Privacy summary

imova is operated by Aethereos Tecnologia Ltda. This page is a plain-English summary of our privacy policy, which is governed by Brazil's LGPD (Lei n.º 13.709/2018). The full, legally-binding policy is published in Portuguese at /politica-privacidade.

What we collect

Depending on how you use imova, we collect: for real estate agents and agencies — name, e-mail, phone, CPF/CNPJ, CRECI registration number and state, profile photo and office address; for people contacting an agent about a property (leads) — name, phone, optional e-mail and message content; for properties listed on the platform — address, coordinates, description, photos and price; and, automatically, cookies, session identifiers, browser user-agent and pages visited. We store a hash of your IP address, not the raw IP.

Why we use it

To operate the marketplace (authenticate agents, publish listings, connect leads to the responsible agent), to verify a broker's CRECI registration, to keep the platform secure, to improve the product from aggregated/anonymized usage, to send transactional notifications, and — only with your explicit consent — for marketing communications.

Who we share it with

We do not sell personal data. Data is shared only with: the broker responsible for a listing (lead contact details), our infrastructure providers (Supabase for database/authentication, hosting, transactional e-mail) under data-processing agreements, COFECI/CRECI for professional-registration verification, and authorities when legally required.

How long we keep it

Broadly: agent account data for as long as the account is active plus up to 5 years; leads for up to 2 years; closed listings for 1 year (then anonymized); access logs for 6 months (per Brazil's Marco Civil da Internet); analytics cookie data for up to 13 months, subject to consent.

Your rights

• Confirm and access your data
• Correct incomplete or outdated data
• Request anonymization, blocking or deletion
• Request portability, where feasible
• Revoke consent at any time
• Object to processing based on legitimate interest
• Request human review of automated decisions

To exercise any of these rights, contact our data protection team at privacidade@imova.io.

Security

We rely on encryption in transit and at rest, Row Level Security in our database, OAuth 2.1 / OIDC with PKCE for authentication, role-based access control, and audit logging of privileged access.

Full policy (Portuguese): /politica-privacidade