Services
LGPD compliance
Privacy policy, consent, and data subject rights — without the headache.
How it works
Here's what it looks like in practice
Every platform launches with a privacy policy and a consent banner. From the Destaque plan up, compliance goes further, with granular consent, fulfillment of data subject rights, and automatic data retention — so the LGPD stops being a risk and becomes routine.
The problem
This is for you if…
Your website's privacy policy was copied from someone else's site
Yours will describe what your company actually collects, why, and how long it keeps it — generated from the platform's configuration, not from a generic template.
A customer asked you to delete their data and no one knows where it is
The admin panel finds the person across every module, exports what's on file, and anonymizes it when you say so — with a record of what was done, which is what the law requires.
You can't say what personal data your company holds today
The record of processing activities lists every processing activity: what data, for what purpose, on what legal basis, for how long, and who it's shared with. It's the first document the data protection authority asks for.
Résumés and form submissions from 2019 are still stored for no reason
Each type of data gets a retention period, and the system anonymizes it automatically when that period ends. Keeping data longer than necessary is a violation — and the easiest one to commit without noticing.
Honesty
This isn't for you if…
-
You want a guarantee that you won't be fined
No one can give that guarantee, and anyone who does is selling something they don't have. Before the data protection authority, responsibility lies with the data controller — which is your company. What we deliver are tools and evidence: the documents exist, the records exist, and decisions can be traced.
-
You want to bring your entire company into compliance, not just the platform
This service covers the data processing that runs through the platform — pages, forms, leads, newsletter, résumés. Employment contracts, medical records, records in internal systems, and clean desk policies are a corporate compliance project, handled with a lawyer and a consultancy. That's not what we do.
-
You want us to be your Data Protection Officer (DPO)
The DPO holds a position of responsibility that requires knowing how the company operates and answering for it. The platform publishes the channel and contact details of whoever you appoint — but the appointment is yours to make.
-
You want a cookie banner just to get the notice off the screen
The banner exists to record a choice, and that choice has to be respected: declining tracking must actually turn tracking off. If the idea is to keep the scripts running no matter what, the banner becomes evidence against you, not in your favor.
Scope
What's included
Privacy policy, generated and kept up to date
The text describes what your company really does
Technical detail
Written based on what the platform actually collects, and updated whenever the configuration changes. Not a copied text that goes stale in the footer.
Cookie consent by category
Anyone who declines tracking isn't tracked
Technical detail
Visitors accept or decline by purpose — necessary, analytics, marketing — and the scripts respect that choice. Declining measurement turns measurement off.
A record of every consent
You have the proof, with date and time, if anyone asks for it
Technical detail
The date, time, network address, and the exact text the person agreed to are all stored. Consent without proof of when it was given doesn't count as consent.
Published data subject request channel
The legal obligation comes ready to go, on any plan
Technical detail
A page where anyone can exercise their rights under Article 18 — access, correction, deletion, portability, and withdrawal of consent. Included in every plan, no exceptions: it's a legal obligation, not a feature.
Legal basis recorded in forms
Every piece of data collected has a recorded reason
Technical detail
Every form on the platform states the purpose of the collection and stores the person's agreement alongside the data. That's what separates a legitimate lead from data collected without legal grounds.
Record of processing activities
You have the document inspectors ask for first
Technical detail
The document that lists every processing activity involving personal data on the platform: purpose, legal basis, data subject categories, retention period, and sharing. It's the first thing the data protection authority asks for in an inspection. Available on the Destaque plan.
Data subject rights fulfilled from the admin panel
A deletion request becomes a matter of minutes
Technical detail
Find the person across every module, export everything on file about them, anonymize or unsubscribe them — all on one screen, with the action logged. Available on the Destaque plan.
Automatic time-based retention
Old data leaves the system without anyone having to remember
Technical detail
Each type of data gets a retention period, and the system anonymizes it automatically when that period ends. No more relying on someone remembering to clean house. Available on the Destaque plan.
Printable compliance report
You show compliance on paper, not in promises
Technical detail
A document showing where your compliance stands — what's configured, what's missing, the consents on record, and the requests fulfilled. Ready to present to a customer, an auditor, or your own board. Available on the Destaque plan.
Audited personal data exports
No one takes data out of the system without leaving a trace
Technical detail
Every time personal data leaves the system — exporting leads, downloading a résumé — it's logged with who did it, when, and how many records were involved. Never with the content in plain text in the log.
Specifications
Technical specs
- Privacy policy
- All plans Generated from the platform's actual configuration and republished whenever the configuration changes.
- Cookie consent
- Granular By purpose category, with the choice respected by the scripts and recorded with date and time.
- Data subject request channel (Art. 18)
- All plans Included in every plan. Never charged separately, because it's a legal obligation of the controller.
- Record of processing activities (RoPA)
- Destaque plan A document listing the purpose, legal basis, data subject categories, retention period, and sharing for each processing activity.
- Time-based retention
- Destaque plan Automatic anonymization when the period ends, run by a scheduled routine. Stops applying if the plan is downgraded.
- Depth on the Autoridade plan
- Same as Destaque Identical to Destaque. There's no compliance layer exclusive to the most expensive plan.
- Files containing personal data
- Restricted access Résumés and attachments are kept off public URLs: they can only be retrieved through authenticated access, and the download is logged.
From sign-up to launch
How we deliver
-
Mapping what your company collects
one conversation with youWhat data comes in through the platform, through which forms, for what purpose, and who inside the company needs access to it.
-
DPO and contact details defined
you appoint the personWho answers for the data at your company, and the address that will be published so data subjects can reach out. You make the appointment; we handle the publishing.
-
Documents generated and published
you approve the textPrivacy policy, cookie notice, and the data subject request channel go live — written from the mapping, not from an off-the-shelf template.
-
Retention periods defined
you set the retention periodsHow long each type of data is kept, and why. This is the decision that turns automatic retention into policy rather than an arbitrary rule.
-
Team trained to handle data subject requests
half an hour of your team's timeWhat to do when an access or deletion request comes in, how quickly to respond, and where to record it. The law holds you to the response deadline, not to good intentions.
-
Compliance reviewed on a recurring cycle
nothing needed from youThe report is redone every period, the policy is revisited whenever something changes, and fulfilled requests stay on record.
How to get it
Included from the Presença plan up
-
Starts here
Presença
R$ 249/month
includes this serviceThe foundation every platform needs
Privacy policy, cookie consent by category with records, legal basis on forms, and a published data subject request channel. It's the legal minimum, and it's not optional on any plan.
-
Destaque
R$ 799/month
includes this serviceFull compliance, with documentary proof
Everything in Presença, plus the record of processing activities, data subject rights fulfilled from the admin panel, automatic time-based retention, and the printable compliance report.
-
Autoridade
R$ 1,499/month
includes this serviceThe same compliance as Destaque
When it comes to compliance, Destaque and Autoridade are identical — and saying so is a deliberate choice on our part. If you need legal protection, you don't have to buy the most expensive plan; what sets Autoridade apart is presence in AI answers, not the LGPD.
The policy, banner, and consent by category are part of the Presença plan. RoPA, automatic retention, and fulfillment of data subject rights come with Destaque — and Autoridade offers the same depth.
What's ready
In the first month, you already have
Your privacy policy, published
Live, linked in the footer, and written based on what your platform actually collects.
A cookie banner that works both ways
Accepting turns the scripts on, declining turns them off — tested, not just installed.
The data subject request channel, live
With the DPO you appointed and the published contact address, as the law requires.
The record of processing activities, filled in
On the Destaque plan, the document is ready in the first month — not a blank form waiting for someone to fill it in.
Retention periods configured
Each type of data with its own retention period, decided with you and already running — not a setting left to sort out later.
The first compliance report
The starting snapshot: what's resolved, what's missing, and what depends on a decision from you. It serves as the baseline for the reports that follow.
Before you sign up
Frequently asked questions
No. The foundation — privacy policy, consent, records, and the data subject request channel — is part of the Presença plan, at R$ 249 per month. The complete layer, with the record of processing activities, automatic retention, rights fulfillment, and the report, comes with Destaque, at R$ 799 per month. There's no separately billed LGPD project.
No. When it comes to compliance, Destaque and Autoridade deliver exactly the same thing. What Autoridade adds is presence in AI tools — nothing related to the LGPD. We could push the higher plan by playing on the fear of fines; we'd rather tell you where compliance ends.
No — and no platform provider can. Before the data protection authority, the one accountable is the data controller: your company. What we do is deliver the tools and records that support your defense: published documents, consents with date and time, and a history of what was done.
For what runs through the platform, no. For your company as a whole — contracts, payroll, medical records, suppliers, internal policies — yes: that's corporate compliance, and it requires someone who knows your industry. We're the digital layer of that compliance, not all of it, and it's better that you know that now.
Whoever you appoint. It can be a partner, someone from your administrative staff, or an outside professional hired for the role. The platform publishes that person's name and contact channel, as the law requires — but the choice belongs to the company, because the company is the one accountable.
It has an expiration date. On the Destaque plan, automatic retention anonymizes the personal data once the period you set runs out. Keeping résumés indefinitely with no purpose is one of the most common violations — and one of the easiest to avoid.
Automatic retention stops running, and the record of processing activities and rights fulfillment from the admin panel are no longer available — the foundation stays. That's by design: a paid capability that kept working after a downgrade would be delivering without charging. Your data stays, and everything comes back if you upgrade again.
They're never kept at a public URL: they're only served to people logged in to the admin panel with the right permissions, and every download is logged. A personal data file reachable through a direct link is a leak waiting to happen.
We also do
Other areas of our work
Online presence on our own platform
Your business online, easy to find, and well maintained — on the OneRank platform, not a generic website builder.
SEO and presence in AI answers (GEO)
Traditional rankings on Google and presence in the answers AI tools give.
Content and publishing
A blog, FAQs, and pages that grow on their own — with content production included from the Destaque plan up.
Next step
Is it right for your business?
We look at your situation and tell you whether this is the right place to start — or which one would be.
Prices published on the platform, no "contact us for pricing".