Sign in or create account
I am an organiser
Sign in or create account
I am an organiser
Leorai · operator details not yet filled in on the panel.
Version in force since 2026-07-30.
This policy explains what Leorai does with personal data, under Brazilian Law 13.709/2018 (LGPD).
Leorai is the CONTROLLER of account and platform-usage data.
Each ORGANISATION is an independent controller of the data it collects and uses in its own auctions — including the contact details of bidders and winners. What the organisation does with that data is its own responsibility.
Data enquiries: the contact channel shown in the footer
From participants: name, WhatsApp number and password (stored only as a cryptographic hash — nobody, the platform included, can read your password).
From organisations: institution name, contact name, email, WhatsApp, city, state, logo and password (hash only).
From usage: bids placed, lots saved, presence in live sessions, IP address, date and time the terms were accepted, and technical access logs — the latter kept for 6 months, as article 15 of the Internet Civil Framework requires.
We do not collect tax numbers, bank details, card numbers or payment data, because the platform does not process payments.
Creating and maintaining your account and letting you sign in — performance of a contract (art. 7, V).
Recording and displaying bids and determining the winner — performance of a contract.
Notifying you on WhatsApp about an auction you saved, a lot going live and the outcome — performance of a contract and legitimate interest (art. 7, IX).
Keeping access logs — legal obligation (art. 7, II, with art. 15 of the Internet Civil Framework).
Keeping the version, date and IP of terms acceptance — legitimate interest, to evidence acceptance.
Preventing fraud and protecting the platform and its users — legitimate interest.
With the organisation running the auction you bid in: your name and WhatsApp number, so it can arrange payment and delivery. The auction cannot work otherwise.
With other participants in that sale: only your first name and last initial, next to the bid, so the bidding is transparent. Your phone number is never shown to other participants.
With the hosting company that runs the servers, and the messaging service used to send WhatsApp notifications.
With authorities, where there is a court order or legal obligation.
Leorai does not sell personal data and does not release it for third-party advertising.
Account data: while the account exists, and for up to 5 years after closure, during which it may still be needed to defend a claim.
Access logs: 6 months (Internet Civil Framework, art. 15).
Bid and award history: kept as a record of what happened at the event, because the organisation and the participant may need it.
You may request at any time: confirmation that we process your data; access to it; correction of anything wrong; anonymisation, blocking or deletion of unnecessary or unlawfully processed data; portability; information about who we share it with; and withdrawal of consent.
Write to the contact channel shown in the footer. We answer within 15 days.
Some data cannot be deleted immediately: the access logs the law requires us to keep for 6 months, and the record of a bid that created an obligation towards an organisation.
Passwords are stored only as a cryptographic hash. The site is served over a secure connection (HTTPS). Database access is restricted.
No system is impenetrable. Should a security incident occur with material risk, we notify the data subjects and the Brazilian data protection authority, as article 48 of the LGPD requires.
If this policy changes, the new version is published here with its date. Material changes are notified through the contact channels on record.
Version in force since 2026-07-30.