Privacy policy

1. Who we are

Shedo is a service of [RAZÃO SOCIAL], registered under number [CNPJ/NIF], with its registered office at [ENDEREÇO].

Data protection officer (DPO): [E-MAIL DO ENCARREGADO/DPO].

2. Who is responsible for the data

We are the controller of the data in your account and about your business, such as your email, password and plan.

The data of clients your business adds, or who book through your page, belongs to your business, which is the controller. In those cases Shedo acts as a processor and only processes the data to provide the service to your business.

3. What data we process

• Account: email, password (stored only as a hash), business name, country, time zone and, if you provide them, the business's address and contact phone.
• Account security: two-factor authentication settings and a count of sign-in attempts with a wrong password.
• Your business's clients: name, WhatsApp, email (optional), notes and booking history, including no-shows.
• Subscription: plan, subscription status and Stripe identifiers. Card details are handled by Stripe and never pass through our servers.
• Visits to the public website: aggregated Cloudflare Web Analytics metrics, such as the page visited, where the visit came from and the browser type, without cookies.
• Technical data: your IP address is used in the server's memory to limit abusive attempts on the booking page. [CONFIRMAR REGISTROS DO SERVIDOR E PRAZO DE RETENÇÃO]

4. What we use the data for

• Providing the service: calendar, booking page, confirmation and reminder emails and the WhatsApp messages you send. Legal basis: performance of a contract (LGPD, art. 7, V; GDPR, art. 6(1)(b)).
• Charging the subscription and meeting tax obligations. Legal basis: performance of a contract and legal obligation (LGPD, art. 7, II and V; GDPR, art. 6(1)(b) and (c)).
• Protecting the service against abuse and unauthorised access. Legal basis: legitimate interests (LGPD, art. 7, IX; GDPR, art. 6(1)(f)).
• Understanding, in aggregate, how the website is visited. Legal basis: legitimate interests, with no cookies or individual profiles.

We don't sell personal data and we don't use your clients' data for advertising.

5. Who we share data with

• Stripe: payments, invoices and the subscription portal.
• Cloudflare: visit metrics for the public website.
• [PROVEDOR DE HOSPEDAGEM E REGIÃO DOS SERVIDORES]: hosting for the service and its database.
• [PROVEDOR DE E-MAIL]: sending the service's emails.

We also share data when the law or a court order requires it.

6. International transfers

Some suppliers process data outside Brazil or the European Economic Area. In those cases we use the safeguards provided by law, such as standard contractual clauses. [CONFIRMAR MECANISMO DE TRANSFERÊNCIA DE CADA FORNECEDOR]

7. How long we keep data

• Account and business data is kept for as long as the account exists.
• When you delete your account, the business's data and your clients' data are erased. [CONFIRMAR PRAZO DE REMOÇÃO DAS CÓPIAS DE SEGURANÇA]
• Billing records are kept for as long as tax law requires. [PRAZO POR PAÍS]

8. Your rights

You can ask for confirmation of and access to your data, correction, portability, anonymisation, restriction or erasure, and object to processing based on legitimate interests, under the LGPD (art. 18) and the GDPR (arts. 15 to 22).

In My account you can download your personal data and delete your account yourself. For any other request, write to [E-MAIL DO ENCARREGADO/DPO].

If you are a client of a business that uses Shedo, contact the business first, as it is the controller of your data. We help the business respond.

You can also complain to a data protection authority: the ANPD in Brazil, the CNPD in Portugal or the Data Protection Commission in Ireland.

9. How we protect data

• Always-encrypted connections (HTTPS).
• Passwords stored only as hashes, lockout after repeated wrong attempts and optional two-factor authentication.
• Each business only accesses its own data.
• Private booking links are stored as hashes, and the public page never shows other clients' details.

10. Changes to this policy

If we change this policy significantly, we will tell you by email or in Shedo before the change takes effect.