Privacy Policy
Version 1.6.1 · updated 18 October 2026
This policy explains, in plain language, what personal data Lagooa collects, why, who we share it with and how you can exercise your rights under the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), the UK GDPR where it applies, and Brazil's data protection law (LGPD, Law No. 13,709/2018). It covers the lagooa.com and lagooa.com.br websites and the Lagooa app.
Outside Brazil, we currently collect only waitlist data and the messages you send us (Contact us and job applications). The other sections describe how the service works in Brazil and how it will work when it launches in your country.
The 30-second version
- Your profile is anonymous until you accept a connection. Until then, companies only see your first name, last initial, area and professional details.
- You decide who gets your contact details. Declining is anonymous.
- We don't sell or rent your data, and we don't use ads or third-party trackers.
- You can ask to see, correct or delete your data at any time by writing to contato@lagooa.com. To erase everything instantly, use Account › Delete my account in the app.
1. Who is responsible for your data
The data controller is Bender Consultoria e Serviços em Tecnologia da Informação Ltda., CNPJ 54.492.019/0001-21, which runs Lagooa. Our data protection officer (DPO) is Cristiano Pereira Bender, reachable at contato@lagooa.com.
2. What we collect and why
| Data | Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|---|
| Waitlist: email, whether you're a company or talent, country and language | Letting you know when Lagooa launches in your country | Consent (point a) |
| Contact us and job applications: name, email, subject and message; if you provide them, phone number and company. To work at Lagooa: also your LinkedIn link and the chosen opening | Replying to your message and assessing your application | Consent (point a) and pre-contractual steps (point b) |
| Support and moderation: internal team notes about the account, account status (active, paused or suspended) and a log of team actions | Providing support, preventing fraud and scams and enforcing moderation decisions, always knowing who did what | Performance of a contract (point b) and legitimate interests (point f) |
| Account: email, password (stored encrypted) and account type. If you sign in with LinkedIn: the name, email and profile photo LinkedIn sends us. We never post to your LinkedIn and the photo is not shown to companies | Creating and securing your account | Performance of a contract (point b) |
| Talent profile, visible part: first name, last initial, job title, skills, languages with proficiency level, years of experience, education level (only "Bachelor's degree" or "Higher education (in progress)" is shown), course and school, city, area, salary range, accepted work modes and contract types, job-search status | Showing your anonymous profile in company searches | Performance of a contract (point b) |
| Talent profile, private part: full name, email, phone, LinkedIn, CV link and your CV as a PDF file, if you upload one | Giving your contact details to a company only after you accept its connection request | Performance of a contract, at your request (point b) |
| Automatic CV reading: the content of the PDF you upload | Suggesting how to fill in your profile, which you review before saving. It only happens when you upload the file or tap "Fill in from my CV" | Performance of a contract, at your request (point b) |
| Company and recruiter: name, company and company registration number | Checking the company is real and protecting talent from scams | Performance of a contract (point b) and legitimate interest in fraud prevention (point f) |
| Statistics-only data: year of birth and sex (with a "Prefer not to say" option) | Measuring, in aggregate and without names, who gets hired through Lagooa (age band and sex). No company ever sees this data, not even after connecting. The year of birth also confirms you are 18 or older | Legitimate interests (point f), keeping to the minimum: we ask for the year only, not the full date |
| Hires: whether a connection led to a hire, as reported by the talent and the company (each sees only their own answer) | Measuring Lagooa's results. We keep a snapshot without names: region, city, field, profession, education level, age band, sex, years of experience, contract type, salary range and company | Legitimate interests (point f) |
| Service use: connection requests and replies (including the company's note, if any), passed profiles, job posts, jobs the talent marked as interesting or passed, messages and whether they were read and a log of which companies viewed each profile | Running the service and showing talent who viewed their profile | Performance of a contract (point b) and legitimate interest (point f) |
| Access logs: IP address, date and time | Security and legal obligations | Legal obligation (point c) and legitimate interest (point f) |
| Preferences on your device: chosen language and login session | Remembering your language and keeping you signed in | Legitimate interest (point f), at your request |
We don't ask for special category data (racial or ethnic origin, religion, political opinions, health, sex life, biometrics). Please don't include this kind of information in your profile or CV.
3. How companies see your profile
- Before a connection, a company only sees the visible part of your profile. Your full name and contact details stay hidden.
- If you accept a connection, that company gets the private part for 90 days. After that, access expires.
- If you decline, the company never finds out who you are.
- You can make your profile invisible at any time. Profiles not updated for 90 days drop out of searches automatically.
- Only verified companies can send connection requests.
- Your year of birth and sex are never shown to companies, before or after connecting.
4. Automated decision-making
The match percentage and the order of profiles are calculated automatically by comparing a company's filters with your profile. This only sorts the list: asking to connect, accepting and hiring are always decisions made by people. We don't make decisions based solely on automated processing that have legal or similarly significant effects on you (GDPR Art. 22). You can ask how the criteria work and request a review of any result.
5. Who we share data with
- Companies: only your anonymous profile and, once you accept, the private part.
- Processors that run the service on our behalf, under contract and only for that purpose: Supabase (database and sign-in, with servers in São Paulo, Brazil) and Vercel (website and app hosting, with a network of servers in several countries).
- AI reading of your CV: when you ask for automatic filling, the PDF is sent to Anthropic (United States), which provides the Claude AI model, only to extract your profile details. Under this provider's commercial terms, data sent through its API is not used to train its models.
- Payments: when we start charging companies, we'll name the payment provider here before it begins.
- Authorities: when required by law or a court order.
We never sell, rent or hand over your data for advertising.
6. International transfers
Data is stored in Brazil. In January 2026 the European Commission recognised that Brazil ensures an adequate level of protection (Implementing Decision (EU) 2026/179), so transfers from the EU to Brazil need no extra safeguards. For transfers from the UK or other countries, and where Vercel processes data elsewhere (for example in the United States) to serve pages quickly, we rely on appropriate safeguards such as standard contractual clauses. The same applies to automatic CV reading, carried out by Anthropic in the United States.
7. How long we keep data
- Waitlist: until we launch in your country or until you ask to leave, for up to 24 months.
- Account and profile: while your account is active. You can delete your account at any time in the app, under Account › Delete my account: your login, profile, connections, messages and waitlist sign-up are erased immediately, and companies lose access to your contact details. If you'd rather ask by email, we delete it within 30 days.
- Contact details shared with a company: available to that company for 90 days after you accept.
- Access logs: 6 months.
- CV file (PDF): until you remove or replace it, or delete your account, when it is erased. Companies can only open it during an accepted connection, through a link valid for 5 minutes.
- Contact messages: up to 24 months after we reply. Applications to work at Lagooa: up to 12 months, so we can consider you for other openings, or less if you ask.
- Internal team notes: deleted together with the account. The log of team actions keeps only the type of action and the reason, without your personal data, for up to 5 years, for accountability.
- Hires: when you delete your account, the answer is no longer linked to you and loses the city. Only a nameless snapshot remains, which is no longer personal data and is used for statistics.
- Backups: overwritten automatically within 30 days.
8. Your rights
Under Articles 15 to 22 of the GDPR, you can ask at any time for:
- access to your data and information about how it's used;
- correction of incomplete or inaccurate data;
- erasure (the "right to be forgotten");
- restriction of processing;
- data portability;
- objection to processing based on legitimate interest;
- withdrawal of consent at any time, for example leaving the waitlist, without affecting earlier processing;
- not being subject to decisions based solely on automated processing.
How to ask: to delete your account, use Account › Delete my account in the app. For anything else, email contato@lagooa.com. We may ask you to confirm your identity to protect you. We reply within one month. You can also complain to a supervisory authority, such as Portugal's CNPD, Spain's AEPD, the UK's ICO or the authority in your country.
9. Security
We use encrypted connections (HTTPS) throughout, store passwords encrypted, enforce database rules that limit who can see each piece of data, and verify companies. If a data breach puts you at risk, we'll notify the relevant authority and, where required, you, within the deadlines set by the GDPR.
10. Minimum age
Lagooa is for people aged 18 and over. We don't knowingly collect data from minors. If you know of a case, please tell us so we can delete it.
11. Cookies and on-device storage
We only use what's strictly necessary: one cookie and your browser's local storage to remember the language you picked, and local storage to keep you signed in. We don't use third-party advertising or analytics cookies. The site's fonts are served from the site itself, with no calls to outside services.
12. Changes to this policy
If we change anything important, we'll let you know on the website, in the app or by email before it takes effect. The date of the current version is at the top of this page.
13. Contact
Questions, requests or suggestions about privacy: contato@lagooa.com.