Privacy

Who we are

One Page Sell is made by Kelvin Arnold Flores Ticona Consultoria em TI, CNPJ 32.116.846/0001-88, trading as Not Products, at Avenida Paulista 777, andar 15, conjunto 15, sala 2173, Bela Vista, São Paulo — SP, 01311-914, Brazil.

This page covers onepagesell.com and the app you log into. Brazil’s data protection law, the LGPD, governs it.

We are a small company, so there is no privacy department here. There is a person, and an address that reaches him: support@onepagesell.com. Everything below can be asked about there.

What we collect, and why

Three different things happen, and they are worth separating.

Reading this website. Nothing is tracked until you say yes to the cookie card. If you accept, we record which pages were opened, which buttons were clicked, the site you came from, and an approximate city from your IP address. If you decline, none of that is collected and the page works exactly the same. Separately, our host records ordinary server logs — IP address, time, which file was requested — because that is how a web server works. It is kept for a short period and used to keep the site up and to block abuse.

Writing to us. The contact form asks for your name, your email, what the message is about, and the message itself. We use them to answer you. Your IP address is checked against a short-term counter so one person cannot flood the form; that counter holds no message content and is discarded quickly. The body of your message is never written to a log. It is saved to a spreadsheet in our Google Workspace account and emailed to our team, which is how it reaches a person. Before it is sent, it goes through the bot check described below.

The bot check. On the contact form, and when you sign up or log in to the app, Cloudflare Turnstile checks that a person is there rather than a script. In the app it runs invisibly — there is nothing to click. It looks at your IP address, your browser’s user agent, how your browser sets up its secure connection (its TLS fingerprint), and which of our pages asked for the check. It does not read what you type, and these signals do not tell it who you are. Cloudflare runs the check for us. It also uses the same signals, under its own responsibility, to improve its bot detection; its Turnstile privacy addendum explains that part. Questions or requests about the check come to us, at support@onepagesell.com.

Having an account. Your name and email, your password (stored scrambled — we never see it), your salon’s details, your team’s logins and roles, your working hours, services and prices, and everything you enter about your clients. Payment is handled by Stripe: card numbers go to them, never to us, and we see only what is needed to bill you and show you an invoice.

We use account data because we cannot run the service without it — that is the contract between us. We use the security and anti-spam signals because a service that cannot defend itself is not a service. We use analytics only if you consented, and only until you take that consent back. We do not sell any of it, and we do not use what is in your account to train AI models.

Your clients’ data, and who’s responsible for it

There are two different sets of people in here, and they aren't treated the same way.

The short version: the people who sit in your chair are your clients, not ours. You decide what to write down about them. We hold it, keep it safe, and do what your account tells us to do with it — nothing else.

That has a practical consequence. If one of your clients wants to know what you hold about them, or wants it corrected or erased, they ask you, not us. The product gives you the tools to answer. If they write to us instead, we will pass the request to you and tell them we have done so.

Who else touches it

We use other companies to run parts of this. Here's all of them and what each one sees.

That is the whole list, not a sample. Rows marked as add-on only receive nothing at all unless you have switched that add-on on — if you never turned on WhatsApp, no client phone number has ever reached Kapso.

When we add or replace a service, this list changes before the service goes live, so the page is never behind the system it describes.

Where it lives and how long we keep it

Your data is stored with Supabase in the United States, and served through Cloudflare’s network. Messages sent through this website’s contact form are held in Google Workspace, also outside Brazil. This means personal data leaves Brazil.

The United States is not on the ANPD’s list of countries with an adequate level of protection. Transfers there are allowed under article 33 of the LGPD when the ANPD’s standard contractual clauses are in the contract with the company that receives the data. Those clauses are the ones published in Resolution CD/ANPD nº 19/2024. That is the safeguard we use with each company on the list above that stores or processes personal data outside Brazil. Write to support@onepagesell.com if you want a copy.

How long we keep things:

• While your account is open, we keep what is in it, because that is the product.
• After you cancel, 30 days. That window exists so you can come back or export your data. When it closes, your account and your clients’ records are deleted.
• Messages sent through the contact form, up to 12 months; then they are deleted from the spreadsheet and from our inbox.
• Invoices and tax records are kept longer, for as long as Brazilian tax and commercial law requires us to keep them. They contain billing details, not your clients’ records.
• Backups. Database backups are overwritten on a rolling 7-day window, which is the current hosting plan. Something deleted from the database can therefore survive in a backup for up to 7 days. Photos and other files in storage are not part of those database backups — once deleted there, they are gone.

Your rights, and how to use them

The LGPD gives you the right to ask us:

• whether we hold data about you at all, and to see it;
• to correct anything wrong or incomplete;
• to anonymise, block or delete data that is unnecessary, excessive, or being handled in a way the law does not allow;
• to delete anything we hold only because you consented to it;
• for a copy of your data in a portable form — ask us and we will put it together for you;
• who we have shared it with;
• what happens if you refuse consent, before you decide;
• to take back a consent you gave, including the analytics one;
• and to have a decision made about you reviewed, if one is ever made automatically.

Write to support@onepagesell.com and say which of these you want. It costs nothing. We will confirm quickly whether we hold anything, and give you the full answer within 15 days. If a request needs longer because it is unusually broad, we will say so and say why rather than going quiet.

If you are a client of a salon that uses One Page Sell, these same rights apply — but the salon answers them, because the salon decides what is stored. Ask them.

If you think we have handled something badly, tell us first — we would rather fix it. You can also complain to Brazil’s data protection authority, the ANPD.

Photos and consent

The photo and formula book is the part of the product that holds the most personal material: pictures of a person’s face and hair, and the record of what was done to it.

Those photos are taken by you, in your salon. Getting your client’s permission before saving one is your job, not ours, and the law puts that duty on you as the person who decides to collect it. The product gives you somewhere to record that permission against the client, so that months later there is an answer to the question of whether it was given.

What we do on our side: photos are stored privately, not on any public address, and are never used in our marketing, on our website, or anywhere else. They are not used to train models. When a client record is deleted, the photos filed against it go with it.

Cookies and analytics

One cookie is set before you choose anything, and only because you chose: it remembers whether you said yes or no, for 180 days, so we stop asking. Nothing else loads until you answer, and if you answer no, nothing else loads at all.

If you pick a language with the language switcher, a second cookie remembers it for a year, so we keep showing that language instead of the one for your country. It holds the language and nothing else.

To show prices in your currency and the site in your language the first time you visit, we read the country your connection comes from, as our host reports it. It is used for that page and not stored.

Say yes and PostHog receives usage events — which pages, which buttons, an approximate city. Say no and it is never loaded. Both buttons are one click and the same size, on purpose.

To change your mind, use Change cookie choice in the footer of any page. The card will ask again. That is one click, the same as the first time.

How to reach a person

Email support@onepagesell.com, or use the contact page. It reaches a person, not a queue, and you will get a reply.

Post reaches us at Avenida Paulista 777, andar 15, conjunto 15, sala 2173, Bela Vista, São Paulo — SP, 01311-914, Brazil.

The date at the top of this page is the last time it changed. If we change something that affects what we do with your data, we will tell account holders by email before it takes effect — not by quietly editing this page.