🔒Legal

Privacy Policy

Last updated: January 2026

This Privacy Policy describes how we collect, use, store, and protect your personal information, in compliance with the Brazilian General Data Protection Law (LGPD - Law No. 13.709/2018).

🏢

1. Data Controller

OneckPass Tecnologia Ltda.

Email:privacidade@oneckpass.com

DPO:dpo@oneckpass.com

📊

2. Data We Collect

Data Provided by You

Email: For authentication and communication
Name: For service personalization
Payment data: For purchase processing

Automatically Collected Data

IP address: For security and fraud detection
Device type: For compatibility and support
Access date/time: For security and auditing

Vault Data (Encrypted)

🔐

IMPORTANT: Your passwords, secure notes, cards, and identities are encrypted on your device. We do not have access to this data in plain text. We store only encrypted blobs.

🎯

3. How We Use Your Data

✓Provide the service

✓Process payments

✓Send service communications

✓Security and fraud detection

✓Improve the service (anonymous analytics)

✓Comply with legal obligations

✕What We Do NOT Do

We do NOT sell your data
We do NOT share for advertising purposes
We do NOT access your encrypted data
We do NOT profile for marketing

🤝

4. Data Sharing

We share data only with:

Payment processor (for billing)
Infrastructure provider (hosting)
Authorities (when legally required)

Even in case of a court order, your vault data remains encrypted and unreadable.

🛡️

5. Data Security

🔒AES-256-GCM encryption for vault data

🔒Argon2id for key derivation

🔒TLS 1.3 for transmission

🔒At-rest encryption in database

🔒Encrypted backups

🗓️

6. Data Retention

Account data: While account is active
Security logs: 2 years
Payment data: 5 years (tax obligation)
Data after deletion: 30 days (backup)

⚖️

7. Your Rights (LGPD)

Under LGPD, you have the right to:

★Confirmation and Access: Know if we process your data and obtain a copy

★Correction: Correct inaccurate data

★Anonymization/Deletion: Request anonymization or deletion

★Portability: Receive your data in structured format

★Revocation: Revoke consent at any time

To exercise your rights, email privacidade@oneckpass.com. We will respond within 15 days.

🍪

8. Cookies

Session: For authentication (duration: session)
Preferences: For settings (duration: 1 year)
Analytics: For product improvement (duration: 1 year)

🔐

9. Zero-Knowledge Architecture

Our architecture means that even in case of:

✓Court order: We hand over only encrypted blobs

✓Server breach: Unreadable data

✓Malicious employee: No access to content

🔄

10. Changes

We may update this Policy. Significant changes will be communicated by email and notice in the application.

📧

Contact

Privacy questions:

📩privacidade@oneckpass.com

Data Protection Officer (DPO):

📩dpo@oneckpass.com

ANPD:

If you are not satisfied with our response, you can contact the National Data Protection Authority at

🔗gov.br/anpd