This policy explains how we handle your personal data when you visit this website, book an appointment or talk to us. It follows Brazil’s General Data Protection Law (LGPD, Law No. 13,709/2018). The Portuguese version prevails in case of any difference.
Who is responsible for your data
The data controller is 68.289.006 MARIA NIELY ALVES OLIVEIRA, CNPJ 68.289.006/0001-64, trading as Niely Oliveira — Studio de Cílios, Av. Pedro Lazar, 633 — 1st floor, Lago Jacarey, Cambeba, Fortaleza — CE, 60822-170, Brazil.
Data protection officer (DPO): our data protection officer can be reached at saulo@zionn.io (LGPD art. 41). For anything about your data, write to that address or message us on WhatsApp +55 85 98961-4195.
What we collect and why
| Data | When | Purpose | Legal basis (LGPD, art. 7) |
|---|---|---|---|
| First name, last name and WhatsApp number | When you book | Reserve your time, confirm and discuss your appointment | Performance of a contract (V) |
| Service, date, time and language | When you book | Organize the schedule and prepare your appointment | Performance of a contract (V) |
| Deposit payment status and reference | When you pay | Confirm payment, deduct the deposit, issue refunds | Contract (V) and legal obligation (II) |
| Record of accepting the terms (date and version) | When you book | Prove what was agreed | Regular exercise of rights (VI) |
| Technical access data (IP, browser, date and time) | When you use the site | Security, fraud and bot prevention | Legitimate interest (IX) |
| Messages exchanged | When you write to us | Reply and provide the service | Performance of a contract (V) |
| Photos of your lashes | Only if you authorize it | Before-and-after portfolio | Consent (I) |
We do not collect card details: payment happens on InfinitePay’s platform. We do not use advertising cookies, tracking or browsing analytics.
Health information
Before your appointment you may tell us about allergies, sensitivities or eye conditions. This is sensitive data (LGPD, art. 11). We use it only to protect your health and safety during the procedure; the website neither asks for nor stores it.
Who we share data with
We never sell or rent personal data. It only passes through the providers needed to run the site and the service:
- Cloudflare: website hosting, booking database and bot protection (Turnstile) on the booking form.
- InfinitePay: deposit payment by Pix or card.
- WhatsApp (Meta): confirmation and conversations about your appointment, when you message us.
- Google: the map loads only if you click “Load map”; Google’s privacy policy then applies.
- Public authorities: when required by law or court order.
Some providers may process data outside Brazil; such transfers follow LGPD article 33, under the contractual safeguards they offer.
Storage in your browser
The site stores only your theme preference (light or dark) on your own device; it is never sent to us. Cloudflare’s verification widget may use technical storage it needs to work.
How long we keep data
- Bookings and payments: up to 5 years after your last appointment, the period in which they may be needed for tax obligations and to respond to consumer claims (Consumer Protection Code, art. 27).
- Holds that expired unpaid: deleted automatically after 6 months.
- Portfolio photos: while your authorization stands; if you revoke it, we remove the photo.
After these periods, data is deleted or anonymized.
Your rights
Under LGPD article 18 you may, at any time and free of charge:
- confirm whether we process your data and access it;
- correct incomplete, inaccurate or outdated data;
- request anonymization, blocking or deletion of unnecessary data or data processed unlawfully;
- request data portability;
- know who we share your data with;
- withdraw consent, such as for the use of photos;
- object to processing based on legitimate interest.
Write to saulo@zionn.io or message +55 85 98961-4195. We may ask you to confirm your identity to protect you, and we reply within 15 days. You may also file a complaint with Brazil’s data protection authority (ANPD).
Security
The site runs only over encrypted connections (HTTPS). The scheduling back office lives on a separate, login-protected address that only the studio’s professional can access. We collect the minimum data needed to book.
Minors
Online bookings must be made by someone aged 18 or over. Appointments for minors require authorization and the presence of a parent or legal guardian.
Changes to this policy
We may update this policy to reflect changes to the site or the law. The last update date is shown at the top, and every booking records the version in force when you accepted it.
See also the Booking Terms and Conditions.