Privacy Policy

Last updated: 2026-10-23

BrazilKeys ("we") runs the guide and the for-sale-by-owner marketplace at brazilkeys.com. This policy says what we collect, why, who processes it, how long we keep it and what your rights are under Brazil's LGPD, the EU/UK GDPR and California's CCPA. Privacy requests: privacy@brazilkeys.com (our data protection contact, the encarregado under the LGPD).

1. What we collect and why

  • Account. Your email address (used to sign you in with an emailed link; no password is stored), the name you choose to show, an optional WhatsApp number, and for brokers the CRECI number and company. Basis: performance of the contract (your account). Sign-in links expire after 30 minutes; sessions last 90 days.
  • Public profile (optional). If you switch on "Show my profile in the community", anyone can see your profile photo, name, headline, bio, where you live, areas and interests, years in real estate, languages and the social links you added (Instagram, Facebook, LinkedIn, TikTok, YouTube, website), plus your live listings. Your email and WhatsApp are never shown there. Profile photos are checked by an automated image review (Cloudflare Workers AI) for nudity, violence and advertising. Basis: your consent, which you withdraw by switching the profile off or deleting the photo or your account. Apart from Facebook sign-in (next item), we do not connect to or read your social media accounts; we only show the links you type.
  • Continue with Facebook (optional). If you sign in with Facebook, Meta sends us your Facebook user ID, name, email address and profile photo, and nothing else: no friends, posts or pages, and we never post on your behalf. We use them to sign you in, to fill an empty name and an empty profile photo (the photo passes the same automated review). Basis: your request (performance of the contract). To remove it, delete the app in Facebook > Settings > Apps and websites (Meta then tells us and we delete the Facebook ID and the photo that came from Facebook), or delete your account here.
  • Listings. Everything you put in a listing: text, price, size, address, photos, links, the title-status you declare. Published listings are public by design. The street number and apartment are never shown; the map shows an approximate point unless you switch on "show exact location". Basis: contract.
  • Messages to sellers. When you contact a seller we store your name, email, phone (optional) and message, send them to that seller by email, and show them in the seller's account. Basis: your consent, given on the form. We never give your email to anyone else.
  • Automated review of listings. Every listing is checked automatically before it is shown: required content, plausible price per m², duplicate photos and text across all accounts, and an AI model's read of the text for scam patterns. The result can publish, hold or reject a listing. We keep a record of each check and, for listings that were rejected, held, reported or removed, a snapshot of the listing for up to 24 months, to stop the same content coming back from a new account. Basis: legitimate interest (fraud prevention) and the protection of other users. You can ask for a human review of any automated decision by writing to privacy@brazilkeys.com (LGPD art. 20).
  • Reports. If you report a listing we store the reason, your email and a hashed IP for 24 months.
  • Server logs. Cloudflare logs IP address, user agent and request for security; we keep a hashed form of the IP in rate-limit counters for 2 days. Basis: legitimate interest (security).
  • Analytics. Only after you click "Accept all": Google Analytics 4 (G-HFLR7HYQQK) records pages viewed, approximate location and device. Basis: consent.

2. Cookies

Essential: bk_lang (your language, 1 year), bk_consent (your cookie choice, 1 year), bk_s (your sign-in session, 90 days), fsbo_src (how you first reached us: the referring website, any campaign tags in the link, the first page and the time; 90 days; no personal data; if you create an account it is kept with it so we know which channels bring owners). With consent only: _ga and _ga_* (Google Analytics, up to 14 months). "Essential only" sets none of the analytics cookies and keeps map tiles off until you click "Show map". Change your choice any time with "Cookie settings" in the footer.

3. Who processes data for us

  • Cloudflare, Inc. (US/EU): hosting, database, photo storage, the automated-review model (Workers AI), transactional email, Turnstile bot check on forms. Privacy policy.
  • Google LLC (US): Google Analytics, after consent only; YouTube embeds load only when you click play (youtube-nocookie.com). Privacy policy.
  • OpenFreeMap (EU): map tiles on listing pages, loaded after consent or when you click "Show map". Esri (US): satellite imagery and map labels on the search map, loaded the same way; Esri receives your IP address and the map area you view. Privacy policy. OpenStreetMap Foundation (Nominatim) (EU): we send a listing's address, server side, to place its pin.

4. International transfers

Data may be processed in the United States and the European Union. Transfers rely on the providers' standard contractual clauses and certifications.

5. Retention

Account: until you delete it (footer of your account page; everything is erased within 30 days, except the fraud-prevention record above). Listings: live until you mark them sold or remove them; sold listings stay visible as a market record until you remove them; a removed listing leaves the site at once and its photos are deleted (the fraud-prevention record above stays). Messages: 12 months. Reports and automated-review snapshots: 24 months. Analytics: 14 months. Logs: 30 days.

6. Your rights

LGPD (Brazil): confirmation, access, correction, anonymisation, deletion, portability, information about sharing, revocation of consent, review of automated decisions. We answer within 15 days. GDPR (EU/UK): access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and a complaint to your supervisory authority; 30 days. CCPA (California): know, delete, correct, opt out of sale or sharing (we do not sell or share personal information), non-discrimination; 45 days. Write to privacy@brazilkeys.com. "Download my data" in your account gives you a JSON copy at once.

7. Children

The service is for adults. We do not knowingly collect data from anyone under 18.

8. Security

HTTPS everywhere, passwordless sign-in, access limited to the people who run BrazilKeys. No system is perfectly secure; tell us at privacy@brazilkeys.com if you find a problem.

9. Changes

Changes are posted here with a new date.