Privacy Policy

Who we are

Onça is a product of Onca Labs LLC (“Onça”, “we”, “us”). We are the data controller for the information described here. You can reach us about anything on this page at hello@oncahq.com.

What this policy covers

It covers oncahq.com, the public marketing site, and the early-access list you can join from it. It does not cover the Onça application at app.oncahq.com, which is not open to the public yet. When early access opens, the data you connect to the product (your Search Console, Business Profile, and site content) will be governed by a separate agreement that we will publish before anyone connects anything.

What we collect

Information you give us

The early-access form asks for your email address, and optionally your name. That is the entire form. Submitting it sends us an email containing what you typed. This site has no database and does not store your submission anywhere else: it arrives in a monitored inbox and lives there.

If you email us directly, we hold that correspondence for as long as we need it to answer you and to keep a record of the conversation.

Information collected to stop spam

The form includes a hidden field that real people never fill in, and it records the moment the page was rendered so we can spot submissions made faster than a human could type. On some deployments we also use Cloudflare Turnstile, a challenge that checks the submission is not automated. None of these identify you, and we do not use them for any purpose other than rejecting bots.

Information collected automatically

• Analytics. We use Google Tag Manager with Google Analytics 4 to understand which pages people read and which links they click. This sets cookies and records your approximate location from your IP address, your device and browser, the page you are on, and where you arrived from. We look at it in aggregate, to decide what to write next.
• Server logs. Our host, Vercel, records standard request information including IP address, user agent, and timestamp. This is operational: it is how a hosting provider serves and secures a site.
• Fonts. The site loads its typefaces from Google Fonts. Your browser requests those files from Google directly, which discloses your IP address to Google as part of the request. We do not receive anything from it.

Why we collect it

• To reply to you. If you join the early-access list, we use your email to contact you about early access and, later, about launch. That is what you gave it to us for.
• To keep the site working. Logs and anti-spam checks exist to serve pages and to stop the form being abused.
• To understand what is useful. Aggregate analytics tell us which pages are worth expanding.

Where the law requires a legal basis, ours is your consent for the early-access list and for analytics, and our legitimate interest in operating and securing the site for logs and anti-spam.

We do not sell or rent your personal information, and we do not share it with advertisers or use it to build advertising profiles.

Who else handles it

We keep this list short on purpose. Each of these is a service provider processing data on our behalf, under their own terms:

• Vercel, which hosts the site and serves every page.
• Resend, which delivers the early-access notification email to us.
• Google, for Tag Manager, Analytics, and Fonts.
• Cloudflare, for Turnstile bot verification where it is enabled.

We may also disclose information if the law requires it, or to protect our rights or someone's safety.

Cookies

The cookies on this site come from Google Analytics via Tag Manager. They are set when you load a page, and they exist to distinguish one visit from another so the traffic numbers mean something.

You can refuse or delete them in your browser settings, and Google publishes a browser add-on that opts you out of Analytics on every site that uses it. Blocking them does not break anything here: the site is static, so every page works with cookies disabled.

How long we keep it

Early-access emails are kept until launch and for a reasonable period afterwards, or until you ask us to delete them, whichever comes first. Analytics data is retained according to our Google Analytics retention settings. Server logs are retained by Vercel on their standard schedule.

Your rights

You can ask us to show you what we hold about you, correct it, delete it, or stop using it, and you can withdraw consent at any time. Email hello@oncahq.com and we will action it. We will not make you use a form or charge you for it.

If you are in the UK or the European Economic Area, the UK GDPR and GDPR give you these rights and the right to complain to your local supervisory authority. If you are in California, the CCPA and CPRA give you rights of access, deletion, correction, and to opt out of sale or sharing. As above, we do not sell or share personal information, so there is nothing to opt out of, and we will not treat you differently for exercising any right.

Children

Onça is a business tool and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child has sent us information, tell us and we will delete it.

Our crawler

Onça operates a research crawler called OncaBot, which reads public pages that already rank in search results. It does not collect personal data and it obeys robots.txt. If you are a site owner who found it in your logs, the OncaBot page explains exactly what it does and how to block it.

Changes

If we change how any of this works, we will update this page and the effective date at the top. For a change that materially affects people already on the early-access list, we will email them rather than rely on you rechecking this page.

Contact

Questions, requests, or complaints about privacy go to hello@oncahq.com, addressed to Onca Labs LLC. See also our Terms of Service.