Privacy Policy

ObraSoft Tecnologia da Informação LTDA. (trading as "Hottest Car List"), registered under Brazilian company number (CNPJ) 13.342.101/0001-92, with address at Avenida Engenheiro Luis Carlos Berrini, 1140, CJ 72, Cidade Monções, São Paulo/SP, Brazil, operates the website https://hottestcarlist.com and the services offered on it. Contact: legal@hottestcarlist.com.

We act as controller of the personal data processed on the site, under article 5, VI of the LGPD. The data protection officer (DPO) can be contacted at dpo@hottestcarlist.com.

Account data: name or display name, e-mail, password (stored encrypted), country, state and city, account type (owner or voter) and preferred language.

Profile and vehicle data: nickname, make, model, year, technical specification, modification history, tuning shop, photos, videos and the car's story.

Interaction data: votes, ratings, comments, reports, invitations sent and language preferences.

Technical data: IP address, access date and time, device identifiers, browser and application logs, including the access logs required by article 15 of the Brazilian Internet Civil Framework.

Subscription data: plan purchased, status, term and transaction identifiers. Full card details are collected and processed directly by Stripe; we have no access to the card number.

Creating and maintaining your account, displaying your profile and vehicles and operating the weekly vote — legal basis: performance of a contract (article 7, V, LGPD).

Processing subscriptions, issuing charges and complying with tax obligations — performance of a contract and compliance with a legal obligation (article 7, II and V).

Preventing voting fraud, ensuring security and moderating content — legitimate interest (article 7, IX).

Retaining access logs for the statutory period — compliance with a legal obligation (Internet Civil Framework).

Sending marketing and news communications — consent (article 7, I), revocable at any time.

Automatically translating interface texts and public content through artificial intelligence services — legitimate interest.

Infrastructure and hosting processors, database, media storage and transactional e-mail delivery.

Stripe, our payment processor, for card processing, subscription billing and fraud prevention.

Artificial intelligence providers used for text translation.

Legal and accounting advisers, and public authorities, when required by law or court order.

We do not sell personal data.

Some processors are located outside Brazil. In those cases, the transfer is carried out under article 33 of the LGPD, with contractual clauses and adequate protection safeguards.

Approved vehicle profiles, photos, videos, the car's story, represented country, the owner's display name and comments are public by the nature of the service. Do not publish data you would not want accessible to third parties.

We keep data while the account remains active. Deleted vehicles stay in the trash for 5 days before permanent removal.

Access logs are kept for at least 6 months (Internet Civil Framework). Tax and payment data are kept for the periods required by tax legislation. Once those periods end, data is deleted or anonymised.

Under article 18 of the LGPD, you may request: confirmation that processing takes place; access to your data; correction of incomplete or outdated data; anonymisation, blocking or deletion of unnecessary or non-compliant data; portability; information about data sharing; information about the option not to give consent; and withdrawal of consent.

Requests may be sent to dpo@hottestcarlist.com and will be answered within statutory deadlines. You may also file a complaint with the Brazilian National Data Protection Authority (ANPD).

We adopt appropriate technical and organisational measures, such as encryption in transit, row level security (RLS) access control, segregation of administrative duties and audit records of legal acceptances.

In the event of a material security incident, we will notify data subjects and the ANPD as required by article 48 of the LGPD.

We use local storage and essential cookies for authentication, session maintenance and language preference. Analytics or marketing cookies, when used, depend on your consent and can be managed in your browser settings.

The service is not intended for people under 18. If we identify an account created by a minor without proper representation, the account may be removed.

This policy may be updated. The version and effective date are shown at the top of this page, and material changes will be announced on the site.