This policy explains how OnEll processes the personal data of people who visit the store, contact us, create an account, or buy a bike. It also explains how you can access your data, correct information, and exercise your rights under Brazil's General Personal Data Protection Law (LGPD).
Who is responsible for your data
OnEll is the controller of the data used to operate this store and serve its customers. Company identification and contact channels are provided on this page. For privacy matters, email suporte@onell.com.br or use the support form. Indicate that your request concerns data protection.
You do not need to create an account, buy a product, or accept advertising to make a request. Support forwards the request to the person responsible for data processing at the company.
What data we use and why
| Situation | Data used | Purpose and legal basis |
|---|---|---|
| Visiting the store | Technical access information, device details, requested pages, and necessary preferences | Delivering the website, maintaining security, and preventing abuse; compliance with legal obligations and legitimate interests, subject to necessity and proportionality |
| Account and authentication | Name, email, protected credentials, and authentication records | Creating and protecting the access you request; performance of a contract and steps taken at your request |
| Orders and delivery | Name, email, phone number, CPF or CNPJ, address, items, amounts, and order status | Processing purchases, issuing documents, delivering products, and providing assistance; performance of a contract and legal obligations |
| Payment | Transaction identifiers, amount, payment method, and provider response | Charging, confirming, reconciling, or refunding the order; performance of a contract and legal obligations |
| Support, warranty, and returns | Contact details, order number, account of the issue, and relevant documents | Responding to and resolving your request; steps taken at your request, compliance with obligations, and the regular exercise of rights |
| Reselling | Contact name, company, CNPJ, city, and submitted business information | Assessing the application and preparing a proposal; preliminary steps toward a contract requested by the interested party |
| Email updates | Email address and record of your choice | Sending content you have authorized; separate, optional consent |
| Analytics and advertising | Browser identifiers and browsing and purchase events | Measuring store usage or personalizing advertising, according to the categories you allow; consent |
Required fields are identified in forms. Without the information necessary for a purchase, delivery, or order identification, we may be unable to complete the requested operation. We do not request health data for purchases; avoid including it in messages when it is unnecessary for support.
Accounts, payment, and security
Account access operates through Supabase Auth. When you choose to sign in with Google and the option is available, we receive identification data authorized through that authentication, such as your name and email. OnEll does not receive your Google password.
Payments are processed by the provider shown during the purchase. For card payments, the provider's protected fields generate a transaction identifier; OnEll's order records do not store the full card number or security code.
We use encrypted connections, role-based access control, enhanced authentication for the staff portal, and operation logs. No system is immune to incidents. If an incident requires legal notification, affected individuals and the competent authority will be informed under the applicable rules and deadlines. Never send your password or authentication code to support.
Who may receive your data
Sharing is limited to what is necessary for the stated purpose:
- Vercel and Supabase: hosting, database, authentication, and store infrastructure.
- Mercado Pago: payment processing, transaction assessment, and refunds, when used for the purchase.
- Delivery services and Melhor Envio: quotes, transportation, and order tracking, when the service is selected. Postal code address lookup uses ViaCEP.
- Resend or the email service configured for the store: authentication messages, support, and transactional updates, when sent.
- Google Analytics and Google Ads: only when the tools are active and you allow the respective cookie category. Advertising consent is separate from analytics consent.
- Mercado Livre: information needed for purchases and support through that channel, when integrated. The marketplace's own rules also apply to use of its platform.
- Support providers and authorities: strictly necessary accounting, legal, or technical assistance, compliance with legal obligations, valid orders, and the regular exercise of rights.
We do not sell customer records. Payment providers and marketplaces may process data independently under their own policies and legal obligations. Social media links take you to independent services; following a link is also subject to the destination's rules.
Processing outside Brazil
Infrastructure and digital service providers may store or access data in other countries, including the United States. This may involve account, support, and order data, technical records, and authorized identifiers, depending on the service used.
International transfers must comply with the LGPD and mechanisms recognized by the ANPD, such as an adequacy decision or applicable contractual safeguards. Through the privacy channel, you may request information about recipients, countries, purposes, duration, and the mechanism used for your data, as well as access to relevant safeguards, subject to legally protected trade secrets.
How long data is kept
Data is retained for as long as necessary for the purpose that justified its collection. Account data supports the access you requested; support data serves to resolve the request and protect the rights involved. Order information, documents, and transactions are also subject to the tax, warranty, and rights-enforcement retention periods applicable to those records.
Closing an account or withdrawing consent does not delete documents that must be kept to comply with a legal obligation or for the regular exercise of rights. In those cases, use is restricted to the purpose justifying retention. Once the need ends, data must be deleted or anonymized, including through backup replacement cycles. You may request the justification and applicable retention period for a specific piece of data.
Preferences and identifiers on your device have the periods described in the Cookie Policy. Deleting browser data does not automatically delete account or purchase records.
Your rights and how to exercise them
You may request confirmation of processing, access, correction, information about sharing, portability when regulated and applicable, and anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data. You may also request deletion of data processed with consent, subject to legally permitted retention, withdraw consent, and object to processing that does not comply with the LGPD.
If a decision based solely on automated processing affects your interests, you may request a review and clear information about the criteria and procedures used, subject to trade and industrial secrets. Decisions made by the payment provider may also be challenged directly with that provider.
Use privacy support or the email address on this page. Describe your request and provide a way to contact you. To protect you, we may confirm your identity proportionately without requiring unnecessary documents. Exercising your rights is free of charge.
Confirmation or access may be provided immediately in a simplified form or through a complete statement within 15 days, subject to applicable rules. If there is a legitimate obstacle, we will explain the reason and next steps. You may also contact the ANPD and consumer protection agencies.
Your choices and updates to this policy
In the footer, Manage cookies lets you refuse or change analytics and advertising choices. To stop receiving email updates, ask support to unsubscribe you or use the mechanism provided in the message. This does not prevent necessary communications about an ongoing purchase or request.
The store is intended for people legally capable of entering into contracts; purchases for minors must be made by their legal guardian. We do not direct behavioral advertising at children or teenagers. If you identify a child's data that was submitted improperly, notify the privacy channel so we can assess it and take appropriate measures in the data subject's best interests.
This policy may be updated to reflect actual changes to the service or legislation. The version date is displayed on this page. A change of purpose that requires consent calls for a new choice; simply publishing text does not replace that authorization.