Privacy Policy

To show the page for your country, we use approximate location supplied by our hosting infrastructure. When this is unavailable and IP lookup is enabled, we send the IP address to api.country.is to obtain only the country. This routine does not save the IP in the application or request your GPS location. If detection fails, we show a general page.

You can choose another country on the page. Your choice is stored in the H2A_COUNTRY cookie for up to one year; NEXT_LOCALE stores your language preference. Flags are loaded from FlagCDN, which receives the technical connection data needed to deliver the image.

H2A Works acts as the controller of the data needed to operate the platform. When a supplier processes data under our instructions, it acts as a processor or service provider, depending on the context.

The channel for privacy and exercising your rights is [email protected].

• Account and identity: name, email, photo and identifiers provided by Google sign-in.
• Profile: phone or WhatsApp, city, state, country, professional summary, experience, qualifications and preferences.
• Résumé: uploaded or generated files and information extracted for filling in and improvement. Photos or screenshots of a résumé are used only for AI reading and are not stored.
• Platform use: jobs viewed, dismissed or saved, applications, templates, conversations with H2A AI, settings and limits.
• Gmail: connected address, authorization and technical credentials needed to send messages. We do not request read access to the inbox.
• Payment: plan, subscription status, invoices and necessary billing data. The provider processes payment data under its own rules.
• Security and operations: IP address, device, browser, access logs, errors and anti-fraud events.
• Visitors without an account: email and preferences (state, role, start month or hourly rate) you enter in the job alert, checklist, email template and calculator forms, together with the page where you asked and the date of consent.
• Emails: delivery, failure, unsubscribes, clicks and approximate opens when the tracking pixel loads.

• Create and protect your account and complete onboarding.
• Show jobs and personalize search, discovery and Autopilot.
• Generate, store and attach résumés; create templates and send applications.
• Provide AI, support, history, notifications and profile improvement.
• Manage plans, billing, limits, fraud prevention and customer service.
• Send job alerts and materials you requested, when you give your email without creating an account. You can unsubscribe at any time.
• Measure delivery and approximate opens of emails and keep application records.
• Comply with legal obligations, respond to authorities and defend rights.
• Improve the product's security, performance and experience.

Depending on the purpose, we use the bases set out in Brazil's General Data Protection Law (LGPD): performance of a contract or preliminary procedures; compliance with a legal or regulatory obligation; regular exercise of rights; legitimate interest with an assessment of necessity and impact; and consent when it is required.

You can consult Law No. 13,709/2018 (LGPD).

Sign-in may provide name, email, photo and account identifier. For applications, we request only the gmail.send permission, used to send the messages you prepare or authorize. We do not read, import or sync your inbox.

The use of data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data or use it for personalized advertising.

Authorization tokens are stored to keep the connection and can be revoked by the user in Google settings.

When you use AI features, the text needed to carry out the request may be sent to the DeepSeek model provider. This may include a question, profile information, résumé, job or template content, depending on the chosen function.

If you submit a photo or screenshot of your résumé, the image is sent to the same provider solely to be read and turned into résumé text, which you review in the editor. We do not keep the image.

Avoid including unnecessary sensitive data. The result is not automatically saved as a final decision when the interface requires your review and confirmation.

We share the minimum necessary with suppliers that support the service, such as hosting and database, S3-compatible storage, Google authentication and Gmail, DeepSeek AI, payment through UvviPay and any communication and security services configured.

Application and résumé data are sent to the employer when you start or authorize the application. We may also share information when required by law, for security or to defend rights. We do not sell personal data.

Some suppliers and recipients are in the United States or other countries. Data may therefore be processed outside Brazil for authentication, storage, AI, email sending and applications. We adopt contractual, technical and organizational measures consistent with the LGPD and limit the transfer to the necessary purpose.

We keep data while your account is active and for the period needed to provide the service, meet obligations, prevent fraud, resolve disputes and exercise rights. Periods vary according to the type of data and the purpose.

Where applicable, data is deleted or anonymized once the need ends. Backups may remain for a limited technical period until they are replaced.

We use access controls, protected connections, per-user segregation, operational logs and restricted credential storage. No system is entirely immune; in the event of a relevant incident, we will adopt the containment and communication measures required by law.

Under the LGPD, you may request confirmation and access, correction, anonymization, blocking or deletion where applicable, portability under the regulations, information about sharing, review of automated decisions, withdrawal of consent and objection to irregular processing.

To protect your account, we may ask for identity confirmation. Send your request to [email protected]. You may also file a petition with Brazil's National Data Protection Authority.

To close your account, see the Delete account and data page.

We may update this Policy to reflect changes in the product, suppliers or applicable rules. Relevant changes will be highlighted on the platform or communicated through an appropriate channel, and the date at the top will indicate the current version.