What Hub Odara collects, why, for how long, and how you take it out.
Hub Odara connects brands and content creators. To do that we store your account details, the profile you build here, and the results of the campaigns you run through the platform. If you connect your Instagram account, we also read the public figures of your professional profile and the metrics of the posts you deliver as part of a campaign. If you buy a ticket or receive a pass for an event, we also keep the ticket and payment details, but never your full card number. We do not sell any data, to anyone.
Name, email, phone number, city, date of birth, and your Brazilian tax number (CPF or CNPJ) when you provide it. We use these to identify you, give you access, formalise contracts, and meet tax obligations. Legal basis: performance of a contract and legal obligation (LGPD, art. 7, V and II).
We also record the date and time of your sign-ins and the IP address of your most recent one, for account security. Legal basis: legitimate interest (art. 7, IX).
Display name, photo, bio, city, website, content niches, and the social accounts you declare. This is what a brand sees when choosing who to work with. Legal basis: performance of a contract.
Connecting is optional, done by you, and can be undone at any time under
My Profile. While the connection exists, using the
instagram_business_basic and
instagram_business_manage_insights permissions, we read:
This serves two purposes: proving to the brand what you delivered, so you never have to send a screenshot, and filling in only the fields left blank on your Hub profile. Legal basis: consent (art. 7, I), recorded with the date, time, and the exact version of the text you accepted.
What we never do: we do not read your direct messages, we do not access your follower list, we never post on your behalf, and we do not collect data about the people who interact with you. The metrics we read are aggregate numbers about your posts, not about the people who saw them.
Proposals, agreed values, deadlines, deliverables, messages exchanged on the platform, and the figures for each delivery. This is the record of the contract between you and whoever hired you. Legal basis: performance of a contract.
When a campaign uses a Hub short link, we count how many clicks it received each day. We do not store IP addresses, browsers, locations, or any identifier of who clicked: what remains is one number per day, and it is impossible to work backwards from it to a person.
When you buy a ticket, apply for a Creator Pass, or enrol in a Guest Pass
for an event at creators.hubodara.com, we collect: full name, email, CPF
(Brazilian taxpayer number), WhatsApp phone number, city, Instagram @
handle, the follower range you declare, the code of the person who invited
you (if any), the tracking parameters of the link you arrived through
(utm_source, utm_medium, and
utm_campaign), the IP address of the purchase and, on the day
of the event, the time of your check-in. For the Guest Pass, also the
message you write to the person who invited you. For card payments, also
the card details (number, name on the card, expiry date, and security code)
and the cardholder's postcode (CEP), house number, and phone number, which
are passed on to N7 Pay.
What each of these is for:
Cards: card details travel encrypted, over HTTPS, to the Hub's servers, which pass them on immediately to N7 Pay, and through it to the Asaas gateway, solely to process the charge. The Hub and the organiser do not store the full card number or the security code, and neither is kept in any system log: all that is kept of the card is the card brand and the last four digits.
Every ticket and every pass lives in a Hub account. If you do not have one yet, we create a participant account with the email address you gave, and you set the password through a link. It shows your tickets and lets you connect Instagram (section 2.3), but it is not shown to brands and is not suggested for campaigns. Anyone whose Creator Pass is approved by the curation team gets a creator account.
If the event sells out and you join the waiting list, we keep your name, your email and, if you give it, your phone number, only to let you know when a place opens up. Legal basis: steps prior to entering into a contract, at your request (art. 7, V).
The event is photographed and filmed for its coverage and promotion, and attendees may appear in the images, as stated in the Terms of Use.
On event pages, the Continuar com Instagram ("Continue with Instagram") button proves the Creator Pass criterion (10,000 followers or more) instead of you only declaring it. When you use it, we read from your Instagram, at that moment, only the @ handle, the account type, and the follower count, together with the account identifier, which Meta sends along with them and which we use to recognise the same profile.
We keep no access token from this read, so it does not become a connection and does not repeat on its own: the Hub only reads your Instagram again through the connection in section 2.3, made by you. What was read stays with your request as evidence for the curation team, which reviews the request all the same. If that Instagram account is already linked to a Hub account, the same button also signs you in. If you are signed in to your account when you use the button, the identifier is linked to it so you can sign in with Instagram next time, with no token kept and nothing else read. Legal basis: steps prior to entering into a contract, at your request (art. 7, V).
In the ticket checkout, the Continue with Google button fills in your order with the name and e-mail address of your Google account, as confirmed by Google. That is all we receive, along with the account identifier, which we do not keep. We keep no access token, read nothing else and do not sign you in to a Hub account through this button: the name and e-mail stay on your order as if you had typed them. Legal basis: steps prior to entering into a contract, at your request (art. 7, V).
The Hub may contact you on WhatsApp about your registration, your Creator Pass application, and the replies you send. For that, we store your phone number, the messages exchanged with Odara's numbers, and your participation in the Odara community groups that the curation team follows, including the messages sent in those groups, which the team reads to organize the community and its challenges. Records of conversations with Odara are kept for operational and audit purposes; group messages are deleted 180 days after they are sent; and the technical notifications we receive from WhatsApp are deleted 14 days after they are processed.
To stop automated messages, reply SAIR or PARAR ("stop" in Portuguese). To receive them again, reply VOLTAR. You can also ask us to delete this data at any time by writing to dpo@hubodara.com. Legal basis: performance of a contract and steps prior to it, when we contact you about your registration and your application (art. 7, V), and legitimate interest, in organising the community (art. 7, IX).
We do not sell data and we do not use it for advertising. Contact about Odara mentoring and opportunities only happens if you authorise it (section 2.6).
Part of our infrastructure sits outside Brazil, and the Instagram API is operated by Meta in the United States, as "Continue with Google" is served by Google. These transfers happen in order to perform our contract with you and to carry out what you consented to when connecting the account (LGPD, art. 33, II and VIII).
The LGPD (art. 18) gives you the right to confirmation of processing, access, correction, anonymisation, portability, information about sharing, withdrawal of consent, and deletion. To exercise any of them, write to dpo@hubodara.com. We reply within 15 days.
Two of them you can do yourself, without asking anyone:
If you removed the Hub Odara app from within Instagram itself, Meta notifies us and we delete that connection's data automatically. You can follow that request on the status page we provide at the moment of removal.
Traffic over HTTPS, passwords stored as hashes, and the Instagram token and the CPF in event orders, passes, and tickets encrypted at rest. Card details pass through the Hub only in transit, encrypted, on their way to N7 Pay: the full card number and the security code are never written to the database or to system logs. Internal access is limited to the people who operate curation and events. No system is immune, and we notify you and the Brazilian data protection authority (ANPD) in the event of a relevant incident.
Hub Odara is for people aged 18 and over, and that also applies to event tickets and passes. We do not create accounts for minors and we do not knowingly collect data from children or adolescents. If you know of such an account, write to our DPO and we will delete it.
When this policy changes, the date at the top changes with it. Any change to what we collect from you, or why, is announced by email, and where consent is involved we ask for it again.
Data Protection Officer: dpo@hubodara.com. You may also lodge a complaint with the Brazilian National Data Protection Authority (ANPD).