Privacy Policy — Mylar Pro Brokers App

My Lar, a private legal entity registered under CNPJ No. 54.865.990/0001-50, is the Data Controller of the personal data processed through the App, pursuant to Article 5, VI of the LGPD. Data Protection Officer (DPO): Email: [email protected]

We collect only data necessary for the App to function: • Account data: full name, email, phone, Brazilian tax ID (CPF), real estate license (CRECI, where applicable), profile photo. • Professional data: affiliated real estate agency, role, permissions, activity history in the App. • Documents: files uploaded by the user (ID, tax documents, proof of address, license, contracts) for approval by the agency. • Usage data: access logs, IP address, device identifier (Device ID), device model, OS version, App version, language. • Location data (optional): approximate or precise coordinates, collected only when recording an in-person signature during property inspection, as optional proof of location. • Photos and media: images captured by the camera or selected from the gallery for inspections, reports, document scanning, and profile photo updates. • Push notification token: device identifier with Expo/Firebase/Apple Push Notification Service for sending notifications. We do not collect sensitive data (health, biometrics, race, religious beliefs, sexual orientation) and we do not perform cross-app advertising tracking (NSPrivacyTracking = false).

The App requests the following permissions, always with the user's explicit consent at the time of use. You may refuse or revoke any permission at any time in your device settings — specific features will be limited accordingly. • Camera (android.permission.CAMERA / NSCameraUsageDescription): Used exclusively to capture photos during property inspections, scan identification documents, and update the profile photo. Images are not shared with third parties outside the operational flow described in this Policy. • Photos / Gallery (android.permission.READ_MEDIA_IMAGES / NSPhotoLibraryUsageDescription): Used to allow the user to attach existing device images to inspections, submit documents for approval, and select a profile photo. • Approximate and precise location (android.permission.ACCESS_COARSE_LOCATION, ACCESS_FINE_LOCATION / NSLocationWhenInUseUsageDescription): Collected only while the App is in active use (when-in-use), exclusively when recording an in-person signature during property inspection, as optional proof of signature location. Background collection never occurs. • Notifications (expo-notifications / APNs / FCM): Used to send inspection reminders, negotiation status updates, internal agency communications, and operational alerts. • Secure local storage (expo-secure-store / expo-sqlite): Used to store authentication tokens, user preferences, and data cache for limited offline functionality. Data remains encrypted on the device.

We use your personal data for the following purposes, based on Articles 7, V (contract performance) and 7, IX (legitimate interest) of the LGPD: • Authenticate the user and maintain an active session. • Enable professional activities linked to the contracting real estate agency (lead management, inspections, contracts, negotiations, clients). • Approve or reject professional documents submitted by the broker. • Send operational notifications (reminders, updates, announcements). • Prevent fraud, ensure App security, and comply with legal obligations. • Improve user experience and develop new features.

Your data is shared only with operators essential to the App's functioning, all under data protection agreements: • Cloudflare R2 (file and image storage) — S3-compatible storage. • Google Firebase / Firebase Cloud Messaging (Android push notifications). • Apple Push Notification Service (iOS push notifications). • Expo (push notification and app update services). • Sentry (error and crash monitoring). • SendGrid (transactional email). • Twilio (SMS / OTP delivery). • Stripe / ASAAS (payments, when applicable). • Evolution API (WhatsApp integrations, when applicable). We do not sell, rent, or transfer your personal data to third parties for marketing purposes. Part of the data may be stored on servers outside Brazil (United States, European Union). In such cases, we adopt contractual safeguards required by LGPD (Article 33) and standard international transfer clauses.

Your personal data is retained while your account is active or as required by law (e.g., tax, labor, and CRECI/COFECI regulatory obligations). Upon account closure: • Operational data is anonymized or deleted within 90 days. • Documents and records with legal retention requirements (contracts, tax receipts) are kept for the applicable legal term and subsequently deleted. • Encrypted backups may contain residual copies for up to 180 days before being overwritten. You may request account deletion at any time inside the App (Profile → Delete account) or by emailing [email protected].

We adopt appropriate technical and organizational measures to protect your data, including: • Encryption of data in transit (TLS 1.2+) and at rest. • Authentication tokens stored in native secure storage (iOS Keychain / Android Keystore). • Role-based access control (RBAC) under the principle of least privilege. • Audit logs and continuous monitoring via Sentry and Datadog. • Multi-factor authentication via OTP for sensitive operations (email change, account recovery). No system is 100% secure. In the event of a security incident with relevant risk, we will notify you and the Brazilian Data Protection Authority (ANPD) as required by Article 48 of the LGPD.

You may exercise the following rights free of charge: • Confirmation of the existence of processing. • Access to the personal data we hold. • Correction of incomplete, inaccurate, or outdated data. • Anonymization, blocking, or deletion of unnecessary data or data processed in violation of the LGPD. • Portability of data to another provider. • Deletion of data processed under consent. • Information on public and private entities with which we share data. • Withdrawal of consent at any time. • Objection to processing carried out under legitimate interest. To exercise any right, email [email protected]. We will respond within 15 (fifteen) days.

The App is intended exclusively for users 18 years of age or older (or legally emancipated), acting in a professional capacity. We do not intentionally collect data from minors. If you believe data has been collected improperly, please contact us for immediate deletion.

We may update this Policy periodically. The latest version will always be available at https://mylarpro.com.br/brokers/privacy-policy. Material changes will be communicated within the App and by email with a minimum of 15 days' notice.

This Policy is governed by the laws of the Federative Republic of Brazil. The courts of the user's domicile shall have jurisdiction over any disputes, pursuant to the Brazilian Consumer Protection Code when applicable.