Privacy Policy · The Outsider Hub

Who we are and when this policy applies

This Privacy Policy explains how The Outsider Hub LTDA, a Brazilian company registered under CNPJ 64.545.681/0001-56, headquartered at Rua Pais Leme, 215, Suite 1713, Pinheiros, São Paulo, SP, Brazil, ZIP 05424-150 ("The Outsider Hub", "we"), handles your personal data. Under Brazil's General Data Protection Law (Law No. 13,709/2018, "LGPD"), we are the controller of this data.

It applies to the theoutsiderhub.com website, to conversations with Nooi, our virtual assistant, to the contact, careers and waitlist forms, and to the emails the website sends. In short:

We only collect what we need to reply to you, review applications and let you know about launches.
We do not sell, rent or trade your personal data.
The website's database runs on servers in Brazil (São Paulo).
Analytics and marketing cookies are only turned on with your consent.
You can access, correct or ask us to delete your data at any time, free of charge, at privacidade@theoutsiderhub.com.

This policy does not cover data we process inside client projects. In those cases we act on the client's behalf, as a processor, and the rules are set in our contract with them. It also does not cover third-party websites you reach through links on this site.

Data we collect

We only receive personal data when you provide it or when your browser sends it as you use the website:

Chat with Nooi: name, email, WhatsApp number, company, service of interest, company revenue range (you can choose not to say), preferred language for support and the page where the chat started.
Contact form: name, email, company, WhatsApp number (optional), service of interest and the message you write.
Job applications: name, email, LinkedIn or portfolio, area and role of interest, your answer about why you want to work with us and your résumé in PDF.
Product waitlist: email and language.
Consent record: on every form, we store the date and time you agreed and the version of this policy in force at that moment.
Technical and security data: IP address, date and time of access, browser and device type, and technical signals used to tell people apart from bots.
Cookies and similar technologies: essential ones are always on; analytics and marketing depend on your choice. Details in our Cookie Policy.
Direct contact: whatever you send us by email, WhatsApp or LinkedIn.

Sensitive data. We do not ask for data about health, racial or ethnic origin, religion, political opinions, union membership, sex life, genetics or biometrics. Please keep this data, and ID numbers such as CPF and RG, out of your résumé. If it is there, it is not used in the review.

Other people's data. If you share data about someone else, such as a colleague at your company, you confirm you are authorized to do so.

How we use it and on what legal basis

Each use has a defined purpose and a legal basis under the LGPD (art. 7). We do not use your data for anything other than what is listed here:

Replying to you: Reading your message or your answers to Nooi, talking to you by email or WhatsApp, understanding your company's needs and preparing a proposal.; LEGAL BASISPre-contractual steps at your request (art. 7, V)
Chat copy: Sending a summary of what you told us to your email, so you have a record of your request.; LEGAL BASISPre-contractual steps (art. 7, V)
Reviewing applications: Assessing your profile for the chosen role and talking to you about the hiring process.; LEGAL BASISPre-contractual steps at your request (art. 7, V)
Talent pool: Keeping your résumé for up to 12 months to consider you for future roles with a similar profile.; LEGAL BASISConsent (art. 7, I)
Waitlist: Emailing you when the chosen product launches.; LEGAL BASISConsent (art. 7, I)
Website security: Blocking bots, spam, fraud and excessive attempts, and investigating incidents.; LEGAL BASISLegitimate interest (art. 7, IX)
Access logs: Keeping IP, date and time of access, as required by Brazil's Internet Civil Framework.; LEGAL BASISLegal obligation (art. 7, II, and Law No. 12,965/2014, art. 15)
Visit statistics: Counting visits, page views, referrers and device types in aggregate, without cookies and without identifying you.; LEGAL BASISLegitimate interest (art. 7, IX)
Audience and campaign measurement: Understanding, in aggregate, how the website is used and measuring ad results.; LEGAL BASISConsent, via cookies (art. 7, I)
Defending our rights: Keeping the minimum needed to respond to complaints, lawsuits or requests from authorities.; LEGAL BASISRegular exercise of rights (art. 7, VI)

When you tick that you agree to this policy, we record that agreement to show you were informed about the processing. For uses based on legitimate interest, we first check that they do not override your rights, and you can object to them at any time.

The data requested in the forms is needed for us to reply to you through that channel. If you prefer not to provide it, you can reach us directly at contact@theoutsiderhub.com.

Nooi, automated decisions and WhatsApp

Nooi is a virtual assistant with predefined questions. It organizes your answers and hands them to our team. Nooi does not use generative AI models to analyze what you write, and your answers are not used to train AI models.

We do not make decisions about you based solely on automated processing, such as profiling clients, approving candidates or setting prices. People on our team read and decide. If that ever changes, we will update this policy first and you will be able to ask for the decision to be reviewed, as provided in art. 20 of the LGPD.

At the end of the chat, if you tap Continue on WhatsApp, your browser opens WhatsApp with a ready-made message. You decide whether to send it. From then on, sending and storing those messages is also subject to the terms and privacy policy of WhatsApp, a service operated by Meta. On our side, we only use the conversation to handle your request.

International transfers

Our main database is in Brazil. Some providers, such as Vercel, Resend, Google, Meta and LinkedIn, are based or have servers outside Brazil, mainly in the United States, and may process data there.

These transfers follow art. 33 of the LGPD and ANPD Resolution CD/ANPD No. 19/2024, based on standard contractual clauses or another valid mechanism, and only take place with providers that offer an adequate level of protection.

How long we keep it

We keep data only for as long as each purpose requires:

Contact and Nooi chats: Answers, messages and emails about your request. If you become a client, the data then follows the contract.; PERIOD24 months after last contact
Applications and résumés: Data and résumé of applicants. Deletion is automatic.; PERIOD12 months
Unfinished résumé uploads: Files uploaded without the application being completed.; PERIOD7 days
Waitlist: Email of people who asked to be notified of a launch.; PERIODUntil launch or until you opt out
Access logs: IP, date and time, kept confidential.; PERIOD6 months (Internet Civil Framework, art. 15)
Cookie choice: Your consent preference.; PERIOD12 months
Analytics data: Usage statistics linked to cookie identifiers.; PERIODUp to 14 months

After these periods, data is deleted or anonymized. We only keep it longer when the law requires it or when it is needed to defend rights in legal proceedings, as allowed by art. 16 of the LGPD.

How we protect your data

Security is part of what we do. Among the measures we take:

Always-encrypted connections (HTTPS/TLS with HSTS).
A database reachable only from the website's server, with access rules on every table. Nothing is exposed to the browser.
Résumés in private storage, accepted only as validated PDFs and opened only through temporary links.
Bot protection, rate limiting and server-side checks on every submission.
No personal data in logs, URLs, analytics tools or error messages.
Internal access limited to the people who need the data for their work, and automatic deletion at the end of each period.

No system is completely immune to failure. If a security incident may cause you significant risk or harm, we will notify Brazil's National Data Protection Authority (ANPD) and the affected people, under art. 48 of the LGPD and ANPD Resolution CD/ANPD No. 15/2024.

Your rights

The LGPD (art. 18) gives you the right, at any time and free of charge, to:

Confirm whether we process your data and get a copy of it.
Correct incomplete, inaccurate or outdated data.
Ask for anonymization, blocking or deletion of data that is unnecessary, excessive or processed unlawfully.
Ask for your data to be ported to another provider.
Ask for deletion of data processed based on your consent.
Know which public and private entities we share your data with.
Know that you may refuse consent and what the consequences are.
Withdraw your consent at any time.
Object to processing based on another legal basis when it does not comply with the LGPD.
Ask for a review of decisions made solely on the basis of automated processing.
File a complaint with the ANPD or consumer protection bodies.

Withdrawing consent applies from then on. What was done before, while consent was valid, remains lawful.

How to exercise your rights

Write to privacidade@theoutsiderhub.com telling us what you need. To protect your data, we may ask for something that confirms the request is really yours, such as replying from the email you used.

Confirmation and access: we reply in simplified form right away, or with a full statement within 15 days (art. 19 of the LGPD).
Other requests: handled within 15 days. If we cannot fulfil a request, we explain why.
Waitlist emails: you can also leave through the link at the end of each message.
Cookies: change your choice at any time in our Cookie Policy.
Specific permissions: see how to withdraw each one on the Permissions page.

If you are not satisfied with our answer, you can file a petition with the ANPD at gov.br/anpd.

Privacy channel

The Outsider Hub is a small-sized processing agent and is therefore exempt from appointing a data protection officer (encarregado), under art. 11 of ANPD Resolution CD/ANPD No. 2/2022.

Instead, we keep a dedicated communication channel to receive requests, questions and complaints about personal data, from you and from the ANPD: privacidade@theoutsiderhub.com. Requests are handled directly by the company's management.

Children and teenagers

The website and our services are intended for businesses and adults. We do not knowingly collect data from children. If we find that a child's data was sent without the consent of a parent or guardian, as required by art. 14 of the LGPD, we delete it.

Changes to this policy

We may update this policy when we change how we handle data or which providers we use, or when the law requires it. The date and version at the top of the page show the version in force, and each consent is recorded with the matching version.

We will announce significant changes on the website and, when we have your email, by email as well. If a change requires your consent, we will ask again.