Privacy Policy

1. Who we are

NewBuildRadar (newbuildradar.com) is operated by [Legal entity name to be confirmed], [address to be confirmed], [registration number to be confirmed]. Privacy contact: contact@andersongeremias.com.

2. Data we collect

Visitors without an account: favorites/likes, saved searches, buyer profile and display preferences stay only in your browser's local storage and are not sent to us.

With an account: email; password stored only as a bcrypt hash — we never store the password itself; date and version of your acceptance of the Terms and this Policy; optional news opt-in (off by default) and its date; language; favorites/likes; saved searches/alerts; buyer profile and comparison selection; active sessions (hashed random identifier and expiry).

Tour/contact form (when you submit it): name, email, phone and message, used to answer your request.

Security: IP address and hashed email to rate-limit access attempts, kept up to 24 hours.

We do not collect SSN, national ID, home address or payment data.

3. Purposes and legal bases

Create and maintain your account and sync your data across devices (performance of the service you requested).

Send transactional emails: email confirmation and password reset (performance of the service).

Protect against abuse and unauthorized access (legitimate interest / security).

Send news only if you opt in (consent, revocable at any time).

4. Cookies

We only use essential cookies: nbr_user_session (login session, HttpOnly, up to 30 days) and nbr_user_csrf (protection against forged requests). No advertising or third-party tracking cookies. Theme and language preferences stay in local storage.

5. Sharing and processors

We do not sell your data. Vendors that process data on our behalf: hosting (Hostinger VPS) and a transactional email provider ([email provider to be confirmed]), which receives your email address and the message only to deliver it. Data may be processed outside your country with appropriate contractual safeguards.

6. Retention

Account data: while the account exists. When you delete your account we permanently erase the account, favorites, searches, preferences, sessions and tokens. Unconfirmed accounts may be removed after [period to be confirmed]. Rate-limit records: up to 24 hours. Backups may keep copies for up to [period to be confirmed] before being overwritten.

7. Your rights

Under the LGPD (Brazil), the GDPR (EU) and US state laws such as the CCPA/CPRA, you may: access and export your data (“Download my data” in My account); correct data; delete your account (“Delete account”); withdraw consent; and request information about processing. We do not sell or share data for cross-context behavioral advertising. Requests: contact@andersongeremias.com. You may also complain to your data protection authority.

8. Security

HTTPS, bcrypt password hashing, hashed random session tokens, single-use expiring links, CSRF protection and rate limiting. No system is 100% secure; we will notify as required by law in case of a relevant incident.

9. Children

The service is not intended for anyone under 18.

10. Changes

We may update this Policy. Relevant changes will be announced on the site and account holders may be asked to accept again.