Privacy Policy

01Who we are

Bnbz Ltda. (“Bnbz”, “we” or “us”), registered under CNPJ no. 09.340.718/0001-00, with its head office at Av. Paulista, 807, suite 2315, Bela Vista, São Paulo/SP, Brazil, is the controller of the personal data processed under this Policy, which follows Brazil’s General Data Protection Law (Law no. 13,709/2018, “LGPD”).

This Policy applies to the bnbz.com.br website, the free rental income estimate, the booking website, the Owner Portal and the property management and hosting services provided by Bnbz.

02What data we collect

Property owners and prospective clients

• Contact: name, email, WhatsApp number, profile (owner, investor, real estate agency, etc.), number of properties and how you heard about Bnbz.
• Property: address, neighborhood, city, postal code (CEP), type, size, furnishing, condition, amenities, costs (HOA/condo fees, property tax and rent), photos and notes.
• Airbnb listing: when you share the link, we read the listing’s public information (title, features, amenities, rating, approximate location and photos) to fill in the form for you.
• Clients: in addition, registration data (name, CPF or CNPJ, ID and address), bank details for payouts and financial information about the managed property.

Guests

• Booking: name, contact details, CPF (for Brazilian residents) and postal code for the invoice, dates, number of guests, amounts and payment method, received directly from you or from booking platforms. Card details go straight to Stripe: Bnbz never sees or stores them.
• Check-in and agreement: ID document or passport, CPF, nationality, home address and details of accompanying guests, including photos of documents, when required by the building, the agreement or the law.
• Support: the messages you exchange with us.

Website visitors

• Browsing: IP address, browser, device, pages visited and traffic source, collected through cookies and similar technologies (see section 8).
• Estimate form: what you have already filled in is saved in your own browser so you can continue later.

We do not ask for sensitive data such as health information, religion or racial origin. Please do not include it in free-text fields.

03How we use your data

Each use has a legal basis under article 7 of the LGPD:

Prepare and send your earnings report and discuss our proposal with you

Consent and pre-contractual steps at your request

Manage the property: list it, price it, run it and pay out the owner

Performance of a contract

Handle bookings, check-in, inform the building for access control and assist guests

Performance of a contract and compliance with a legal obligation

Issue tax documents, keep accounting records and meet other legal obligations

Compliance with a legal obligation

Defend our rights in judicial, administrative or arbitration proceedings

Regular exercise of rights

Measure website usage, fix problems and improve content and security

Legitimate interest

Send news about our services, when you allow it

Consent, which you can withdraw at any time

04Estimates and automated tools

To prepare your report, we combine your property details with third-party market data (for example, from PriceLabs) and may use artificial intelligence tools to organize the analysis. Every estimate is reviewed by the Bnbz team before it is sent, and you can ask for explanations or a new analysis at any time.

The report is an estimate. It does not guarantee revenue, occupancy or nightly rates.

05Who we share data with

We do not sell or rent personal data. We only share what is necessary with:

• Providers that process data on our behalf, such as website hosting, email and cloud storage (for example, Google and Dropbox), the booking system and Owner Portal (Guesty), pricing and market data (PriceLabs), electronic signature of agreements and analytics and artificial intelligence tools.
• Booking platforms, such as Airbnb, Booking.com and Expedia, to publish listings and manage bookings. These platforms have their own privacy policies.
• The property owner and the building, to the extent necessary for the stay, security and access control.
• Banks and payment institutions (such as Stripe), to receive payments and make payouts.
• Accountants, lawyers and advisors, who are bound by confidentiality.
• Public authorities, when required by law or court order.

We require providers to adopt security measures and to use the data only for the contracted purposes.

06International transfers

Some providers store data on servers outside Brazil, for example in the United States and the European Union. We only do this with providers that offer adequate safeguards, under article 33 of the LGPD.

07How long we keep data

• Estimate requests that do not lead to a contract: up to 24 months after the last contact, so we can pick up the conversation if you wish. After that, the data is deleted or anonymized.
• Clients and guests: for the duration of the contract and afterwards for the periods required by law (for example, 5 years for tax and contractual documents).
• Website access logs: for 6 months, as required by Brazil’s Internet Civil Framework (Law no. 12,965/2014).

You can ask for deletion before these periods, unless the law requires us to keep the data.

08Cookies and similar technologies

• Necessary: make the website work, for example by remembering your choice in the cookie notice.
• Measurement: we use Google Analytics to understand, in aggregate, how many people visit the website and which pages work best.
• Local storage: keeps in your browser what you have already filled in on the estimate form, your preferred language, your search dates and, if you tick “Remember my details on this device”, your booking contact details (never your CPF or card). Estimate form data is deleted when you submit it; the rest when you untick the option or clear your browser data.
• Third-party services: card payments (Stripe) and the links to WhatsApp and social networks may use their own cookies, governed by those services’ policies.

You can block or delete cookies in your browser settings. Some website features may stop working.

09Your rights

Under the LGPD (article 18), you can request at any time:

• confirmation that we process your data and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law;
• portability of your data to another provider;
• deletion of data processed based on your consent;
• information about who we share your data with;
• information about the possibility of not giving consent and its consequences;
• withdrawal of consent;
• review of decisions made solely based on automated processing.

To request a copy of your data or its deletion, use the Your personal data page; you confirm the request by email. For your other rights, write to contato@bnbz.com.br. We reply within 15 days and may ask for information to confirm your identity. You can also file a complaint with Brazil’s National Data Protection Authority (ANPD) at gov.br/anpd.

10Security

We adopt technical and administrative measures to protect data, such as encrypted connections (HTTPS), username and password access, access restricted to team members who need the data, and providers with recognized security standards.

No system is completely immune to incidents. If an incident occurs that may cause relevant risk or harm, we will notify you and the ANPD, as required by law.

11Children and teenagers

Our services are intended for people aged 18 or over. Data of children and teenagers staying with their parents or guardians is processed only when necessary for the stay, with the guardian’s knowledge and in the minor’s best interest (article 14 of the LGPD).

12Links to other websites

The website links to third-party services such as Airbnb, WhatsApp, social networks and the booking website. We do not control their practices; we recommend reading each one’s policies.

13Data protection officer and contact

The channel for data subjects and for our data protection officer is contato@bnbz.com.br.

Bnbz Ltda. · CNPJ 09.340.718/0001-00
Av. Paulista, 807, suite 2315, Bela Vista, São Paulo/SP, Brazil

14Changes to this Policy

We may update this Policy to reflect changes in the law or in our services. The date of the last update is shown at the top of the page, and relevant changes will be announced on the website or by email.