Privacy Policy

Version 1.3 · Last updated: 08/11/2026 · In force from publication · This translation is provided for convenience; if there is any conflict, the Portuguese version prevails.

1. About this policy

This policy explains, in plain language, how Busqueli processes personal data on the busqueli.com website, on the app.busqueli.com platform, in the mobile app, in the alerts we send and on the public pages we host. It follows the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018) and the Brazilian Internet Civil Framework (Marco Civil da Internet, Law No. 12,965/2014).

Busqueli is a business opportunities platform for companies and professionals. It gathers opportunities from public sources (such as public procurement notices and job openings advertised by companies), companies that may need a service (such as companies without a website found on Google Maps) and requests posted by people who need to hire, and alerts each subscriber to the opportunities in their line of business and region.

Our services are aimed at companies and professionals. When we say "you", we mean the person who uses the website, the platform or the app, on their own behalf (self-employed professional) or on behalf of a company.

2. Who we are and how to reach us

The data controller is Henrique Toffanin Silva Tecnologia da Informacao LTDA (trade name Toffanin Tecnologia), CNPJ 69.184.924/0001-91, with registered office at R. Dr. Luiz Migliano, 923, Apt 32, Bloco 1, Jardim Caboré, São Paulo/SP, Brazil, CEP 05711-001, owner of the Busqueli brand ("Busqueli", "we").

Channel of the data protection officer (LGPD, art. 41): contato@busqueli.com. Use this address for questions about this policy and to exercise your rights. If your company appears on Busqueli and you do not want to be contacted, use the page busqueli.com/minha-empresa (section 6).

3. Website

• Visiting the website: to deliver the pages and protect the website, our hosting provider processes the IP address, the browser and device type, the page requested, the date and the time. On the institutional website, we do not keep our own access logs and do not build visitor profiles.
• Contact form: name, company, business email and the message you write (required) and, if you choose, the plan you are interested in, with the date and time of submission. Do not write sensitive data in the message (health, religion, political opinion, biometrics, etc.) or documents.
• Form protection: we count how many submissions come from the same IP address within 10 minutes. The IP is turned into a code that cannot be read back and is kept only in temporary memory: it is not stored and does not reach us.
• Email sent to contato@busqueli.com: your email address, your name (if shown) and the content of the message and attachments.

4. Platform: your account

• Sign-up (all plans, including Free): name, email (confirmed by a code or a link we send), account type (company or self-employed professional), the line of business (segment) and the area you serve. The password is only requested after you confirm your email and is stored in protected form, never as plain text. Until you confirm your email, the account does not exist: we keep only the request (name, email, account type, WhatsApp if provided, and the IP address and browser) for 24 hours for confirmation and delete it within 7 days if it is not confirmed.
• Sign in with Google (optional): if you sign in or sign up with Google, Google sends us your name, your already verified email and a unique identifier of your Google account. We use the name to fill in your profile (you can edit it), the email to find or create your account and the identifier to recognize you on later sign-ins, even if you change your email at Google. Google also sends your profile photo, but we do not store or use it. We do not receive your Google password, do not access your Gmail, contacts or calendar and do not store any access token: after sign-in, we have no way to access your Google account. We only ask Google for the basic identification permissions (OpenID, email and profile). If an account with the same email already exists, we only link Google to it after you prove the account is yours (with the password or through a link sent to the email). You can unlink Google in Profile, after setting a password. Our internal team does not use Google sign-in. Sign-in data is also processed by Google, under its own privacy policy. The mobile app works the same way: sign-in uses Google's sign-in screen on the device, we receive the same data, we keep no token, and the app shows the notice "What Busqueli receives from Google" before the button.
• WhatsApp (optional): the number you provide only receives alerts after it is confirmed by a code sent to it, and you can turn the channel off whenever you want (by replying SAIR, "stop" in Portuguese, or in the preferences).
• 7-day trial and paid plan: we ask for the CNPJ (company) or CPF (self-employed professional), the Brazilian tax IDs. With the CNPJ, we look up the company name and address in a public database to fill in the profile. The document is used to issue the invoice and to ensure the trial is used only once per company or professional. The Free plan does not ask for a document.
• Payment: billing is handled by Asaas (Pix, boleto or card). Card details are entered in the Asaas environment: we do not receive or store them. We keep the plan, amounts, dates, payment status and invoices.
• Refund by bank transfer: when we need to refund an amount paid by boleto (for example, on withdrawal or when new terms are refused) or when the refund cannot go back through the original method, we ask you to confirm the Pix key that is the subscription's CPF or CNPJ, or to provide another Pix key or the details of an account (bank, branch, account and type). The account must be under the same CPF or CNPJ as the subscription; we do not ask you to type the holder's name or document. The data is encrypted, you only see the last digits, and only the finance team opens it, with a log, to make the transfer.
• Using the platform: the opportunities you open, the status and notes you record on each one, the amounts you report as "won" (optional), your alert preferences and the account settings. Status and notes are private to your account: our team only sees whether each opportunity is new or has already been read by the account and, for the other statuses, totals added up from at least 3 accounts; it only sees your status and notes if you grant support access, time-limited and logged.
• Posting a request (free): what you write in the request, the city and neighborhood, the contact you provide and the interested parties you choose. Your contact stays hidden and only appears to those you release it to. If you are a self-employed professional, before release subscribers see only your first name or "Self-employed professional" (your choice) and the city.
• Interest in a request: when you express interest, the poster sees your account's public profile (name, city, segments, description and website) and the short message you write.
• Public page (mini-site), if you turn it on: whatever you choose to publish (name, logo, photos, description, services, area served, business contacts and social networks) is open to anyone on the internet. If you are a self-employed professional, your name and photo are public; we never show your CPF, and the address only shows down to the city, unless you choose otherwise. We count visits on our server, without cookies.
• Access and security logs: for each sign-in to the platform or the app (with password or Google), failed attempt and sign-out, we keep the user, the IP address (and the source port, when available), the date, time and time zone, the method used (password or Google) and the result; we also keep Google linking and unlinking. We also keep the browser or the app version and device type, and relevant actions (settings changes, contact release). The law requires us to keep access logs for 6 months (Marco Civil da Internet, art. 15); after that, they are deleted. Only the authorized administrator consults them, for security or under a court order. We do not record passwords, codes or tokens in these logs.
• Alerts: for each alert sent we keep the channel, date, type and whether it was delivered, without keeping the full text. For push in the browser or on your phone, we keep the technical delivery address (token) that the browser or the app generates when you accept notifications.
• Mobile app: the app uses the same account. It has no advertising, does not track you across other apps and websites and does not read contacts, location, photos or the device's advertising identifier. To work, it uses: the alert token, stored encrypted and deleted when you sign out, remove the permission, change your password or delete your account; and a check that the call comes from the official app on a real device (Firebase App Check, with Google Play Integrity or Apple App Attest), only to prevent bots and fraud; this check sends none of your personal data. Phone alerts are delivered through Firebase Cloud Messaging (Google) and, on iPhone, also by Apple. Firebase, which sits inside the app, generates the alert token and an app installation identifier, and receives the alert, the device token (on iPhone, Apple's) and technical delivery data (app version, date, time and the IP address of the connection). The alert carries only a generic title, with no company name or phone. We do not use Firebase Analytics, Crashlytics or advertising: Firebase does not collect usage statistics or crash reports from the app.
• Support: what you write in tickets and conversations with our team.

Do not request or send through the platform sensitive data, identity documents or other people's personal data that is not necessary.

5. Platform: opportunities and where they come from

Each opportunity shows its source, with the original link and the date it was found.

5.1 Public procurement notices. They come from the National Public Procurement Portal (PNCP) and other public portals. This is publicly accessible information. It may mention the names of public servants or of individual suppliers: we do not highlight these people, do not show CPF and take you to the official document.

5.2 Job openings. We show openings advertised by companies, only from sources that have authorized us or whose terms allow this use, with the hiring company, the position, the city, the date and the link to the original opening. We do not keep the name, email or phone of recruiters, or candidates' data.

5.3 Posted requests. They are posted by people who need to hire (section 4) and are reviewed before they appear. Phone numbers, emails, CPF and full addresses written in the text are flagged for removal before posting.

5.4 Companies found on Google Maps. They come from Google Maps (Google Places) and are companies that may need a service. Data processed: name, phone, address, website and rating. See section 6 for retention, legal basis and how to opt out.

6. Companies found on Google and how to opt out

Busqueli searches Google Maps (Google Places) for companies that may need a service, for example companies without a website or with a website that does not work on mobile, and shows them to subscribing companies in that line of business and region, which may make a business contact. This opportunity is not exclusive: all subscribers in the same line of business and region can see it. Busqueli does not send messages to these companies; the contact is made by the subscriber, who undertakes in our terms to identify themselves, to say they found the company through Busqueli and to respect anyone who does not want to be contacted.

• What data: business name, phone, address, rating and number of reviews (only the total, never who reviewed), Google Maps link and website, as shown on the public Google profile. If the company is an individual micro-entrepreneur (MEI) or sole trader, this data may identify a person and is treated as personal data. We also keep the coordinates (latitude and longitude) of the place, as Google provides them.
• What we send to Google: to search, we send only the search term (for example, "bakery"), the geographic area of the search, the place identifier and, to find the center of a municipality, the name of the municipality and state. We do not send personal data of subscribers or of data subjects. As with any request, Google receives the network address of our servers.
• What we check: whether the company has a website and whether it loads, has a secure connection (HTTPS) and works on mobile. The reasons are shown to the subscriber, in a factual and dated way. We do not run security scans on the website.
• Where it comes from: from Google Maps (Google Places), from each company's public profile, and it is displayed with Google attribution.
• What we keep and for how long: we keep what Google Maps shows about the company (name, phone, address, website, rating and number of reviews), plus the search city, the qualification reasons and the dates. We refresh this data every 90 days by checking Google Maps again; anything Google no longer shows is deleted here. Each company stays on the list for at most 12 months from the capture; after that it only returns if a new search finds it. If Google can no longer find the company (or shows it as permanently closed), we delete its name, phone and address immediately. When the company leaves the list (it is no longer an opportunity, was discarded or asked to be removed), this data is deleted within 90 days; only a minimal marker remains so the company is not shown or repeated again (section 12). The coordinates (latitude and longitude) and the distance to the search point, which come from Google, are kept for 30 days from when they are recorded; after that they are deleted, and the company stays on the list with the rest of its data, which follows the periods above. Backups are replaced in cycles of up to 35 days. Alerts by WhatsApp, email and push do not include the company's name or phone. If our team records a company contact by hand (for example, after speaking with the company), that record follows the same periods and the same opt-out at busqueli.com/minha-empresa.
• Contact limit: each company found is shown to at most 5 accounts every 30 days, so that it is not approached by many people at the same time.
• Legal basis: legitimate interest (LGPD, art. 7, IX, and art. 10), ours and the subscribers', in finding companies and offering them services, using the channel the company itself made public for business contact. We carried out the balancing test and maintain the safeguards in this section.
• How to opt out: at busqueli.com/minha-empresa, without signing in, provide the company's phone or name and city. We confirm the request within 2 business days; once confirmed, the company leaves the list of all subscribers and Busqueli never shows it again. A subscriber can also record that the company asked not to be contacted, with the same effect. So that the company does not reappear, we keep a minimal, permanent record (Google identifier, CNPJ and the phone and email as a code that cannot be read back).
• You can also write to contato@busqueli.com to find out where the data came from, request correction or deletion and object to the processing.

7. What we use data for and on what legal basis

We do not sell personal data and do not use it for third-party advertising. We do not send marketing messages by WhatsApp.

8. Who we share with

• Other platform users, only as inherent to the service: subscribers in the line of business and region see the opportunities (including companies found on Google); whoever posted a request sees the public profile and message of those interested; the interested party only sees the poster's contact if the poster releases it; anyone can see the public page you turn on. Users of the same account see what the account records.
• Suppliers that process data on our behalf: Amazon Web Services (hosting, database, queues and files; servers in the us-east-1 region, Northern Virginia, United States; section 9); Cloudflare (protection, delivery of the website and platform, anti-bot and email forwarding); Resend (email delivery); Z-API and WhatsApp/Meta (delivery of WhatsApp alerts); your browser's notification services (Google, Apple or Mozilla, depending on the device) for push on the computer; Google Firebase (phone alerts, app verification) and Apple (alerts and app verification on iPhone); Asaas (billing, invoicing and refunds); Anthropic (artificial intelligence, section 10); Google (Google Maps/Places, "Sign in with Google" and the mailbox where we receive contacts).
• Public authorities, when the law or a court order requires.

These suppliers process data for the purposes of this policy, under their own terms of service and data protection terms, with confidentiality and security obligations. Google, for sign-in and Google Maps, and Asaas, for fraud prevention, also process data under their own policies. For Google sign-in, our use of the data received is limited to identifying and authenticating you, and Google is responsible for processing your Google account data. In Google Maps/Places, Google is the source of the companies' public information and receives from us only the search term and area (section 6). The use of Google Maps on the platform follows the Google Maps Additional Terms of Service (maps.google.com/help/terms_maps) and the Google Privacy Policy (policies.google.com/privacy).

9. International transfer

Where your data is. Busqueli's servers are on Amazon Web Services (AWS), in the us-east-1 region (Northern Virginia, United States). This means that the database, files, queues, access logs and backups holding your personal data are stored in the United States, outside Brazil.

The following suppliers also store or process data outside Brazil, especially in the United States: Amazon Web Services (hosting), Cloudflare (protection and delivery of the website and the platform, which may pass through servers in several countries, the closest to the visitor), Resend (sending emails), Anthropic (artificial intelligence) and Google (including Firebase and Google Maps). Apple and Meta (WhatsApp) process data outside Brazil in the services you use with them.

Legal basis for the transfer: the transfer is necessary to provide the service you contracted or requested (LGPD, art. 33, IX, read with art. 7, V) and is made with contractual safeguards that the data will have protection equivalent to the LGPD, such as the standard contractual clauses approved by the ANPD (art. 33, II, b, and ANPD Resolution CD/ANPD No. 19/2024), together with security measures such as encryption and access control. For each supplier above, these data protection terms are part of the service contract. You can request information about the transfers and a copy of the safeguards at contato@busqueli.com (LGPD, art. 18, VII).

In the company search, Google (Google Maps/Places) receives only public business data and search terms, with no personal data of individuals (section 6). In the artificial intelligence, Anthropic receives already-masked opportunity texts (section 10) and processes them in the United States.

10. Artificial intelligence and automated decisions

We use artificial intelligence (Anthropic models) to read and classify opportunities (line of business, region, type), flag personal data and prohibited content in posts and calculate how well each opportunity fits the account's profile. What we send to the artificial intelligence: the public text of the opportunity (for example, the subject, agency and place of a public tender; the title, summary, hiring company name and place of a job posting) or the text of a request posted on the platform, and our team's earlier corrections. Before sending, we remove phone numbers, emails and CPF; names of people that appear in the text are not removed (which is why third-party text also goes through human review). Your account's status, notes, profile and private data are never sent. Data from Google Maps is not sent to the artificial intelligence. The supplier does not use this data to train its models and may keep it for a limited time, under its contract.

Doubtful classifications and all third-party posts are reviewed by a person. The fit score only sorts the list and never hides an opportunity. The indication that a company "has no website" or has a "website that does not work on mobile" comes from objective, dated checks; if your company disagrees, it may request a review at contato@busqueli.com (LGPD, art. 20).

11. Cookies and storage on your device

The institutional website does not set its own cookies. Our security and delivery provider (Cloudflare) may set, on the website and on the platform, including on public pages, the technical cookie `__cf_bm`, which lasts up to 30 minutes, only serves to tell visits from bots apart and does not identify you or store your personal data. The platform only uses strictly necessary cookies and storage: keeping you signed in, protecting forms against forgery and bots (Cloudflare Turnstile) and, if you install the platform on your phone, storing the app files and the notification permission. In the mobile app, the session key is kept in the device's system vault, without going to backup, and the last list of opportunities downloaded is kept encrypted on the device for up to 72 hours, so you can check it offline (only the list fields, never contact, address or notes); it is deleted when you sign out. We do not use advertising cookies or third-party analytics tools. If this changes, this policy will be updated first, and analytics cookies will only be set with your consent.

12. How long we keep data

We keep data only for as long as needed for the purpose, to comply with the law or to defend rights:

At the end of the period, we delete or anonymize the data. Deletion requests are handled within the period in section 14, except for what the law requires us to keep or what is needed to defend rights (in which case we explain why).

13. Security

We adopt technical and administrative measures to protect data: encrypted connections, protected passwords, encrypted bank details, mandatory two-step verification for the team, complete separation between accounts (one account never sees another's data), role-based permissions, audit logs, attempt limits, anti-bot measures and supplier keys kept in a vault, never in the browser or in the app. No system is completely immune to failure. If a security incident occurs that may cause relevant risk or harm, we will notify the ANPD and the affected people within the deadlines set by regulation.

14. Your rights

Under the LGPD (art. 18), you may request:

• confirmation that we process your data and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data or data processed in breach of the law;
• portability of the data to another supplier;
• deletion of data processed with your consent;
• information about who we share your data with;
• information about the possibility of not consenting and its consequences;
• withdrawal of consent;
• objection to processing based on another legal basis (for example, companies found on Google, section 6);
• review of decisions taken solely on the basis of automated processing (art. 20).

How to request: write to contato@busqueli.com; for companies found on Google, you can also use busqueli.com/minha-empresa. On the platform and in the app, the account owner can request full deletion of the account. The request is free of charge. To protect you, we may ask you to confirm your identity before providing or deleting data. We reply within 15 days. With a paid plan, deletion of the account is scheduled for the end of the period already paid: renewal is cancelled right away, you keep using the platform until that date and the account is deleted on it. We confirm the request within 15 days and tell you the date. If you prefer, the account owner can give up the remaining period and ask for immediate deletion; in that case there is no pro rata refund. You can also complain to the Brazilian Data Protection Authority (ANPD, gov.br/anpd) and to consumer protection bodies.

15. Children and adolescents

The website, the platform and the app are aimed at companies and professionals and are not intended for people under 18. If we learn that we have received data from a minor, we delete it.

16. Changes to this policy

We may update this policy. Each version has a number and a date and is published on this page. If the change is relevant, we notify you on the website and on the platform and, where applicable, ask for a new acceptance.