Privacy policy

It applies to website visitors, clients who book services through the platform, and professionals and businesses that use Horanza to run their business.

We are the controller of your account data, subscription billing and website usage.

When a business records information about its own clients (bookings, service history, tabs, notes), the business is the controller and Horanza acts as the processor, handling that data only to provide the contracted service. Requests about that data should go to the business first; we help whenever needed.

We only collect what the platform needs to work:

• Account: name, email and profile photo received from Google or Facebook when you choose to sign in with them, and the language you browse in, used to send your notifications in that language.
• Contact: your account email, used to send confirmations, reminders and notices about your bookings, and the phone number and email given to the establishment.
• Bookings: service, professional, date, time, status and notes.
• Businesses: name, description, address and map location, opening hours, images, social links and team details.
• Payments: subscription and customer data at Stripe. Card numbers are processed by Stripe and never stored by us.
• Notifications: your browser’s push subscription, when you allow notifications.
• Technical and security data: IP address, browser, operating system, email and device signals (such as screen, time zone, fonts and graphics capabilities), collected on the sign-in screen and in the signed-in area, used to keep your session and prevent fraud, bots and sign-in attacks.

Each use relies on a legal basis under article 7 of the LGPD:

• Creating and keeping your account, handling bookings and running the business dashboard — performance of a contract.
• Sending confirmations, reminders and notices about your bookings to your account email and, when you allow it, by push notification. These are essential service notices and need no activation — performance of a contract.
• Charging subscriptions and issuing tax documents — performance of a contract and legal obligation.
• Protecting accounts, detecting abuse and keeping access logs — legitimate interest and legal obligation (Brazilian Internet Civil Framework).
• Improving the platform with aggregated usage data — legitimate interest.
• Sending promotional messages — only with your consent or where the law allows, always with an unsubscribe option. The link in these messages records whether it was clicked and whether it led to a booking, so the business can measure the campaign’s result.

We do not sell personal data. We only share what is necessary with:

• The business you book with, which receives your contact and booking details.
• Stripe, to process subscription payments.
• Vercel, to host the platform and store images.
• Google Maps Platform, for address search and maps.
• Google and Facebook, only when you choose to sign in with them.
• Your browser’s notification services, to deliver push notifications.
• Resend, to send confirmation, reminder, waitlist, team invitation and campaign emails.
• Better Auth (Better Auth Infrastructure), to detect fraud, bots and sign-in attacks, receiving IP address, email and device signals.
• Public authorities, when required by law or court order.

Some of these providers process data outside Brazil, mainly in the United States. These transfers follow article 33 of the LGPD, with contractual safeguards compatible with Brazilian law.

We keep data while your account is active or while it is needed for the purpose it was collected for.

When an account is closed, its data is deleted or anonymized, except what the law requires us to keep — for example, access logs for 6 months (Brazilian Internet Civil Framework) and tax records for the period required by tax law.

Under article 18 of the LGPD, you may request at any time:

• Confirmation that we process your data, and access to it.
• Correction of incomplete, inaccurate or outdated data.
• Anonymization, blocking or deletion of unnecessary data or data processed unlawfully.
• Portability of your data to another provider.
• Deletion of data processed based on your consent.
• Information about who we share your data with.
• Withdrawal of consent and objection to processing based on legitimate interest.

Send your request to contatoappagenda@gmail.com from the email registered on your account. We may ask for additional information to confirm your identity before acting on it, to protect you.

We reply within the period set by the LGPD. If you are not satisfied, you can also file a complaint with Brazil’s National Data Protection Authority (ANPD).

We use encrypted connections (HTTPS), short-lived sessions, access control per business and per team role, protection against repeated sign-in attempts, and processing of uploaded images that strips metadata such as location.

If a security incident could cause relevant risk or harm, we will notify the ANPD and the affected people, as required by article 48 of the LGPD.

The platform is not intended for people under 18. Bookings for children and teenagers must be made by a parent or legal guardian, from their own account.

We only use necessary cookies. See our cookie policy for the details.

Cookie policy

Horanza’s data protection officer (DPO) can be reached at contatoappagenda@gmail.com, with the subject "Privacy - LGPD".

We may update this policy to reflect changes to the platform or the law. The last update date is shown at the top of the page and, for relevant changes, we will let you know in the platform or by email.