Privacy Policy

1. Introduction

Homemarket, Inc., a Delaware corporation ("HomeMarket", "we", "us", "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use the HomeMarket app, website, and related services (the "App").

This Policy applies to users of the App outside Brazil — including the United States, Canada, the United Kingdom, and the euro-zone countries where the App is available. It includes specific sections for residents of the European Economic Area and the United Kingdom (section 10) and for California residents (section 11). Users located in Brazil are served by HOME MARKET CONSULTORIA E TECNOLOGIA LTDA. under a separate privacy policy.

Effective date: August 31, 2026.

2. Definitions

For the purposes of this Policy:

• Personal Data (or Personal Information): information that identifies, relates to, or could reasonably be linked to an identified or identifiable individual;
• Data Subject: the individual to whom the personal data refers;
• Controller: HomeMarket, the entity that determines the purposes and means of the processing of personal data;
• Processor (or Service Provider): a third party that processes personal data on our behalf and under our instructions;
• Processing: any operation performed on personal data, such as collection, storage, use, disclosure, or deletion.

3. Data We Collect

3.1. Data provided by you:

• Account data: name, email address, phone number, password (stored hashed), country, and profile photo if you add one;
• Address data: delivery address, including unit or apartment number and delivery instructions;
• Payment data: your card details are collected directly by our payment processor, Stripe; we receive only a payment token, the card brand, the last four digits, and the expiration date;
• Order data: the products you order, quantities, prices, the store you buy from, delivery status, and any ratings or reviews you leave;
• Communication data: messages exchanged with Sellers or with our support team through the in-app chat, email, or other support channels.

3.2. Data collected automatically:

• Location data: the approximate or precise location of your device (with your permission) so we can show you the stores near you; you may also enter an address manually instead;
• Device data: device model, operating system and version, language, unique device identifiers, and push-notification tokens;
• Usage and analytics data: screens viewed, products searched and viewed, interactions with the App, and crash reports;
• Log data: IP address, date and time of access, and request metadata.

3.3. Seller data (additional):

• Store name, description, opening hours, and store location;
• Identity, date of birth, tax identification, and bank-account information, collected by Stripe when you open your Stripe Connect account (we receive verification status and the last digits of the payout account);
• Information about the products sold, prices, and stock;
• Sales, payout, refund, and dispute history.

4. Purposes of Processing

We use your personal data for the following purposes:

4.1. Performance of the contract and provision of the services:

• Create and manage your account;
• Show you stores and products available near you;
• Process your orders and payments;
• Connect Buyers and Sellers and enable the in-app chat;
• Provide the delivery address to the Seller;
• Send transactional notifications about order status (push, email, SMS, or WhatsApp);
• Process payouts to Sellers and handle refunds and disputes.

4.2. Legitimate interests:

• Improve and personalize your experience;
• Develop new products and features;
• Prevent fraud, abuse, and ensure the security of the platform;
• Carry out statistical and usage analyses;
• Enforce our Terms of Use and protect our legal rights.

4.3. Compliance with a legal obligation:

• Meet accounting, tax, and financial-regulation obligations;
• Respond to lawful requests from competent authorities;
• Keep records as required by law.

4.4. With your consent (where required by law):

• Access your device's precise location;
• Send marketing communications and promotions;
• Use non-essential cookies and similar technologies.

You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Data Sharing

We share your personal data only as described below:

5.1. Sellers: when you place an order we share your name, delivery address, phone number, order details, and chat messages with the Seller responsible for your order, strictly for the purposes of preparing and delivering it. Sellers are independent merchants and are responsible for their own handling of your data.

5.2. Payment processor: Stripe, Inc. (and its affiliates, including Stripe Payments Europe, Ltd. for European users) processes card payments and Seller payouts. Stripe collects your card details directly and processes them under its own privacy policy, available at stripe.com/privacy. For Sellers, Stripe also performs identity and financial verification.

5.3. Service providers: we share data with companies that assist us in operating the App under contractual confidentiality and data-protection obligations, including cloud hosting and storage providers, email, SMS, and push-notification delivery providers, WhatsApp messaging (Meta), customer-support and analytics tools, crash-reporting services, and mapping and geocoding services (Google Maps Platform) used to locate addresses and nearby stores.

5.4. Public authorities: when required by law, court order, or a lawful request from competent authorities, or to protect our rights, safety, or property or those of others.

5.5. Group companies and business transfers: we may share data with our affiliates, including our Brazilian affiliate HOME MARKET CONSULTORIA E TECNOLOGIA LTDA., for the purposes described in this Policy, and with a successor in the event of a merger, acquisition, or sale of assets, subject to this Policy.

We do NOT sell your personal data, and we do not share it with third parties for cross-context behavioral advertising.

6. Storage and Security

6.1. Your data is stored on secure cloud servers located in the United States and/or in countries that offer an adequate level of data protection, and may be accessed by our team in Brazil.

6.2. We adopt appropriate technical and organizational security measures to protect your data against unauthorized access, destruction, loss, alteration, or disclosure, including:

• Encryption of data in transit (TLS) and at rest;
• Role-based access controls and least-privilege access;
• Passwords stored using one-way hashing;
• Continuous security monitoring and logging;
• Card data handled exclusively by a PCI-DSS-compliant processor;
• Information security policies and staff training.

6.3. In the event of a security breach affecting your personal data, we will notify you and the competent authorities where and when required by applicable law.

7. Data Retention

We keep your personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

• Account data: while the account is active, and up to 30 days after deletion to allow reversal and complete pending orders;
• Transaction and payout data: for the period required by tax, accounting, and financial regulations (generally 7 years);
• Communication data: up to 6 months after the matter is resolved, unless needed for a dispute;
• Location data: only for as long as needed to show nearby stores; not kept as a movement history;
• Marketing data: until you withdraw consent or opt out;
• Analytics data: in aggregated or pseudonymized form.

After the end of the retention period, the data will be deleted or anonymized, unless there is a legal basis for its retention.

8. Your Rights

Depending on where you live, you have the following rights regarding your personal data:

• Access: obtain confirmation of whether we process your data and a copy of it;
• Correction: request the correction of inaccurate or incomplete data (you can also edit most data in the App);
• Deletion: request the deletion of your data, subject to the retention obligations described above (you can delete your account from the App settings);
• Portability: receive your data in a structured, commonly used, machine-readable format;
• Objection and restriction: object to, or ask us to restrict, processing based on legitimate interests;
• Withdrawal of consent: withdraw consent at any time, including opting out of marketing and disabling location access in your device settings;
• Non-discrimination: not be treated differently for exercising your rights.

To exercise your rights, contact us at contact@homemarketapp.com. We may need to verify your identity before acting on your request. We will respond within 30 (thirty) days, or within the shorter period required by the law of your jurisdiction.

9. Cookies, Analytics, and Similar Technologies

Our website and App use cookies, software development kits (SDKs), and similar technologies to operate the service, understand how it is used, and personalize content.

9.1. Types we use:

• Essential: necessary for the operation of the website and App (sessions, security, cookie preferences);
• Analytics and performance: collect information about how you use the website and App (for example Google Analytics on the website and in-app usage analytics), used only with your consent where required by law;
• Functionality: remember your preferences, such as language;
• Marketing: used to measure the effectiveness of our own campaigns (subject to consent). We do not use third-party advertising cookies to track you across other websites.

You can manage your cookie preferences through the consent banner on our website and through the settings of your browser or device.

10. Additional Information for Users in the EEA and the United Kingdom (GDPR / UK GDPR)

If you are located in the European Economic Area or the United Kingdom, the General Data Protection Regulation (EU) 2016/679 and the UK GDPR apply to our processing of your personal data. Homemarket, Inc. is the controller of your data.

10.1. Legal bases:

• Performance of a contract (Art. 6(1)(b)): account management, orders, payments, deliveries, chat, transactional notifications, and Seller payouts;
• Legal obligation (Art. 6(1)(c)): tax and accounting records, responding to authorities;
• Legitimate interests (Art. 6(1)(f)): fraud prevention and security, service improvement, aggregated analytics, and enforcement of our Terms — in each case balanced against your rights and freedoms;
• Consent (Art. 6(1)(a)): precise location, marketing communications, and non-essential cookies.

10.2. Your rights:

In addition to the rights in section 8, you have the right to object to processing based on legitimate interests (including profiling), the right to object at any time to direct marketing, the right to restriction of processing, and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions.

10.3. International transfers:

Your data is transferred to and processed in the United States, where Homemarket, Inc. and our hosting providers are located, and may be accessed from Brazil. For transfers from the EEA and the UK we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), supplemented where appropriate by additional safeguards, and, where a provider is certified, on the EU-US Data Privacy Framework and its UK Extension. You may request a copy of the relevant safeguards by contacting us.

10.4. Complaints:

You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement, or with the UK Information Commissioner's Office (ICO). We would appreciate the chance to address your concerns first.

10.5. Contact for privacy requests:

Email: contact@homemarketapp.com (subject line "Privacy request"). Please indicate the country you live in so we can apply the correct rules.

11. Additional Information for California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") grants you the rights described in this section.

11.1. Categories of personal information collected in the last 12 months:

• Identifiers: name, email, phone number, account ID, IP address, device identifiers;
• Customer records: delivery address, payment token and card last four digits;
• Commercial information: orders, purchase history, ratings;
• Internet or network activity: usage of the App and website, interactions, logs;
• Geolocation data: approximate or precise device location (with permission);
• Audio or electronic information: chat messages and support communications;
• Professional information (Sellers): store, tax, and payout information, largely collected by Stripe;
• Inferences: product preferences derived from your usage, used only to personalize the App.

We collect these categories from you directly, from your device, and from our payment processor, for the purposes described in section 4, and we disclose them to the categories of third parties described in section 5 for business purposes.

11.2. No sale or sharing:

We do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are defined by the CCPA, and we have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16 years of age. We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA.

11.3. Your rights:

• Right to know: the categories and specific pieces of personal information we collected, the sources, the purposes, and the categories of third parties to whom we disclosed it;
• Right to delete: request deletion of your personal information, subject to legal exceptions;
• Right to correct: request correction of inaccurate personal information;
• Right to opt out: of the sale or sharing of personal information (not applicable, as we do neither);
• Right to limit: the use of sensitive personal information (we already limit it to permitted purposes);
• Right to non-discrimination: we will not deny services, charge different prices, or provide a different level of service because you exercised your rights.

11.4. How to submit a request:

Email contact@homemarketapp.com with the subject "California privacy request", or use the account-deletion option in the App. We will verify your request by matching the information you provide with the information in your account (for example, by sending a confirmation to the email on file). You may designate an authorized agent to make a request on your behalf; we will require proof of the agent's authorization and may verify your identity directly. We respond to requests within 45 days, extendable by a further 45 days where reasonably necessary.

12. Children's Data

HomeMarket is not directed at children under 18 years of age. We do not knowingly collect personal data from children under 16, and we do not knowingly allow anyone under 18 to create an account. If we become aware that we have collected data from a child without the consent of their parent or guardian, we will delete that information.

13. Changes to this Policy

We may update this Privacy Policy periodically. Significant changes will be communicated through the App or by email before they take effect. The date of the last update is indicated at the top of this document.

We recommend that you review this Policy regularly to stay informed about how we protect your data.

14. Contact

If you have questions, concerns, or requests related to this Privacy Policy or to the processing of your personal data, contact us:

Homemarket, Inc., a Delaware corporation
Email: contact@homemarketapp.com