages with adult content, we store only a cookie showing that access was granted.
4. Creator and Onne.link: who is responsible for what
The data a visitor enters in a form is collected for the creator of that page, who decides how to use it and is the controller of that data. Onne.link acts as the processor: it stores this data and delivers it to the creator, following the creator's instructions and this policy. To exercise your rights over this data, contact the creator; if you cannot reach them, write to us.
5. How we use data and on what legal basis
| Purpose | Legal basis (LGPD, art. 7) |
|---|---|
| Create and maintain your account, publish your page and provide the service you signed up for | Performance of a contract |
| Send access codes, security alerts and emails about your account or subscription | Performance of a contract |
| Show visit and click metrics to the creator | Performance of a contract with the creator and legitimate interest |
| Prevent fraud, abuse and unauthorized access | Legitimate interest and the regular exercise of rights |
| Receive visitor data through creator forms | Visitor consent |
| Send Onne.link news and offers | Consent, which you can withdraw at any time through the link in the email itself |
| Comply with legal and tax obligations and respond to orders from authorities | Compliance with a legal obligation |
6. Cookies and similar technologies
- Essential: login session, protection of Sign in with Google, unlocking protected content and age verification. The platform does not work without them.
- Visitor identifier: a random code, not linked to your name or IP, used to prevent duplicate answers in forms and polls.
- Creator tools: a creator can add Meta Pixel, Google Analytics or the TikTok pixel to their page. In that case, these companies receive data about your visit under their own policies.
- Ads: pages on the free plan may show Google AdSense ads, which use their own cookies. You can adjust personalized ads at adssettings.google.com.
You can delete or block cookies in your browser settings. Blocking essential cookies prevents login and some features.
7. Who we share data with
We do not sell personal data. We share it only with providers that help us run the service, under contract and only as far as needed:
- DigitalOcean: application hosting and storage of images and files.
- Amazon Web Services: database.
- Twilio SendGrid: email delivery.
- Stripe: subscription payment processing.
- Google: Sign in with Google and ads on free plan pages.
We may also share data with authorities when the law requires it or under a court order, and to defend the rights of Onne.link, creators or visitors.
8. International transfer
Our servers are in the United States, so your data is transferred outside Brazil, with contractual clauses and our providers' security measures, under article 33 of the LGPD.
9. How long we keep data
- Account data and page content: for as long as the account exists.
- Visitor form data: for as long as the creator keeps the account or until the creator deletes it.
- Access logs (IP address, date and time, and browser): for as long as needed to comply with the law, including Brazil's Internet Civil Rights Framework (Marco Civil da Internet, Law 12.965/2014, art. 15), and to prevent and investigate fraud, with no fixed period. They are protected, with restricted access, and never sold. Creators see only the totals of visits and clicks.
- Billing and tax data: for the period required by tax law.
Once data is no longer needed for these purposes, it is deleted or anonymized.
10. Security
We use encrypted connections (HTTPS), hashed passwords, an encrypted Pix key in the database and restricted access to our systems. No system is completely immune to failure. If an incident happens that may pose a significant risk, we will notify the people affected and Brazil's National Data Protection Authority (ANPD), as the law requires.
11. Your rights
You can ask us at any time for:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of data that is unnecessary or processed in breach of the law;
- portability of your data to another provider;
- deletion of data processed based on your consent, and withdrawal of that consent;
- information about who we share your data with;
- review of decisions made solely by automated processing.
To exercise your rights or to ask for your account to be deleted, write to team@onne.link from the email address on your account. We reply within 15 days. You can also file a complaint with the National Data Protection Authority at gov.br/anpd.
12. Children and teenagers
Onne.link is not directed at people under 18. Anyone under 18 may use the platform only with the permission and supervision of their parents or guardians. If you know of an account created by a child without this permission, write to us.
13. Changes to this policy
We may update this policy. The date at the top shows the latest version. When a change is significant, we will let you know by email or with a notice in the dashboard before it takes effect.