Privacy policy
In effect since 27 October 2026
PRIVACY POLICY – H2FAST
The H2Fast platform ("Platform") is operated by MOOVE NEGÓCIOS DIGITAIS LTDA ("Moove"), registered under Brazilian corporate tax ID (CNPJ) No. 50.628.785/0001-10, headquartered at Rua Príncipe Humberto, 112, Conjunto 44, Centro, São Bernardo do Campo – SP, ZIP 09725-200, Brazil.
The Platform assists candidates in organizing and submitting job applications for temporary employment opportunities in the United States linked to the H-2A and H-2B programs. This Privacy Policy transparently describes what data we collect, how we use, store, protect, and share it, as well as your rights as a data subject, in compliance with the Brazilian General Data Protection Law (Law No. 13.709/2018 – LGPD) and the Google API Services User Data Policy.
1. DATA CONTROLLER AND CONTACT CHANNEL (DPO)
MOOVE NEGÓCIOS DIGITAIS LTDA is the Controller of the personal data processed within the H2Fast Platform. For any questions, requests, or to exercise your rights related to privacy and data protection, please contact us directly through our official channel:
Data Protection Officer (DPO) and Privacy Email: h2fast@moovevistos.com.br
2. PERSONAL DATA COLLECTED
We strictly collect and process the data necessary for the operation of the Platform:
a) Identification and Account Data: Full name, email address, phone number, preferred language, and access password (stored exclusively under cryptographic hash, never in plain text).
b) Professional Profile and Preference Data: Areas of interest, professional experience, preferred U.S. states, program category (H-2A or H-2B), and search filters configured by you or jointly with your consultant (Career Manager), if you have hired the Premium Advisory service.
c) Application Documents and Templates: Resumes in PDF format, cover letters, and email templates registered or approved by you on the Platform.
d) Operational History on the Platform: Selected job openings, record of submitted applications, contacted companies, interview schedules, and follow-up notes recorded by you or by the support team.
e) Google Account (Gmail) Integration Data: When you choose to connect your Google account via OAuth 2.0, we collect your Google email address, basic authentication identifiers (openid, email, profile), and the encrypted authorization token for sending messages (scope https://www.googleapis.com/auth/gmail.send), as detailed in Section 4.
f) Microsoft Account (Outlook and Hotmail) Integration Data: When you choose to connect your Microsoft account via OAuth 2.0, we collect your Microsoft email address, basic authentication identifiers (openid, email, User.Read), and the encrypted authorization token for sending messages (Mail.Send permission, with ongoing offline_access), as detailed in Section 4-A.
g) Technical Data and Access Logs: IP address, browser type, and date and time of access, used exclusively for information security, fraud prevention, compliance with the Brazilian Civil Rights Framework for the Internet (Law No. 12.965/2014), and recording acceptance of the Terms of Use.
3. PURPOSES OF PROCESSING AND LEGAL BASES (LGPD)
We use your personal data exclusively for:
3.1. Performance of Contract (Art. 7, V of the LGPD): Filtering and displaying H-2A and H-2B job openings compatible with your profile, enabling, for clients who hired the Premium Advisory service, personalized follow-up by the Moove Career Managers team, and sending operational notifications from the Platform (such as invitations, verification codes, password recovery, and activity summaries).
3.2. Based on Your Specific Consent (Art. 7, I of the LGPD): Dispatching your job application emails and resume directly from your connected Gmail, Outlook or Hotmail account to the U.S. employers you select or authorize.
3.3. Legitimate Interest and Fraud Prevention (Art. 7, IX of the LGPD): Ensuring the cybersecurity of the Platform, authenticating access sessions, and preventing technical abuse.
3.4. Compliance with Legal or Regulatory Obligation (Art. 7, II of the LGPD): Maintaining connection and access logs as required by Brazilian legislation.
4. GOOGLE API DATA USAGE AND LIMITED USE DISCLOSURE
The integration of H2Fast with your Google Account follows the strictest privacy and security standards established by Google:
4.1. Minimum Scope and Restricted Permission (gmail.send)
H2Fast exclusively requests from Google the technical permission necessary to send emails on your behalf (scope https://www.googleapis.com/auth/gmail.send), in addition to basic identification of the connected address (openid, email, profile). The Platform DOES NOT have permission to read, view, synchronize, store, modify, or delete any email from your Gmail inbox or folders.
4.2. Dispatch Control and Transparency
Job application emails are only sent to the job openings and recipients selected within the Platform workflow, strictly using the text, subject line, and resume (PDF) chosen and approved by you, through an action initiated by you or expressly delegated by you to your Career Manager on the Platform (for clients who hired the Premium Advisory service). No email sent by the Platform contains advertising, third-party promotional links, or hidden trackers.
4.3. Secure Token Storage and No Human Access Restriction
Access and refresh tokens (OAuth Access/Refresh Tokens) granted by Google are stored in a database with advanced encryption at rest and transmitted exclusively over a secure connection (HTTPS/TLS). Moove does not allow humans to read raw data or credentials obtained from Google APIs, except: (a) with the user's affirmative and explicit consent for specific technical support; (b) when strictly necessary for security purposes or technical abuse investigation; (c) to comply with a legal obligation; or (d) when data is aggregated and anonymized for internal operations.
4.4. Prohibition of Use in Artificial Intelligence (AI/ML) and Advertising
Data and tokens received from Google APIs are never sold, rented, transferred to data brokers, or used for advertising, remarketing, or consumer profiling purposes. H2Fast (Moove) does not use, transfer, or retain any data obtained through Google Workspace APIs (including the Gmail API) to develop, improve, or train generalized, foundational, or third-party Artificial Intelligence (AI) or Machine Learning (ML) models.
4.5. Compliance with Google Limited Use Policy
H2Fast's use and transfer to any other app of information received from Google APIs will strictly adhere to the Google API Services User Data Policy (available at: https://developers.google.com/terms/api-services-user-data-policy) and the Google Workspace API User Data and Developer Policy (available at: https://developers.google.com/workspace/workspace-api-user-data-developer-policy), including the Limited Use requirements.
Official English Disclosure: "H2Fast's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements, as well as the Google Workspace API User Data and Developer Policy (https://developers.google.com/workspace/workspace-api-user-data-developer-policy)."
4.6. Revocation of Access by the User
You may disconnect your Gmail account and revoke the access token at any time, with immediate effect, by clicking the disconnect option within the H2Fast dashboard or directly in your Google Account security settings at: https://myaccount.google.com/permissions. Upon disconnecting your account, the corresponding OAuth token is immediately invalidated and deleted from our servers.
4-A. MICROSOFT DATA USAGE (OUTLOOK AND HOTMAIL)
When you connect a Microsoft account (Outlook or Hotmail), the same safeguards described in Section 4 apply:
4-A.1. Restricted Permission (Mail.Send)
H2Fast exclusively requests from Microsoft the permission to send emails on your behalf (Mail.Send, via the Microsoft Graph API), basic identification of the connected address (openid, email, User.Read), and the ongoing access needed to keep the connection active (offline_access). The Platform DOES NOT have permission to read, view, synchronize, store, modify, or delete any email from your Outlook or Hotmail inbox or folders.
4-A.2. Dispatch Control, Storage and Prohibitions
Dispatches follow exactly the rules of Section 4.2. Tokens granted by Microsoft are stored with encryption at rest, under the same human access restrictions as Section 4.3, and are never sold, used for advertising, or used to train Artificial Intelligence models, on the same terms as Section 4.4.
4-A.3. Revocation of Access by the User
You may disconnect your Outlook or Hotmail account at any time, with immediate effect, within the H2Fast dashboard or in your Microsoft account privacy settings at: https://account.live.com/consent/Manage. Upon disconnecting, the corresponding token is immediately invalidated and deleted from our servers.
5. SHARING OF PERSONAL DATA
Moove does not sell personal data. Your data is shared strictly under the following circumstances:
a) U.S. Employers (Application Recipients): When a job application email is sent, the employer responsible for the H-2A or H-2B opening receives your email address, cover message, and PDF resume.
b) Technology Infrastructure Providers (Processors): Companies contracted for cloud hosting, secure databases, transactional system emails, and Google LLC itself (for executing the Gmail API via OAuth 2.0) and Microsoft Corporation (for executing the Microsoft Graph API via OAuth 2.0), all contractually bound to confidentiality and security duties compatible with the LGPD.
c) Public Authorities: Upon judicial request or express legal obligation.
International Data Transfer: Since the recipient employers of the job openings and part of the cloud servers are located in the United States, international data transfer occurs, carried out pursuant to Articles 33, II (contractual protection and technical safeguards) and IX (performance of a contract at the request of the data subject) of the LGPD.
6. DATA RETENTION AND DELETION
6.1. Your registration and operational data are kept for as long as your account remains active on the Platform.
6.2. If you disconnect your Gmail, Outlook or Hotmail account, the authorization credentials (OAuth tokens) are deleted immediately.
6.3. After the end of the contract, personal profile data and resumes may be deleted upon the User's request to h2fast@moovevistos.com.br (processed within 15 days), retaining only technical access logs and contractual history necessary to comply with legal obligations (Art. 15 of the Brazilian Civil Rights Framework for the Internet) and the regular exercise of rights in administrative or judicial proceedings (Art. 16 of the LGPD) for up to 24 (twenty-four) months.
7. DATA SUBJECT RIGHTS (ART. 18 OF THE LGPD)
You may request at any time, free of charge, by sending a request to h2fast@moovevistos.com.br:
a) Confirmation of the existence of processing and access to your personal data;
b) Correction of incomplete, inaccurate, or outdated data;
c) Anonymization, blocking, or deletion of unnecessary data or data processed in non-compliance with the LGPD;
d) Data portability and information about the entities with which data has been shared;
e) Deletion of your personal data and revocation of consent at any time.
You also have the right to petition the Brazilian National Data Protection Authority (ANPD).
8. INFORMATION SECURITY
We adopt strict technical and administrative measures to protect your data against unauthorized access, loss, or alteration, including: 100% encrypted communication via HTTPS/TLS, passwords protected by cryptographic hash algorithms, Google and Microsoft OAuth tokens encrypted at rest, two-factor authentication (via code) for internal team access, and strict role-based access control. In the event of a security incident that may entail relevant risk or damage, we will notify the affected data subjects and the ANPD in accordance with the law.
9. COOKIE POLICY
The Platform uses exclusively strictly necessary (essential) cookies to keep your session securely authenticated and recognize trusted devices in access control. We do not use third-party cookies for behavioral advertising or cross-site tracking.
10. PROTECTION OF MINORS
H2Fast is intended exclusively for individuals aged 18 (eighteen) and older. We do not intentionally collect data from children or adolescents. If we identify a registration by a minor, the account and its respective data will be immediately removed.
11. CHANGES TO THIS PRIVACY POLICY
This Policy may be updated periodically. Whenever there is a relevant change in the way we process your data or use Google and Microsoft APIs, we will update the date at the top of this page and notify you in advance on the Platform to collect new consent, when applicable.
IDENTIFICATION AND CONTACT
Controller: MOOVE NEGÓCIOS DIGITAIS LTDA (Moove)
CNPJ (Tax ID): 50.628.785/0001-10
Address: Rua Príncipe Humberto, 112, Conjunto 44, Centro, São Bernardo do Campo – SP, CEP 09725-200, Brazil
Privacy and Support Email: h2fast@moovevistos.com.br
Official Website: https://moovevistos.com.br
