Your data
Privacy Policy
We ask for little. We keep it briefly. We sell nothing.
This page explains what happens to your data when you use the Harven Founders website.
Who we are
Harven Founders is the student entrepreneurship league of Harven Agribusiness School, in Brazil.
The party that decides how your data is used (the controller, under Brazil's data protection law, the LGPD) is:
Harven Founders Board
To talk about your data, use the site's contact form%3A%0AMy%20name%3A%0AWhatsApp%3A%0A%0A).
What we collect, and why
When you contact the league ("Talk to the league" form):
name, email, WhatsApp number, your profile (freshman, senior student, company, mentor or other), your message if you write one, and the channel that brought you here (for example, "instagram").
We use it to reply to you. Nothing else.
When you join the waiting list ("Let me know when it opens"):
the same data, without the message.
We use it to tell you when the selection process opens. Nothing else.
When you visit the site (metrics):
- the page viewed and where you came from (the site or campaign that brought you);
- how long you stayed on each page and how far you scrolled;
- device type, browser and operating system (for example, "Safari on iPhone");
- approximate country;
- time of day, in 3-hour blocks;
- the sequence of pages in your visit, linked by a daily code.
The daily code is generated by our server from your IP address and browser, scrambled in a way that cannot be undone. It changes every day. Your IP address and full browser details are not stored.
We use no cookies. We never link a visit to your name, email or WhatsApp.
We use this to learn what works on the site: which pages get read, where people drop off, which campaign brings people in. The board sees totals and the path of each visit without a name, only the daily code. In totals, any group with fewer than 3 visitors is hidden.
To be honest with you: this code is not full anonymity. It is a pseudonym, which separates the visit from who you are, but cannot rule out every way of linking it back to you. That is why we handle this data with the same care as personal data.
To protect the form:
the sender's IP address is held for a few minutes, in server memory only, to block bulk submissions. It is not stored in our database.
We do not ask for sensitive data (such as health, religion or political views). Please don't include it in your message.
Legal basis
| What we do | Legal basis (LGPD) |
|---|---|
| Reply to your message | Your consent (art. 7, I) |
| Notify you when the selection process opens | Your consent (art. 7, I) |
| Visit metrics and visit paths, with a daily code | Legitimate interest (art. 7, IX): improving the site |
| Blocking bulk submissions by IP | Legitimate interest (art. 7, IX): form security |
Why legitimate interest applies here (the balancing test, in short):
- Purpose: understanding how the site is used in order to improve it. A real, concrete interest of the league.
- Necessity: we collect the minimum. No cookies, no stored IP, no name, no following you from one day to the next. In totals, groups with fewer than 3 visitors are hidden.
- Your expectations: measuring visits is something people expect from any website. We do not use the data for advertising, profiling or decisions about you.
- Safeguards: only the board can see it, with a login; nothing is sold or matched against contacts; everything is deleted within 13 months; you can object (see "Your rights").
You can withdraw consent at any time by sending a message through the site's contact form%3A%0AMy%20name%3A%0AWhatsApp%3A%0A%0A). This does not undo what was done before, but we stop from then on.
How long we keep it
- Contacts and waiting list: up to 24 months from submission, or until you ask us to delete them, whichever comes first.
- Visit metrics, including the path of each visit: up to 13 months.
- IP used for submission control: a few minutes, in server memory only.
After that, we delete the data or make it anonymous.
Who we share it with
We do not sell, rent or share your data for anyone's marketing.
Only the league's board can access the data, each with an individual login.
Two services process data on our behalf (processors):
- Supabase, which hosts the database.
- Vercel, which hosts the site and measures visits.
These services may store or process data outside Brazil, including in the United States. When that happens, the transfer follows article 33 of the LGPD, with contractual data protection safeguards provided by these suppliers.
We only disclose data to authorities when required by law or court order.
Your rights
Under the LGPD (art. 18), you may at any time:
- confirm whether we process your data;
- access your data;
- correct incomplete, inaccurate or outdated data;
- have unnecessary or excessive data anonymized, blocked or deleted;
- have data processed based on your consent deleted;
- receive your data to take it to another service (portability);
- know who we share it with;
- know what happens if you do not give consent;
- withdraw your consent;
- object to processing based on legitimate interest, such as visit metrics.
About visit metrics: since we do not store your IP or name, and the code changes every day, we generally cannot tell which visits were yours. If you ask, we will explain what we were able to check. Either way, this data is deleted within 13 months. If you prefer not to be measured, you can turn on your browser's tracking protection.
How to ask: write to us through the site's contact form%3A%0AMy%20name%3A%0AWhatsApp%3A%0A%0A) from the same email or WhatsApp you gave us. We reply within 15 days.
If you are not satisfied, you may contact Brazil's National Data Protection Authority (ANPD) at gov.br/anpd.
Security
- The database accepts writes only from our server, and only board members, with a login, can read it.
- No one can edit what you sent. The board can only mark a contact as "replied" or "archived".
- All traffic to the site is encrypted (HTTPS).
No system is perfect. If an incident could put you at risk, we will notify you and the ANPD, as the law requires.
Cookies
We use no tracking or advertising cookies.
Visit metrics, including visit paths, work without cookies and store nothing on your device. The board's login area uses only what is needed to keep board members signed in, and does not affect visitors.
Changes to this policy
If we change something important, we will update this page and the date at the top. If the change affects how we use data you have already given us, we will ask for your consent again.
Questions: site's contact form%3A%0AMy%20name%3A%0AWhatsApp%3A%0A%0A).
This English version is provided for convenience. In case of conflict, the Portuguese version prevails.