Privacy Policy

1. What we collect

• Account data: email address, password (stored as a salted hash, never in plain text), optionally your name and company.
• Security data: a two-factor authentication secret if you enable it, and login-attempt/lockout counters used to detect abuse.
• Marketing preference: whether you've opted in to promotional emails.
• Submitted listings: any company or event information you submit for publication.
• Technical data: IP address, retained briefly to rate-limit abuse (registration, login, listing submissions).

2. Why we process it, and on what basis

• Providing the account/Service (email, password, listings) — necessary to perform our contract with you.
• Security (2FA secret, lockout counters, IP-based rate limiting) — our legitimate interest in keeping accounts and the Service secure from abuse.
• Marketing emails — only sent if you explicitly opt in; based on your consent, which you can withdraw at any time (see Section 6).

3. Who we share it with

We use the following processors to run the Service. We do not sell personal data.

• Vercel Inc. — application hosting.
• Neon Inc. — database hosting.
• Resend — sends account-related emails (password/MFA confirmation, email verification).

These providers are based in the United States. Personal data is therefore transferred internationally (from Brazil, and from the EEA for EU/EEA visitors) — we rely on standard contractual clauses recognized under LGPD/GDPR, or an equivalent safeguard offered by the provider.

4. How long we keep it

Account data is kept for as long as your account is active. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we're required to retain records for legal or security purposes.

5. Cookies

We use a single strictly-necessary session cookie to keep you signed in. It is not used for tracking or advertising and does not require separate consent, since it's essential to the Service functioning.

6. Your rights

Under LGPD and, where applicable, GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request erasure of your data ("right to be forgotten").
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw marketing consent at any time — every promotional email includes an unsubscribe link.
• Lodge a complaint with your local data protection supervisory authority if you believe your data has been mishandled.

To exercise any of these rights, contact us at [contact email].

7. Changes to this policy

We may update this policy from time to time. Where a change materially affects how we use your data, we will notify you (e.g. by email) before it takes effect, as required by law.