Privacy policy

Hasta processes personal data under Brazil's General Data Protection Law (LGPD, Law 13,709/2018). This page explains, in plain language, what data we collect, why, who we share it with and how you exercise your rights.

1. Who the controller is

Hasta (hasta.com.br and hasta.bid) is the controller of the data processed on this site. Our data protection officer (DPO, LGPD art. 41) can be reached at atendimento@hasta.com.br.

2. What data we collect

We do not collect sensitive data (art. 5, II) or data from anyone under 18. If such an account is identified, it is deleted.

3. Why we use the data (purposes and legal bases)

• Showing auctions and running your account (saved properties, alerts, reports) — performance of a contract, art. 7, V.
• Sending the e-mail or WhatsApp alerts you set up — performance of a contract and consent, art. 7, I and V. Every message includes a way to cancel.
• Sending Hasta news by e-mail — legitimate interest, art. 7, IX, always with a one-click unsubscribe link.
• Measuring audience and improving the site — legitimate interest, art. 7, IX, using aggregated data.
• Protecting your account and preventing fraud — legitimate interest and legal obligation, art. 7, II and IX.
• Billing the PRO subscription — performance of a contract, art. 7, V.
• Showing Hasta ads to people who have visited the site (remarketing), on Google and Meta platforms — legitimate interest, art. 7, IX. You can object at any time, as explained in section 6.

4. Who we share it with

Only with processors that provide services to Hasta, under contract, and only what each function needs:

• Hosting and infrastructure — Hostinger (servers) and Cloudflare (protection and file storage).
• E-mail — Resend, for transactional and informational e-mails.
• WhatsApp — Twilio, for the alerts you turn on.
• Payments — Stripe, for the PRO subscription.
• Sign-in, measurement and advertising — Google (Google Sign-In, Google Analytics, Google Ads) and Meta (pixel), as described in section 6.
• Artificial intelligence — language-model providers used to generate reports and answer the chat. We send only the content needed for the analysis; never passwords or payment data.

Some of these processors are outside Brazil. International transfers follow LGPD art. 33, with contractual protection clauses. We may also share data under a court order or legal obligation.

5. How long we keep it

• Account data: for as long as the account exists. After a deletion request, we erase it within 30 days.
• Access logs (IP, date and time): 6 months, as required by Brazil's Internet Civil Framework (Law 12,965/2014, art. 15).
• Billing data: 5 years, for tax purposes and defence in any legal proceedings.

6. Cookies, measurement and advertising

We use cookies and browser local storage for three things:

• Necessary — keeping you signed in and remembering your preferences. The site does not work without them.
• Measurement — Google Analytics, to learn which pages are useful. Data is aggregated.
• Advertising — Google Ads and the Meta pixel, to measure whether an ad brought a visit and for remarketing: showing Hasta ads on Google, on partner sites and apps, and on Facebook and Instagram to people who have visited the site. These cookies belong to Google and Meta, which recognise the browser without Hasta sending your name, e-mail or phone number.

To stop seeing personalised ads, turn them off in Google ad settings and Meta ad preferences. You can also block or delete cookies in your browser settings. Blocking measurement and advertising cookies does not affect your use of the site.

7. Your rights (LGPD art. 18)

At any time, free of charge, you may request:

• confirmation that we process your data and access to it;
• correction of incomplete, inaccurate or outdated data;
• portability: a copy of your data in a readable format;
• anonymisation, blocking or deletion of unnecessary or unlawfully processed data;
• withdrawal of consent and objection to processing based on legitimate interest;
• information about who we share your data with;
• deletion of your account and the data linked to it.

To exercise any right, write to atendimento@hasta.com.br from your registered e-mail. We reply within 15 days. Alerts and informational e-mails can be cancelled directly through the link in each message, without writing to us.

If you believe your request was not handled, you may file a complaint with Brazil's National Data Protection Authority (ANPD) at gov.br/anpd.

8. Security

All traffic is encrypted (HTTPS). Passwords are stored only as hashes. Internal access to data is restricted and logged. In the event of a security incident that may pose a relevant risk to you, we will notify you and the ANPD, as required by LGPD art. 48.

9. Public auction data

Property information (address, values, auction notice, title record) is public by nature: it comes from auction notices, official auctioneers' websites and Caixa. It is not personal data of Hasta users. If you are a party to a case and believe a published document exposes your personal data beyond what auction publicity requires, write to the DPO and we will assess the request.

10. Changes

This policy may change when the service changes. The date of the current version is shown below. Material changes are announced by e-mail to registered users.

Continue

• Guides to Brazilian property auctions
• Browse properties at auction