HYVEN — Terms of Use and Privacy Policy
Privacy Policy
Version 1.2 · Validation Phase · Invite-only access · Rio de Janeiro
Last updated: October 9, 2026
This document is in draft form and is subject to review and approval by legal counsel before publication.
1. Data Controller
POC JOB SOLUCOES EM EVENTOS LTDA (CNPJ No. 32.334.215/0001-35) is the controller of the personal data processed in connection with the HYVEN platform, pursuant to Law No. 13,709/2018 (LGPD — Brazil's General Data Protection Law).
Data Protection Officer (DPO): Léo Nova · Contact: privacidade@hyven.events
2. Data Collected and Purposes
We collect only the data strictly necessary to operate the platform:
| Data | Purpose | Legal basis (LGPD) |
|---|---|---|
| Full name | User identification and profile display | Performance of a contract (Art. 7, V) |
| Authentication, transactional communications, and account recovery | Performance of a contract (Art. 7, V) | |
| Communications about opportunities and support — provided voluntarily | Consent (Art. 7, I) | |
| CPF (Brazilian individual taxpayer ID) | Uniqueness of registration, prevention of duplicates and fraud — see Section 3 | Legitimate interest (Art. 7, IX) |
| CNPJ (Brazilian company taxpayer ID) | Identification of Suppliers that are legal entities | Performance of a contract (Art. 7, V) |
| Date of birth | Self-declared verification of legal age — see Section 3 | Legitimate interest (Art. 7, IX) |
| Profile photo | Display on the profile and visibility to other users | Performance of a contract (Art. 7, V) |
| City and State | Geolocation for job matching and launch phase | Performance of a contract (Art. 7, V) |
| Work categories | Matching with jobs and visibility in search results | Performance of a contract (Art. 7, V) |
| Notes / Remarks | Additional information provided voluntarily (free text — may contain personal data) | Consent (Art. 7, I) |
| Review history | Reputation and trustworthiness on the platform | Performance of a contract (Art. 7, V) |
| Access and device logs | Security, fraud detection, and auditing | Compliance with a legal obligation (Art. 7, II) and legitimate interest (Art. 7, IX) |
We do not process health data, racial origin, religious belief, or other sensitive data set forth in Art. 5, II of the LGPD.
3. CPF and Date of Birth
3.1 CPF
The CPF is collected based on the legitimate interest of POC JOB SOLUCOES EM EVENTOS LTDA (Art. 7, IX of the LGPD) for the following purposes:
- Ensuring the uniqueness of the registration and preventing duplicates;
- Preventing users from re-registering to erase review history or circumvent a suspension;
- Contributing to fraud prevention on the platform.
The CPF is not displayed publicly and is not shared with other users. Internal access is restricted to operational and security functions.
Retention after account deletion: the Company intends to retain the CPF for up to 5 (five) years after the account is closed, as a measure to prevent fraud and duplicate re-registration.
Legal review note
The retention period and the exact legal basis (legitimate interest vs. compliance with a legal obligation) will be validated with legal counsel before the public launch. Attention to the right of erasure under Art. 18, VI of the LGPD and the retention hypotheses of Art. 16.
3.2 Date of Birth
The date of birth is collected based on legitimate interest (Art. 7, IX of the LGPD) for the purpose of restricting access to adults aged 18 and over, as required by the Terms of Use.
The information is self-declared — HYVEN does not perform documentary verification of age. The restriction on minors is reinforced by the express prohibition in the Terms of Use and by the collection of the CPF, which allows fraudulent re-registrations to be identified. The date of birth is not displayed publicly.
After age verification, the date is retained while the account remains active and for the same period applied to the CPF after the account is closed.
Legal review note
Under the principle of data minimization (Art. 6, III of the LGPD), counsel is recommended to assess whether collecting the full date is necessary or whether the year of birth or a checkbox confirmation would suffice — which would reduce the volume of data processed without compromising the purpose.
4. Retention and Erasure
Personal data is retained while the account remains active or for the period necessary to fulfill the purposes described in this Policy.
After the account is closed, the following periods apply:
| Data | Post-closure period | Justification | Status |
|---|---|---|---|
| Email, name | Up to 2 years | Resolution of disputes and contractual records | ⚠️ Retention period and legal basis to be validated with legal counsel (Arts. 16 and 18, VI of the LGPD) |
| Review history | Up to 2 years | Integrity of the reputation record; prevention of opportunistic deletion | ⚠️ Retention period and legal basis to be validated with legal counsel (Arts. 16 and 18, VI of the LGPD) |
| CPF and date of birth | Up to 5 years | Fraud prevention and duplicate re-registration | ⚠️ Retention period and legal basis to be validated with legal counsel (Arts. 16 and 18, VI of the LGPD) |
| Access logs | Up to 6 months | Compliance with the Brazilian Internet Bill of Rights (Law 12,965/2014, Art. 15) | Specific legal basis — minimum legal period |
| Other data | Deleted within 30 days | — | — |
After the periods above, the data is deleted or irreversibly anonymized.
Legal review note
All periods exceeding 30 days are subject to legal review. Counsel must verify the appropriateness of each period and legal basis against the hypotheses of Art. 16 of the LGPD (retention after the end of processing) and confirm the extent of the right of erasure under Art. 18, VI in each case.
5. Sharing and International Data Transfer
We do not sell personal data. Sharing occurs only in the following situations:
- Other platform users: name, photo, categories, and reviews are visible according to profile settings;
- Infrastructure providers: listed below — all subject to contractual confidentiality and security obligations;
- Public authorities: when required by law, court order, or applicable regulation.
International Data Transfer
The personal data processed by HYVEN is transferred to the United States of America due to the use of the following infrastructure providers:
| Provider | Service | Country | Safeguards |
|---|---|---|---|
| Supabase | Database, authentication, and storage | USA | Standard contractual clauses (DPA); TLS in transit; encryption at rest |
| Vercel | Web application hosting and delivery | USA (global edge) | Standard contractual clauses (DPA); TLS in transit |
| Resend | Transactional email delivery | USA | Standard contractual clauses (DPA); TLS in transit |
The transfer is carried out based on the necessity for the performance of the contract with the data subject (Art. 33, V of the LGPD) and on the adequate safeguards provided by the providers through their Data Processing Agreements (DPAs).
Legal review note
The DPAs of each provider (Supabase, Vercel, and Resend) will be attached to this Policy at the legal validation stage. Counsel must confirm whether the safeguards are sufficient in light of Art. 33 of the LGPD and the ANPD's guidance on international transfers.
6. Data Subject Rights
Under Art. 18 of the LGPD, you have the right to:
- Confirmation and access: to know what data we process and obtain a copy;
- Correction: to update incomplete, inaccurate, or outdated data;
- Anonymization or erasure: of unnecessary data or data processed in violation of the LGPD;
- Portability: to receive your data in a structured format;
- Revocation of consent: where processing is based on that legal basis;
- Objection: to processing based on legitimate interest, in the cases provided by law;
- Information: about with whom we share your data.
These rights may be exercised by emailing privacidade@hyven.events. We will respond within 15 business days.
Legal review note
(a) The right to erasure of the CPF and date of birth may be limited while the retention periods set forth in Section 4 remain in effect. This point must be validated with legal counsel. (b) For data processed based on consent (WhatsApp, notes/remarks), revocation by the data subject entails immediate cessation of processing and erasure, except where a retention hypothesis under Art. 16 of the LGPD applies.
7. Data Security
We adopt appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or improper disclosure, including:
- Encryption in transit (TLS) and at rest;
- Role-based access controls (RLS) in the database;
- Rate limiting on sensitive routes;
- Secure authentication via Supabase Auth.
In the event of a security incident that may pose a relevant risk to data subjects, the Company will notify the National Data Protection Authority (ANPD) and the affected users within the applicable legal timeframes.
8. Cookies and Tracking Technologies
We use strictly necessary session cookies for authentication and platform operation. We do not use advertising tracking cookies or third-party cookies for marketing purposes.
9. Data Protection Officer
Pursuant to Art. 41 of the LGPD, the Officer appointed by POC JOB SOLUCOES EM EVENTOS LTDA is:
Léo Nova · Email: privacidade@hyven.events
The Officer is the channel of communication between the Company, data subjects, and the National Data Protection Authority (ANPD).
10. Amendments to this Policy
This Policy may be updated periodically. The effective version date is indicated at the top of the document. Material changes will be communicated by email at least 15 days in advance.
Applicable law: Law No. 13,709/2018 (LGPD) and other applicable Brazilian regulations.