Brazil Privacy Policy

This Privacy Policy ("Policy") describes how Hub collects, uses, shares, transfers, protects and retains personal data relating to users, contributors, task applicants and other individuals interacting with the Platform in Brazil.

It should be read together with the Contributor Terms, the Data Rights, Image & Voice Agreement and, where applicable, the Task Conditions.

Hub Data, Inc. is the primary controller for the Platform's core activities, including accounts, task eligibility, Contribution processing, quality, security, dataset development and corporate licensing.

HUB AGENCIA DE DADOS LTDA, CNPJ 68.362.634/0001-28, participates in local Brazilian activities such as support, payouts, compliance, disputes and Brazilian legal obligations. Depending on the specific processing activity, the Brazilian entity may act operationally in support of Hub Data, Inc. and/or as an independent controller for purposes and obligations it directly determines.

Hub maintains internal records of processing activities and entity responsibilities. If you have questions about the entity responsible for a particular activity, contact privacy@hub.xyz.

Some optional profile fields or Contribution content may reveal or permit inferences about protected characteristics. Hub should limit collection to what is necessary, avoid unnecessary inferences and rely on an appropriate legal basis.

Voluntarily provided descriptors such as skin tone, hair or eye color are not presented as the result of facial recognition or automated biometric measurement unless such functionality is expressly implemented and disclosed.

If Hub processes biometric data for unique identification or otherwise processes sensitive personal data, it will use a valid Article 11 LGPD legal basis and appropriate safeguards.

Hub may use automated systems to support task eligibility, fraud detection, review prioritization and a reliability score.

Relevant factors may include submission quality/acceptance rate, technical integrity, compliance with task specifications, duplicate/fraud signals and reviewer feedback. Simple inactivity or choosing not to accept tasks should not be treated as a violation or penalty.

If a decision based solely on automated processing materially affects your interests, you may request information about the criteria/procedures used and seek review, subject to trade-secret protections and applicable law.

We may share data with affiliates and vendors supporting hosting, storage, security, analytics, support, messaging, notifications, KYC, payouts and fraud prevention. Current examples may include Didit (verification), Dots and/or other payment processors, Google and Discord (login), PostHog (analytics), Sentry (crash/performance), cloud, email and push-notification providers.

Corporate clients may receive Contributions and metadata needed for the dataset. Account information, credentials, identity documents, PIX keys, bank details and direct contributor contact information should not accompany client datasets.

Hub may disclose data to comply with law or government orders, investigate fraud/security, establish or defend legal claims, complete corporate transactions or obtain professional advice, subject to applicable safeguards.

Before or during dataset preparation, Hub may separate account data from materials, remove unnecessary metadata, pseudonymize identifiers and apply blurring/redaction/anonymization where technically appropriate and compatible with the purpose.

Dataset clients should be subject to purpose and security restrictions and, depending on risk, prohibitions on deliberate re-identification, targeted contributor contact and unauthorized biometric uses.

Hub Data, Inc. is located in the United States and infrastructure/vendors may operate in other countries. Brazilian users' data may therefore be transferred internationally.

Hub will use a valid mechanism under Articles 33-36 of the LGPD and ANPD Resolution No. 19/2024, including where applicable the ANPD Standard Contractual Clauses, adequacy decisions, approved binding corporate rules, approved specific contractual clauses or another legally available mechanism.

Required international-transfer transparency information will be made available in Portuguese through an accessible channel. Where requested and legally applicable, Hub will provide information about the transfer mechanism, subject to trade-secret and security protections.

Under the LGPD, as applicable, you may request confirmation of processing; access; correction; anonymization, blocking or deletion of unnecessary/excessive/unlawfully processed data; portability; information about sharing; deletion of consent-based data subject to legal exceptions; information about the ability to refuse consent and its consequences; consent withdrawal; objection; and information/review regarding automated decisions.

Send requests to privacy@hub.xyz. Hub may verify identity before responding and will comply within applicable legal deadlines. You may also petition Brazil's National Data Protection Authority (ANPD).

You may request account deletion through available controls or privacy@hub.xyz. Deletion does not prevent legally permitted retention or retention required to establish or defend legal rights.

Where consent is the legal basis and is withdrawn, Hub will stop future processing based solely on that consent, subject to other applicable legal bases and the validity of processing carried out before withdrawal.

Effectively anonymized content is no longer personal data under the LGPD where the anonymization cannot be reversed using Hub's own means or reasonable efforts.

Hub websites may use strictly necessary, preference, analytics and campaign-measurement cookies. Non-essential technologies should be handled in accordance with applicable transparency and choice requirements.

Hub may use custom audiences to reach existing users on platforms such as Meta, subject to minimization, identifier protection, an appropriate legal basis and opt-out. Hub does not use Contribution content as personal advertising-targeting data.

Hub uses technical and organizational measures proportionate to risk, including protection in transit and at rest, access controls, authentication, segregation of duties, logging, vulnerability management, incident response and vendor review.

No measure eliminates all risk. Personal-data security incidents will be assessed and, where applicable, reported to the ANPD and affected individuals in accordance with then-current law.

The contributor Platform is not intended for individuals under 18. If Hub identifies an underage account in breach of the rules, it may block participation and take steps to delete or restrict the data as required by law.

Data Protection Officer (DPO): Tim Sprecher. Channel: privacy@hub.xyz. Support: support@hub.xyz. Legal: legal@hub.xyz.

Hub may update this Policy. Material changes will be communicated through a reasonable channel. If a change requires renewed consent, consent will be requested separately.

For users in Brazil, the Portuguese version prevails over translations.