01Who we are and where this policy applies
OneTik is a scheduling platform for businesses that run on appointments: barbershops, clinics, salons, studios and practices. It brings together a calendar, an artificial-intelligence secretary that answers customers on WhatsApp, reminders, a point of sale, subscription plans and payments.
This policy explains what happens to data in:
- the onetik.io website and the OneTik dashboard;
- the OneTik app for iPhone and Android;
- each business's public booking page;
- the WhatsApp conversations a business handles through OneTik, including the ones answered by the AI secretary.
We wrote this in plain language on purpose. If any part is unclear, write to [email protected] and we will explain.
02Business and customer: who is responsible for what
There are two kinds of people in this policy, and the law treats each one differently.
- Professional. The person who signs up for OneTik, opens the dashboard or the app and serves their own customers. For the data of your account, OneTik is the controller: we decide how that data is handled.
- End customer. The person who books an appointment, pays for a service or chats on WhatsApp with a business that uses OneTik. In that case, the business serving you is the controller of your data. OneTik is the processor: we store and process that data on the business's behalf, following its instructions and this policy.
In practice: if you are a customer of a barbershop that uses OneTik, the barbershop decides whether to keep or delete your record. We give it the tools to do so and help you reach it when you need to.
03What data we collect
We collect only what the platform needs in order to work.
From the professional and the business
| Data | Where it comes from | What for |
|---|---|---|
| Name and phone number | Entered when the account is created | Identify you and sign you in with a code sent on WhatsApp |
| Optional, entered by you | Contact about the account and billing | |
| Profile photo, biography and social links | Optional, uploaded by you | Appear on the business's booking page |
| Business data | Name, address, opening hours, services, prices and logo | Build the calendar, the booking page and the secretary's answers |
| Push notification token | Generated by the device when you allow notifications in the app | Notify you about bookings, messages and charges. Stored with the platform, the device model and the app version |
| OneTik subscription data | Plan, billing cycle, payment status | Charge the subscription. The card number stays with Stripe or Mercado Pago only, never on our servers |
| Activity logs | Actions taken in the dashboard, with date and author | Security and the business's own audit trail (who changed what) |
From the end customer
| Data | Where it comes from | What for |
|---|---|---|
| Name and phone number | Entered by the business, by the booking page or taken from the WhatsApp display name | Identify the customer, book and send reminders |
| E-mail and birthday | Optional, entered by the customer or the business | Contact and actions by the business, such as birthday greetings |
| Profile photo | Public WhatsApp photo | Show the conversation in the business's dashboard |
| WhatsApp conversations | Messages exchanged with the business: text, audio, photos, videos, documents, stickers, location and shared contacts | Serve the customer, whether by a person or by the AI secretary, and keep the service history |
| Uploaded files | Exams, prescriptions and other documents sent in the conversation | Stay on the customer's record for the professional to consult |
| Business's notes | Remarks the professional writes about the customer | Remember preferences and history |
| Appointments | Service, professional, date, time and status | Honor the appointment, notify and charge |
| Payments and subscriptions | Amount, method, status and the plan contracted with the business | Record what was paid. Card data stays with Mercado Pago only |
Technical data
When you access the website, the dashboard or the app, we log the IP address, the device and browser type, the app version and any errors that happen. We use that for security and to fix problems. We do not use advertising cookies or third-party trackers. The browser keeps only your session and preferences, such as the light or dark theme.
04What we use the data for
- Provide the service. Book, confirm, reschedule and cancel appointments; send reminders; record sales and subscriptions; issue charges.
- Serve customers on WhatsApp. Show the conversations to the business and let the AI secretary answer when the business turns that feature on.
- Notify you. Notifications on WhatsApp or by push in the app about bookings, messages and payments. Each professional chooses which notices to receive.
- Integrate with Google Calendar. Only if the professional connects their own account. The connection can be undone at any time in the dashboard.
- Security. Authenticate access, prevent fraud and misuse, record who did what.
- Legal obligations. Keep tax and payment records for as long as the law requires.
- Improve the product. Assess the quality of the secretary's answers and fix mistakes. We do that by looking at how the system behaves, not to build customer profiles.
We do not sell data. We do not use conversations or records for advertising and we do not build profiles for third parties.
05How the AI secretary handles conversations
When the business turns the AI secretary on, messages received on WhatsApp are sent to an artificial-intelligence provider to generate the reply. Today that provider is OpenAI.
- Text messages go along with the conversation context, the business's records and the knowledge base the business wrote.
- Audio messages are transcribed to text by the same provider before being answered.
- Images and documents may be analyzed to identify what they are, for example an exam, and file them on the customer's record.
The provider is contracted through its business interface, which does not use the content sent to train its models. The secretary answers only with what is in the business's records and knowledge base, and the business can take over the conversation at any time.
06Recording of appointments
The business can turn the recording of appointments on. It comes turned off. With it on, an appointment can be recorded in two ways: the professional records from the dashboard or the app, in an in-person appointment, or the recording joins the Google Meet room, in an online appointment.
- Notice and authorization. In an online appointment, the confirmation and reminder messages say it will be recorded, the recording joins the room under a name that says it records and writes so in the room's chat. In person, the professional confirms that you authorized it before starting. You can ask not to be recorded at any time.
- What is done with the audio. It is transcribed by the same artificial-intelligence provider, and the transcript becomes the summary of the appointment, notes on your record and, in health businesses, a draft of the patient record that the professional reviews before it counts.
- Who listens. Nobody. The audio cannot be played or downloaded by anyone, the business included.
- For how long. The audio is deleted 7 days after it was recorded. The summary and the transcript stay with the business, like the rest of the service history.
07Who we share data with
We share data only with those who need it for the platform to work, and only the necessary part.
| Who | What they receive | Why |
|---|---|---|
| The business serving you | Everything you share with it: records, conversations, files, appointments and payments | It provides the service and controls that data |
| Meta (WhatsApp) | The messages sent and received | It is the channel the conversation happens on |
| OpenAI | Text, audio and image messages from conversations handled by the AI secretary; the audio and the transcript of recorded appointments | Generate replies, transcribe audio and write the summary of the appointment |
| Amazon Web Services | Files, photos, audio and video from conversations, profile photos and logos; the audio of recorded appointments, for 7 days | File storage |
| Mercado Pago and Stripe | Name, e-mail, amount and description of the charge | Process payments. They keep the card data; we do not |
| Appointments, if the professional connects Google Calendar; the business's address to place it on the map | Calendar integration and location on the booking page | |
| Expo, Apple and Google (Firebase) | Notification token and the text of the notice | Deliver the app's push notifications |
We may also share data when a law, a court order or a competent authority requires it, always within the limits of what is requested.
08How long we keep data
We keep each piece of data only while it has a purpose. After that, we delete it or make it anonymous.
| Data | Retention |
|---|---|
| Professional's account | While the account exists. After a closure request, deleted within 30 days |
| End customer's record | While the business keeps you as a customer. When the business removes you, the link and the AI secretary's memory of you at that business are deleted immediately |
| WhatsApp conversations, audio, photos and files | While the business's account exists, to keep the service history. Deleted within 30 days after the account is closed or on request |
| Appointments | While the business's account exists, because they are part of its history and revenue |
| Audio of recorded appointments | 7 days after it was recorded. After that it is deleted |
| Summary and transcript of recorded appointments | While the business's account exists. Deleted within 30 days after the account is closed or on request |
| Reminders sent | 30 days after sending. Then deleted automatically |
| Push notification token | Until you sign out of the app or remove the device. Tokens that stop working are discarded |
| Payment and billing records | 5 years, as required by tax and other law |
| Activity logs and technical data | Dashboard activity logs while the account exists. Technical data for a short period, only for security and diagnostics |
Deleted data may remain in backups for a limited period, until those backups are rotated. Backups are not used to restore data you asked us to delete.
09How to delete your data and exercise your rights
Brazil's General Data Protection Law (LGPD) gives you the right to know what data we hold, correct it, request a copy, request deletion, withdraw consent and know who we share it with.
If you are a professional
- Name, e-mail, photo and other profile data can be edited directly in the dashboard.
- To close the account and delete everything, write to [email protected] from the registered e-mail or contact support on WhatsApp at +55 45 98812-5568 from the account's phone number. We verify identity through the registered phone before acting.
- Deleting the app from your phone does not close the account. Signing out of the app removes that device's notification token; to delete the account, use the contact above.
If you are an end customer
- Ask the business serving you directly. It can correct your record and remove you in the dashboard.
- If you prefer, write to [email protected] with the phone number used in the conversations and the name of the business. We forward the request to the business when it is the responsible party and help carry it out.
Deadlines. We answer any request within 15 days. Deletions are completed within 30 days after confirmation, except for data the law requires us to keep, such as tax records.
10App permissions
The OneTik app asks for permissions only when you use the matching feature. All of them are optional and can be revoked in the device settings.
| Permission | When it is used |
|---|---|
| Notifications | To notify you about bookings, messages and charges. Without it, notices arrive on WhatsApp |
| Microphone | Only when you record an audio message to send in a conversation or press Record on an appointment. An appointment is only recorded with the app on screen |
| Camera | Only when you take a photo to send in a conversation or to illustrate a service |
| Photos | Only when you pick an image from the gallery to send in a conversation or to illustrate a service |
The app does not access your location, your contacts or your gallery in the background.
11Children and teenagers
OneTik is made for businesses and adults. We do not create accounts for anyone under 18.
A business may serve children and teenagers, for example when a mother books appointments for her daughters. In that case the data is provided by the guardian and stays under the responsibility of the guardian and the business, as the LGPD requires.
12Security
- All communication with our servers is encrypted.
- Access to the dashboard and the app uses a one-time code sent on WhatsApp, so there is no password to leak.
- Within each business, what each person can see and do depends on their role (owner, administrator or professional).
- Data lives with cloud providers under access controls, and only the team members who need it have access to production.
No system is completely secure. If an incident could put you at risk, we will notify you and Brazil's National Data Protection Authority within the period set by law.
13International transfers
Some of the providers listed above, such as OpenAI, Amazon Web Services, Google, Meta and Stripe, may process data outside Brazil. When that happens, the transfer follows the safeguards set by the LGPD, with contractual clauses that bind the provider to protect the data to the same standard required here.
14Changes to this policy
When we change something relevant, we will announce it in the dashboard or by e-mail before the change takes effect. The date at the top of this page always shows the version in force.
15Contact
Questions, requests about your data and contact with the data protection officer:
- E-mail: [email protected]
- WhatsApp: +55 45 98812-5568
The rules for using the platform are in the Terms of Use.