Legal

Privacy Policy

Last updated: 27 August 2026 · version 2026-08-27

1. Controller

HubLife processes personal data to operate the marketplace. Until a dedicated DPO email exists, the data-subject channel is in-app support and account deletion under My profile. Payment processing with Asaas is covered by Annex II (Personal Data Processing Agreement) of the Asaas Terms, documented in the internal runbook docs/legal/dpa-asaas.md. This policy does not replace external legal advice.

2. Data we collect

• Registration: name, email, password (stored as a hash), phone, country, language, and account type (person, company, or admin).
• Personal profile: goal, stated income, family size, city of interest, and profession.
• Company: description, category, city, phone and website (not shown publicly), services, plan, KYC documents (file, type, and status).
• Usage: leads, chat messages, deals (amounts, commission, payment status), reviews, assistant conversations, and notifications.
• Payment: Asaas identifiers and, at checkout, the payer’s CPF/CNPJ when the provider requires it.
• Technical: logs needed for security, JWT authentication, and incident diagnosis.

3. Legal bases (LGPD)

We process data mainly on the following bases:

• Performance of a contract: account, chat, proposal, charging, receivables statement, and support.
• Legitimate interest: security, fraud and lead-diversion prevention, internal ranking, and product improvement, limited to what is necessary.
• Legal obligation: keeping payment and tax records for the required period. Accepting the terms records acknowledgment; we do not use consent as the sole basis for essential account processing.

4. Purposes

To operate the marketplace, connect clients and companies via chat, calculate commission and net amounts, process payments on Asaas, verify companies, send essential account notices, generate recommendations, and protect the platform from abuse.

5. Sharing

We do not sell contact lists. We share what is necessary with: (a) Asaas, as payment processor; (b) the transactional email provider; (c) the partner company when you open a lead — in that case the company sees the name and chat content, not the client’s email or phone. HubLife admins access data for moderation, verification, and finance.

6. International transfers

Companies in Paraguay access the chat and the support data needed to deliver the service. That implies an international transfer of personal data from Brazil to Paraguay, limited to what the lead requires.

7. Data-subject rights

Under Brazil’s LGPD (art. 18), you may request:

• Confirmation of processing, access, and correction of incomplete or outdated data.
• Anonymization, blocking, or deletion of unnecessary or excessive data.
• Portability and information about entities with which we share data.
• Information on the option not to consent and the consequences (when processing is based on consent).
• Withdrawal of consent and objection to irregular processing. You can delete your account under My profile (immediate anonymization), subject to legal retention of deals and payments.

8. Retention

We keep the account while it exists. On deletion we anonymize account data and remove profile, chats, and notifications; payment, commission, and deal records are kept for up to 5 years for tax obligations. KYC is removed on erase or after rejection + 30 days. PSP webhook payloads are deleted after 90 days. Operational detail: docs/legal/retention-runbook.md.

9. Security

We use hashed passwords, JWT authentication, role-based access (person, company, admin), and infrastructure best practices. No system is 100% risk-free. You must protect your password and sign out on shared devices.

10. Cookies and local storage

We do not currently use a marketing cookie banner. Session tokens and a summary profile stay in the browser’s localStorage so you remain signed in. That is essential to the logged-in area.

11. Changes

The current version is the one published on this page (version 2026-08-27). Material changes may require a new acceptance on the account, together with the Terms of Use.