Privacy policy

Hasta processes personal data under Brazil's General Data Protection Law (LGPD, Law 13,709/2018). This page explains, in plain language, what data we collect, why, who we share it with and how you exercise your rights.

1. Who the controller is

Hasta (hasta.com.br and hasta.bid) is the controller of the data processed on this site. Our data protection officer (DPO, LGPD art. 41) can be reached at atendimento@hasta.com.br.

2. What data we collect

Situation	Data
Visiting without an account	IP address, browser and device type, pages visited and measurement cookies (see section 6).
Sign-up	Name, e-mail, password (stored only as a hash), WhatsApp number and city/state of interest. With Google sign-in we receive the name, e-mail and photo of your Google account.
Using your account	Saved properties, alerts you set up, saved filters, reports you requested and messages exchanged with Hasta.
PRO subscription	Payment data is collected and stored by Stripe. Hasta receives only the payment confirmation and the subscription identifier; we never store card numbers.

We do not collect sensitive data (art. 5, II) or data from anyone under 18. If such an account is identified, it is deleted.

3. Why we use the data (purposes and legal bases)

Showing auctions and running your account (saved properties, alerts, reports) — performance of a contract, art. 7, V.
Sending the e-mail or WhatsApp alerts you set up — performance of a contract and consent, art. 7, I and V. Every message includes a way to cancel.
Sending Hasta news by e-mail — legitimate interest, art. 7, IX, always with a one-click unsubscribe link.
Measuring audience and improving the site — legitimate interest, art. 7, IX, using aggregated data.
Protecting your account and preventing fraud — legitimate interest and legal obligation, art. 7, II and IX.
Billing the PRO subscription — performance of a contract, art. 7, V.

What we do not do: we do not sell, rent or hand over your data to third parties for their own purposes. We do not use your data for automated decisions with legal effects on you.

4. Who we share it with

Only with processors that provide services to Hasta, under contract, and only what each function needs:

Hosting and infrastructure — Hostinger (servers) and Cloudflare (protection and file storage).
E-mail — Resend, for transactional and informational e-mails.
WhatsApp — Twilio, for the alerts you turn on.
Payments — Stripe, for the PRO subscription.
Sign-in and measurement — Google (Google Sign-In, Google Analytics, Google Ads) and Meta (measurement pixel), as described in section 6.
Artificial intelligence — language-model providers used to generate reports and answer the chat. We send only the content needed for the analysis; never passwords or payment data.

Some of these processors are outside Brazil. International transfers follow LGPD art. 33, with contractual protection clauses. We may also share data under a court order or legal obligation.

5. How long we keep it

Account data: for as long as the account exists. After a deletion request, we erase it within 30 days.
Access logs (IP, date and time): 6 months, as required by Brazil's Internet Civil Framework (Law 12,965/2014, art. 15).
Billing data: 5 years, for tax purposes and defence in any legal proceedings.

6. Cookies and measurement

We use cookies and browser local storage for three things:

Necessary — keeping you signed in and remembering your preferences. The site does not work without them.
Measurement — Google Analytics, to learn which pages are useful. Data is aggregated.
Advertising — Google Ads and the Meta pixel, to measure whether an ad brought a visit.

You can block or delete cookies in your browser settings. Blocking measurement and advertising cookies does not affect your use of the site.

7. Your rights (LGPD art. 18)

At any time, free of charge, you may request:

confirmation that we process your data and access to it;
correction of incomplete, inaccurate or outdated data;
portability: a copy of your data in a readable format;
anonymisation, blocking or deletion of unnecessary or unlawfully processed data;
withdrawal of consent and objection to processing based on legitimate interest;
information about who we share your data with;
deletion of your account and the data linked to it.

To exercise any right, write to atendimento@hasta.com.br from your registered e-mail. We reply within 15 days. Alerts and informational e-mails can be cancelled directly through the link in each message, without writing to us.

If you believe your request was not handled, you may file a complaint with Brazil's National Data Protection Authority (ANPD) at gov.br/anpd.

8. Security

All traffic is encrypted (HTTPS). Passwords are stored only as hashes. Internal access to data is restricted and logged. In the event of a security incident that may pose a relevant risk to you, we will notify you and the ANPD, as required by LGPD art. 48.

9. Public auction data

Property information (address, values, auction notice, title record) is public by nature: it comes from auction notices, official auctioneers' websites and Caixa. It is not personal data of Hasta users. If you are a party to a case and believe a published document exposes your personal data beyond what auction publicity requires, write to the DPO and we will assess the request.

10. Changes

This policy may change when the service changes. The date of the current version is shown below. Material changes are announced by e-mail to registered users.

Version in force since September 20, 2026 · Data protection officer: atendimento@hasta.com.br