Privacy Policy

1. Who processes the data, and in what role

linqo is operated by VITOR DO PRADO FERREIRA LTDA, registered in Brazil under tax ID (CNPJ) No. 43.115.280/0001-96, headquartered at Piraju/SP.

The platform processes sets of data in different roles, and the distinction matters for the exercise of your rights:

• Data of the contracting business and its users (administrator and professionals): linqo is the controller.
• Data of end clients, registered by the business or provided at booking: the contracting business is the controller and linqo acts as the processor, handling this data according to the business’s instructions.
• Data of those who visit the site or talk to our support: linqo is the controller.

In practice, an end client who wishes to correct or delete their own data should contact the business where they booked; we support the handling of that request.

2. Information we collect

We collect only what is necessary to operate the service:

• Business record: legal or trade name, tax ID (CNPJ) when provided, email, phone, address, city and state, logo, description and public contact links.
• Account users: name, email, phone, ID document, specialty, profile photo, bio and professional registration, when provided.
• End clients: name, email, phone, tax ID (CPF) and date of birth when provided, photo when uploaded, address when the service is on-site, notes and tags recorded by the business, and the history of bookings with the business.
• Bookings: service, professional, date and time, mode, price and payment method recorded by the business, status, cancellation reason and, in virtual mode, the session link.
• Subscription: plan subscribed, billing history and invoicing data, such as tax ID, when there is billing.
• Platform usage: technical logs of access (IP address, browser, date and time), of actions taken in the account, of notification sending and of API calls (request identifier, key used and time), necessary for security, auditing and support.
• Support: the messages you exchange with our support, by email or WhatsApp.
• Video sessions: the connection data of the room and the record of the acceptance shown before entry, as described in the section "Video sessions".

We do not collect credit card data on the platform. When there is a charge, processing is handled by a specialized payment provider, which receives that data directly.

We do not ask for sensitive data. linqo may be used by clinics and other health professionals, and the notes fields are free text: whatever the business records in them — including health information — is processed by us only as a processor, under the responsibility of the business, which is the controller.

3. What we use the data for

The data is used exclusively to:

• Operate the calendar: create, confirm, remind, reschedule and cancel bookings.
• Send transactional communications to the end client and the professional, through the channels configured by the business.
• Publish the business’s booking page, with the information it chose to make public.
• Authenticate users, prevent fraud and protect the integrity of the platform.
• Provide support and improve the product.
• Bill the subscription and comply with legal, tax and regulatory obligations.
• Send the administrator notices about the account, security and changes to the service and, with the option to unsubscribe, product news.

We do not use your clients’ data for our own advertising and do not turn it into a contact base of our own.

The legal bases for this processing, under the LGPD, are: the performance of the contract with the business and of preliminary procedures related to it; compliance with a legal or regulatory obligation, such as keeping access logs; the legitimate interest in keeping the platform secure, preventing fraud and improving the product; the regular exercise of rights; and consent, when we ask for it specifically. For end client data, the legal basis is defined by the business, which is the controller.

4. Sharing with third parties

We do not sell or transfer personal data. Sharing is limited to the providers necessary for the operation of the service — infrastructure and database, email delivery, notifications and, where applicable, messaging, video rooms and payment processing —, always in the minimum volume necessary and under a contractual obligation of confidentiality.

Today, these providers are:

• Infrastructure, database, file storage, authentication and video room connection: Amazon Web Services (AWS).
• Hosting of the site and the dashboard: Vercel.
• Email delivery: Resend.
• Error monitoring of the dashboard: Sentry, which receives the identifier and email of the affected user and the technical data of the error.
• WhatsApp messaging: Zernio, which operates the sending, and Meta (WhatsApp Business), when the channel is active.
• Video room relay, when the participants’ devices cannot connect directly: Cloudflare, which receives their IP addresses and relays the encrypted audio and video without access to the content, when the feature is active in the account.
• Subscription payment: Stripe, which receives payment data directly, when billing is active.

This list is updated whenever a provider changes.

Within an account, client data is visible to the administrator and to the professionals of the business, according to each one’s permissions. What the business decides to publish on the booking page — name, logo, description, professionals, services and prices — is visible to anyone.

When the contracting business connects its own or a third-party system to linqo through the public API — including artificial intelligence assistants and agents connected through the MCP protocol —, the data that system reads or writes goes through it by decision and under the responsibility of the business, which is the controller. linqo gives each key only what the scopes chosen by the administrator allow, and the business can revoke access at any time. The processing carried out by the connected system follows the rules of whoever operates it, not this Policy.

We may also share data when required by law, court order or competent authority. In the event of a corporate reorganization or sale of the business, the data may be transferred to the successor, which is bound by this Policy.

5. International data transfers

Our main infrastructure providers operate in the United States. For that reason, data processed by linqo is stored and processed outside Brazil.

This transfer relies on the standard contractual clauses approved by the Brazilian National Data Protection Authority (ANPD Resolution CD/ANPD No. 19/2024), incorporated into the contracts with these providers, as provided for in articles 33 to 36 of the LGPD. They bind the providers to standards of protection and security compatible with those of this Policy. You may request more information — including the text of the clauses — through the channel indicated in the section "Data protection officer and contact".

6. Retention and deletion

We keep the data while the account is active. Deleting the account through the platform settings removes the data of the business, the professionals, the clients and the associated bookings.

Some records may be retained for a legal period or for the regular exercise of rights, even after deletion — for example, proof of communications sent.

The periods we apply:

• Backups: deleted data leaves the backups within 35 days.
• Logs of access and of activity in the account: 12 months, observing the minimum of 6 months required by Brazil’s Internet Civil Framework (Marco Civil da Internet). Technical operation logs: up to 90 days.
• Audit trail of data changes, records of acceptance of terms and proof of communications sent: up to 5 years after the account is closed, in a restricted-access environment.
• Billing data and tax documents: for the period required by tax law.
• Blocked accounts or accounts without an active plan: the data is preserved for 12 months and may be deleted after that, with prior notice to the administrator.

Deletion of the data of a specific client may be requested by the business from our support.

7. Your rights as a data subject (LGPD)

Law No. 13,709/2018 guarantees you the right to confirm the existence of processing, access your data, correct incomplete or outdated data, request anonymization, blocking or deletion, request portability, obtain information about sharing, object to processing you consider irregular, and withdraw consent.

Much of this is resolved directly in the platform screens. Anything beyond that may be requested by email to support, and we respond within the periods provided by law.

To protect you, we may ask for information that confirms your identity before handling the request. Requests from end clients are forwarded to the business responsible, which decides as the controller.

You may also file a complaint with the National Data Protection Authority (ANPD).

8. Information security

We adopt technical and organizational measures commensurate with the risk: encrypted traffic, data encrypted at rest, passwords kept by a managed identity service and never in readable text, isolation of data by business on every request, role-based access control and logging of sensitive operations in an audit trail that cannot be altered.

Public API keys are stored only as a hash and shown a single time, at creation. Each key reaches only the scopes chosen by the administrator and can be revoked at any time.

The logo and the profile photos of professionals appear on the public booking page and are kept at a public address: whoever has the link can open them. Client photos are private: only users of the business account can see them, through temporary links that expire within a few minutes. Do not upload images containing sensitive information.

No system is immune. In the event of a security incident with relevant risk to data subjects, we will notify those affected and the National Data Protection Authority, as required by law. When the incident involves end client data, we will notify the controlling business within 48 hours of becoming aware of it; the business is responsible for communicating with the data subjects.

Security also depends on you: use a unique password, do not share access, and revoke keys and users you no longer use.

9. Cookies and similar technologies

We use local storage and strictly necessary cookies to keep the session authenticated, store the theme and language preferences and remember the email at login, when you ask. We do not use advertising cookies or cross-site tracking.

10. Children and adolescents

A linqo account is intended for people over 18. Data of clients who are minors is processed only when the business registers it, under its responsibility and in the best interest of the minor, with the consent of a parent or legal guardian when the law requires it.

11. Video sessions

When a session takes place in a linqo video room, we process the connection data needed to establish the call and keep it secure — IP address, browser and time of entry and exit — and we record the acceptance of the terms presented to the client before entry.

Audio and video are transmitted in real time, encrypted in transit — directly between the devices or, when that is not possible, through the relay described in "Sharing with third parties". linqo does not record, store or access the content of sessions.

What is said and shown in the session is processed by the professional and the business, as controllers. If the session uses an external tool chosen by the professional, the terms and privacy policy of that tool apply.

12. Users outside Brazil

linqo serves businesses in Brazil and in other countries, is operated from Brazil and processes data in accordance with the LGPD. If the law of your country grants you additional data protection rights, they remain valid and may be exercised through the same channel.

13. Data protection officer and contact

The channel for contacting linqo’s data protection officer is support@uselinqo.com. Requests, questions and complaints about personal data should be sent there. The data protection officer is Vitor do Prado Ferreira.

14. Changes to this Policy

This Policy may be updated to reflect changes in the service or in legislation. The last-updated date at the top of this page always indicates the version in force, and material changes are communicated to active users.