Privacy Policy

This Privacy Policy explains, in plain terms, how Lupa Vagas processes personal data of candidates, companies and site visitors, in compliance with Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018). It applies to the lupavagas.app.br website and to the platform's installable app (PWA).

Who we are and how to reach us

Lupa Vagas is a Brazilian job platform that connects candidates and companies and acts as the controller of the data processed in the service. For any privacy matter, including contacting the data protection officer (art. 41 of the LGPD), use the contact page.

Data we process

We process only the data needed to run the platform, grouped as follows:

  • Account: name, email and password. The password is stored in protected form (not as readable text). The email is used to activate the account and to recover the password.
  • Candidate profile: phone, city and state, address (street, number, complement, neighborhood and ZIP code), professional headline, skills, education level, date of birth, salary expectation, photo, work experience (role, company, description and period) and courses (name, institution and years). From the address we calculate approximate geographic coordinates to measure the distance to jobs.
  • Company data: company name, CNPJ (Brazilian company tax ID), website, description, address, approximate geographic coordinates and logo. We also process the account data of the person who manages the company.
  • Published jobs: title, description, location, salary range, employment type, work model, requirements and dates. Jobs are public content.
  • Applications: the chosen job, the associated candidate profile and the stage of the application in the company's hiring process.
  • Feedback messages: the text sent, the category and, if you wish, an email address for a reply.
  • Technical security data: session tokens (access and refresh) and attempt counters per IP address, used to limit abuse and protect accounts.

Storage in your browser and in the app

  • Language: we store your language choice in the browser's local storage to remember it on future visits.
  • Session: when you sign in, session tokens are kept in the browser. If you choose to stay signed in, they are kept in local storage; otherwise they stay only in the tab's session storage and disappear when the tab is closed.
  • App cache: the installable app keeps a copy of public content (job lists, locations and job titles) so it works on a poor connection. Candidate photos and signed-in areas are not stored in this cache.

We do not use advertising cookies or tracking tools for marketing purposes.

What we use the data for

  • Create and maintain your account and allow access to the platform.
  • Calculate the match between a candidate's profile and jobs and show the most compatible opportunities.
  • Allow applications and let companies follow the hiring process.
  • Send service emails, such as account activation and password recovery.
  • Keep the platform secure, prevent fraud and limit abuse.
  • Answer contact and feedback messages and improve the service.

Legal bases

We process personal data on the bases set out in art. 7 of the LGPD, depending on the purpose:

  • Performance of a contract or preliminary procedures: creating the account, building the profile, applying and following applications.
  • Legitimate interest: platform security, abuse prevention and service improvement, always respecting your rights and expectations.
  • Compliance with a legal or regulatory obligation: when the law requires us to keep or provide information.
  • Consent: when a feature depends on it, and you may withdraw it at any time.

Who we share data with

  • Companies: a company sees the applications received for its own jobs, together with the candidate's profile. Registered companies can also find candidates in the talent search, where name, photo, headline, skills, city and state, education level, salary expectation, courses and experience are shown. Phone, email, full address and date of birth do not appear in this search.
  • Public jobs: jobs, and only jobs, are public. Each job gets an open page and is sent to search engines such as Google (Google for Jobs) and to job aggregators through public feeds. Candidate data never goes through these channels.
  • Service providers: hosting and email delivery infrastructure providers, which process data only to operate the service, following our instructions.
  • Authorities: when there is a legal obligation or an order from a competent authority.

We do not sell personal data.

How long we keep data

We keep data while your account exists and as long as needed for the purposes described above. After that, we keep only what the law requires or what is necessary for the regular exercise of rights, for the applicable period. Security data, such as session tokens and attempt counters, is kept for short periods and expires automatically.

Your rights

Under art. 18 of the LGPD, you may request at any time:

  • confirmation that we process your data;
  • access to the data;
  • correction of incomplete, inaccurate or outdated data;
  • anonymization, blocking or deletion of unnecessary or excessive data, or data processed in violation of the law;
  • data portability;
  • information about the entities we share data with;
  • information about the possibility of not giving consent and the consequences of refusing;
  • withdrawal of consent;
  • objection to processing carried out on a basis other than consent, if the law is not being followed.

Some of these rights you can exercise directly in your account by editing your profile. For the others, or for any question, send your request through the contact page. You may also file a complaint with the Brazilian National Data Protection Authority (ANPD).

Security

We adopt technical and organizational measures to protect data: protected passwords, session tokens with limited lifetime, limits on access attempts, access control by account type and validation of uploaded files. No system is completely immune to failures; in case of an incident that may cause relevant risk, we will notify data subjects and the ANPD, as required by law.

Changes to this policy

We may update this policy to reflect changes in the service or in the law. The update date appears at the top of this page. Relevant changes will be announced on the platform. Use of the service is also subject to the Terms of Use. Common questions are answered in the FAQ.