Privacy Policy

Who decides how data is used

Hest determines the processing needed to run the platform, including accounts, authentication, support, security and billing. Each business decides how it uses customer data for its services, bookings, contact lists and any marketing it chooses to carry out. When Hest processes that data on a business’s instructions, it acts as a processor. The business is responsible for the purposes it decides on, including how it uses exported contacts.

Data we use

We use details such as your name, username, email address and credentials to create and access an account. Your profile may include a photo. A business can add its address, business information, services, prices, hours and photos. It can also add professionals and invite them by email.

For a booking, we use the name, email address, phone number if provided, service, professional, time and booking status. If the appointment is for someone else, we may receive their name. Businesses can also enter personal data when they add bookings or contacts. When a customer rates a service, the rating is linked to the booking.

We process technical connection data, such as IP addresses, to operate and protect the platform. If you choose to use your location in search and grant permission in your browser, Hest uses approximate coordinates to suggest a city. You can also select the city manually.

Why we use the data

We use data to authenticate accounts, manage permissions, show published pages and operate bookings, calendars and contacts. Email lets us verify accounts or bookings, deliver invitations, send confirmations and reminders, notify customers of changes and answer support requests. You may need to provide certain data to complete a booking or account action.

Where Brazil’s General Personal Data Protection Law (LGPD) applies, the legal basis depends on the purpose. Contract performance or steps requested by the person may support registration, bookings and billing. Legal obligations may require retaining some records. Legitimate interests may support proportionate security and abuse prevention measures, subject to individuals’ rights. Where consent is necessary, we ask for it for the specific purpose.

Public information and data recipients

When a business publishes its page, the details it selects for display, such as its trading name, address, services, prices and public staff profiles, may appear on its page and in Hest search. Booking contact details are available to the business and to authorized professionals according to their role.

Vercel hosts the website and platform. Supabase provides the database, authentication and storage. Resend delivers platform emails. Google may be involved in authentication if you choose Google sign-in when it is available. This website also loads Google fonts, which connects your browser to that provider. If a business requests an address lookup in the dashboard, the postal code is looked up through ViaCEP in Brazil and Zippopotam.us in other supported countries.

Stripe operates checkout for subscriptions and, where offered, online booking payments. It receives payment method data directly. Hest receives transaction details such as identifiers, amounts and status so that it can link a payment to the subscription or booking. For online booking payments, the email address may be sent to Stripe for checkout.

We may provide data as required by law or a valid order from a competent authority. Providers may process data in other countries, subject to applicable international transfer requirements. External links, such as articles and social media, lead to services with their own policies.

Cookies and browser storage

The platform uses a temporary cookie to maintain the session during booking email verification. The dashboard and search use browser storage to keep sessions and preferences such as language and theme. Clearing or blocking this storage may require signing in again, verifying your email again or resetting your preferences.

Security and retention

The platform uses HTTPS, access verification and role-based permissions. Keep your password, emailed codes and booking management links protected.

Retention depends on the purpose and type of record, including operating the account or booking, maintaining business records and meeting applicable legal obligations. You can ask to close your account or delete data. Requests are assessed under the applicable rights and legal grounds for retention.

Your rights and how to exercise them

Under the LGPD, you can request confirmation of processing, access, correction and information about data sharing. Where applicable, you can also request portability, anonymization, blocking or deletion, object to improper processing, learn the consequences of withholding consent, withdraw consent or request review of decisions made solely by automated processing that affect your interests.

For privacy questions or requests about data Hest processes, email sac@hest.me. We may need to verify your identity to protect your data. If your request concerns how a business uses your information, contact that business. Where applicable, you can submit a petition to Brazil’s National Data Protection Agency (ANPD).

Updates to this policy

The current version is available on this page. We will communicate relevant changes as required by applicable law.