Last updated: October 19, 2026
Welcome to Plendoro, a platform operated by Vision Tech Ltda, a Brazilian company registered under CNPJ 42.756.860/0001-08, with its registered office at R. João Batista da Motta, 79, Marajoara, Teófilo Otoni/MG, 39.803-144, Brazil ("we", "us"). This policy explains how we collect, use, share and protect your personal data, in line with Brazil's General Data Protection Law (LGPD) and, for users in the European Economic Area or the United Kingdom, the GDPR.
Vision Tech Ltda is the controller of the personal data processed to run Plendoro.
If you are a customer of a business that uses Plendoro (you bought from a store, booked an appointment, received an invoice or signed in to the customer area of a website built on the platform), that business decides how your data is used and is the controller; we process it on its behalf as a processor. The privacy policy that applies to you is the one published on that business's website, and your requests should go to that business. If you need help, write to support@plendoro.com and we will forward your request.
We only use cookies that are essential for the service to work, such as the one that keeps you signed in. We do not use advertising or tracking cookies.
On our marketing site (plendoro.com) we measure visits with Cloudflare Web Analytics, which uses no cookies and does not identify visitors, and we count clicks on call-to-action buttons per day without storing IP addresses or any personal data. On the sign-up and password reset forms we use Cloudflare Turnstile to keep bots out.
We process your data to perform our contract with you, to comply with legal obligations, on the basis of our legitimate interest in running, securing and improving the service, and with your consent where required (for example, product news by email). We use it to:
We do not sell your personal data. We share it only with the following sub-processors, strictly to provide the service and under contractual confidentiality and security obligations:
| Sub-processor | Purpose | Country |
|---|---|---|
| Amazon Web Services | Servers, database and files | Brazil (São Paulo) |
| Stripe | Payments and subscriptions | United States and Ireland |
| OpenAI | Artificial intelligence features (websites, text and images) | United States |
| Cloudflare | DNS, protection against attacks and bots, cookieless analytics | United States |
| Brevo | Sending emails | France |
| Calendar integration, when you turn it on | United States | |
| Sentry | Technical error diagnostics, without personal data by default | United States |
We may also disclose data when required by law, to enforce our policies, to protect our rights, or in connection with a merger, acquisition or sale of assets.
Our servers, database and files are in Brazil. Some sub-processors process data in other countries, mainly the United States, under contractual safeguards with each provider. Transfers of data from the European Economic Area or the United Kingdom to Brazil and to these providers rely on the safeguards each provider offers and, where none applies, on the transfer being necessary to perform our contract with you. You can ask us for more information about these safeguards.
The Google Calendar integration is optional and only turns on when you connect your Google account on the online booking page. When you connect, we request only these scopes:
openid and email: to identify which Google account was connected.https://www.googleapis.com/auth/calendar.freebusy: to read the times you are busy.Data accessed. We read only your Google email address and the time ranges marked as busy (start and end). We do not access event titles, descriptions, locations, attendees or any other event content, and we never create, change or delete events in your calendar.
Use. Busy times are used only to hide, on your online booking page, the slots where you already have a commitment, so you are not double-booked. These ranges are cached temporarily for at most 5 minutes and are not written to our database.
Storage. We keep the connected Google account's email and the OAuth access tokens, the tokens encrypted, while the integration is active.
Sharing. Data received from Google is not sold, not shared with third parties, not used for advertising and not used to train or improve artificial intelligence models. No person reads this data, except with your explicit consent, when needed for security, or to comply with the law.
Revoking and deleting. You can disconnect Google Calendar in Plendoro at any time. When you disconnect, we revoke access with Google and delete the stored email and tokens. You can also revoke access at myaccount.google.com/permissions.
Plendoro's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We apply appropriate technical and organisational measures, such as encryption, permission-based access and private files served only to those allowed to see them. No method of transmission or storage is 100% secure.
You have the right to access, correct, delete and port your data, to object to or restrict certain processing, to withdraw consent at any time, and to know who we share your data with. You can also complain to the Brazilian Data Protection Authority (ANPD) or to the data protection authority where you live.
We may update this policy from time to time. The current version is always the one on this page, with its last-updated date at the top. We will email you about material changes.
For questions or to exercise your rights, contact our data protection officer: