Privacy Policy

1. Introduction

This Privacy Policy (the "Policy") explains how Project Cantos ("Cantos", "we", "us" or "our") collects, uses, shares, retains and protects Personal Data when you access or use our website at https://cantoscrypto.com, our dashboard at https://cantos.onrender.com and any related service (collectively, the "Platform").

We respect your privacy and are committed to handling your Personal Data in a transparent, lawful and proportionate manner, in accordance with the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados — Law No. 13,709/2018, the "LGPD").

2. Who Is the Controller

For the purposes of applicable data-protection law, the data controller (controlador / "business") responsible for the processing of your Personal Data is Project Cantos, reachable at admin@cantoscrypto.com.

3. Personal Data We Collect

We collect only the Personal Data that is strictly necessary to operate the Platform and to improve the user experience. Depending on how you interact with us, this may include:

• Identification and contact data: name, email address, username, authentication credentials (password hashes), and any information you voluntarily provide when contacting us or subscribing to updates.
• Technical and usage data: IP address, browser type and version, operating system, device identifiers, language settings, time-zone, referring URLs, pages visited, features used, dashboards accessed, alerts opened, time spent on the Platform, and similar telemetry.
• Cookies and similar technologies: see our separate Cookies Policy for details.
• Communications data: content of the messages you send us through email, forms or support channels.
• Payment data (if and when paid plans are launched): we will not store card numbers; payments will be processed by a regulated payment-service provider.

We do not intentionally collect sensitive or special categories of Personal Data. Please do not submit any such data to the Platform.

4. How We Collect Personal Data

• directly from you, when you register, contact us, subscribe to a newsletter or otherwise interact with the Platform;
• automatically, through cookies, log files and similar technologies when you access the Platform;
• from third parties, such as authentication providers, analytics tools and infrastructure providers (e.g., Render, Supabase, OpenAI, Pinecone), strictly as needed to operate the Platform.

5. Legal Bases and Purposes of Processing

Under the LGPD, we process Personal Data based on the following legal bases (articles 7 and 11), as applicable:

• Consent (art. 7, I): when you voluntarily accept, for example, marketing communications or non-essential cookies.
• Performance of a contract or pre-contractual steps (art. 7, V): to provide the Platform you requested.
• Compliance with a legal or regulatory obligation (art. 7, II): for example, responding to requests from competent authorities.
• Legitimate interests (art. 7, IX): to secure, improve and operate the Platform, prevent fraud and abuse, and develop new features — always subject to a balancing test with your rights and freedoms.
• Regular exercise of rights in judicial, administrative or arbitral proceedings (art. 7, VI).

6. How We Use Personal Data

We use Personal Data solely to operate and improve the Platform, to protect it against abuse and to comply with law. We do not sell your Personal Data. We do not use your Personal Data to train third-party machine-learning models for unrelated purposes.

7. Sharing with Third Parties

We share Personal Data only with trusted service providers who process it on our behalf and under appropriate contractual safeguards. These include, among others:

• cloud hosting and infrastructure providers (e.g., Render);
• database and storage providers (e.g., Supabase, Pinecone, Redis providers);
• AI inference providers strictly for generating scores and narratives (e.g., OpenAI);
• analytics and error-monitoring tools;
• communication and email delivery providers;
• professional advisors (legal, accounting, audit) under duties of confidentiality;
• competent authorities, regulators or courts, when we are legally required to do so.

We do not disclose Personal Data for monetary consideration to third parties for their own marketing purposes.

8. International Transfers

Some of our service providers are located outside Brazil, including in the United States and the European Union. Whenever we transfer Personal Data internationally, we do so in accordance with article 33 of the LGPD, relying on (a) transfers to countries with an adequate level of data protection, as recognized by the ANPD; (b) specific contractual clauses, standard contractual clauses or binding corporate rules; (c) the explicit consent of the data subject; or (d) another legal basis permitted by the LGPD.

9. Data Retention

We retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected, to comply with our legal, regulatory, tax and accounting obligations, and to defend our legal rights. When Personal Data is no longer needed, we delete, anonymize or securely archive it, in accordance with our internal retention schedule.

10. Security

We implement reasonable and appropriate technical and organizational measures designed to protect Personal Data against unauthorized access, accidental loss, alteration or disclosure. These measures include transport-layer encryption (HTTPS/TLS), encryption at rest where appropriate, access controls, least-privilege principles, logging and monitoring, and periodic security reviews. No method of transmission or storage is 100% secure, however, and we cannot guarantee absolute security.

11. Your Rights (LGPD)

Under the LGPD (article 18), you have the following rights with respect to your Personal Data, which you may exercise free of charge at any time by contacting us at admin@cantoscrypto.com:

• confirmation of the existence of processing;
• access to your Personal Data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data;
• portability of your data to another service or product provider, subject to ANPD regulations;
• deletion of data processed with your consent, subject to legal exceptions;
• information about public and private entities with which we have shared your data;
• information about the possibility of refusing to provide consent and the consequences of such refusal;
• revocation of consent, at any time;
• the right to lodge a complaint with the Brazilian National Data Protection Authority (Autoridade Nacional de Proteção de Dados — ANPD).

12. Children's Privacy

The Platform is not directed to children under 18 years of age. We do not knowingly collect Personal Data from children. If you believe a child has provided us with Personal Data, please contact us at admin@cantoscrypto.com and we will delete the relevant information.

13. Automated Decisions and AI

The Platform uses automated processing and artificial-intelligence models (such as large language models) to classify events, compute the Context Signal Score (CSS) and generate narratives. These outputs are informational only and do not produce legal effects or significantly affect you in a way comparable to a human decision. Where the applicable law grants you the right to request human review of a purely automated decision, you may contact us at admin@cantoscrypto.com.

14. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, services or applicable law. We will indicate the revised "Effective date" at the top of the document and, where appropriate, notify you through the Platform.

15. Contact

If you have any question or request regarding this Policy or the processing of your Personal Data, please contact us at admin@cantoscrypto.com.

You also have the right to lodge a complaint with the Brazilian National Data Protection Authority — ANPD (www.gov.br/anpd).

Privacy Policy

1. Introduction

This Privacy Policy (the "Policy") explains how Project Cantos ("Cantos", "we", "us" or "our") collects, uses, shares, retains and protects Personal Data when you access or use our website at https://cantoscrypto.com, our dashboard at https://cantos.onrender.com and any related service (collectively, the "Platform").

We respect your privacy and are committed to handling your Personal Data in a transparent, lawful and proportionate manner, in accordance with the applicable U.S. privacy laws, including — where applicable — the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), and similar U.S. state privacy statutes.

2. Who Is the Controller

For the purposes of applicable data-protection law, the data controller ("business") responsible for the processing of your Personal Data is Project Cantos, reachable at admin@cantoscrypto.com.

3. Personal Data We Collect

We collect only the Personal Data that is strictly necessary to operate the Platform and to improve the user experience. Depending on how you interact with us, this may include:

• Identification and contact data: name, email address, username, authentication credentials (password hashes), and any information you voluntarily provide when contacting us or subscribing to updates.
• Technical and usage data: IP address, browser type and version, operating system, device identifiers, language settings, time-zone, referring URLs, pages visited, features used, dashboards accessed, alerts opened, time spent on the Platform, and similar telemetry.
• Cookies and similar technologies: see our separate Cookies Policy for details.
• Communications data: content of the messages you send us through email, forms or support channels.
• Payment data (if and when paid plans are launched): we will not store card numbers; payments will be processed by a regulated payment-service provider.

We do not intentionally collect sensitive or special categories of Personal Data. Please do not submit any such data to the Platform.

4. How We Collect Personal Data

• directly from you, when you register, contact us, subscribe to a newsletter or otherwise interact with the Platform;
• automatically, through cookies, log files and similar technologies when you access the Platform;
• from third parties, such as authentication providers, analytics tools and infrastructure providers (e.g., Render, Supabase, OpenAI, Pinecone), strictly as needed to operate the Platform.

5. Legal Bases and Purposes of Processing

We process Personal Data for the following purposes, consistent with applicable U.S. privacy laws:

• to provide, operate, maintain and secure the Platform you requested;
• to authenticate users, prevent fraud, debug, detect security incidents and enforce our Terms of Use;
• to communicate with you, including service announcements and support;
• to analyze usage patterns and improve our features, models and user experience;
• to comply with our legal obligations and respond to lawful requests from authorities;
• with your consent, for marketing or other optional purposes you specifically opt into.

6. How We Use Personal Data

We use Personal Data solely to operate and improve the Platform, to protect it against abuse and to comply with law. We do not sell your Personal Data. We do not use your Personal Data to train third-party machine-learning models for unrelated purposes.

7. Sharing with Third Parties

We share Personal Data only with trusted service providers who process it on our behalf and under appropriate contractual safeguards. These include, among others:

• cloud hosting and infrastructure providers (e.g., Render);
• database and storage providers (e.g., Supabase, Pinecone, Redis providers);
• AI inference providers strictly for generating scores and narratives (e.g., OpenAI);
• analytics and error-monitoring tools;
• communication and email delivery providers;
• professional advisors (legal, accounting, audit) under duties of confidentiality;
• competent authorities, regulators or courts, when we are legally required to do so.

We do not disclose Personal Data for monetary consideration to third parties for their own marketing purposes.

8. International Transfers

Project Cantos is based in the United States. If you access the Platform from outside the United States, your Personal Data may be transferred to, stored and processed in the United States and other jurisdictions where our service providers operate. By using the Platform you acknowledge such transfers. Where required by applicable law, we implement appropriate safeguards (such as standard contractual clauses) for such transfers.

9. Data Retention

We retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected, to comply with our legal, regulatory, tax and accounting obligations, and to defend our legal rights. When Personal Data is no longer needed, we delete, anonymize or securely archive it, in accordance with our internal retention schedule.

10. Security

We implement reasonable and appropriate technical and organizational measures designed to protect Personal Data against unauthorized access, accidental loss, alteration or disclosure. These measures include transport-layer encryption (HTTPS/TLS), encryption at rest where appropriate, access controls, least-privilege principles, logging and monitoring, and periodic security reviews. No method of transmission or storage is 100% secure, however, and we cannot guarantee absolute security.

11. Your Rights (CCPA)

Depending on where you reside, you may have the following rights with respect to your Personal Data under applicable U.S. privacy laws (including the CCPA/CPRA for California residents, and similar statutes in other states):

• the right to know what Personal Data we collect, use, disclose and retain;
• the right to access a copy of your Personal Data in a portable format;
• the right to request the deletion of your Personal Data, subject to legal exceptions;
• the right to request correction of inaccurate Personal Data;
• the right to opt out of the sale or sharing of Personal Data (we do not sell your Personal Data);
• the right to limit the use of sensitive Personal Data (we do not intentionally collect sensitive Personal Data);
• the right to non-discrimination for exercising any of these rights.

You may exercise these rights by contacting us at admin@cantoscrypto.com. We will respond within the timeframes required by applicable law. You may also authorize an agent to submit requests on your behalf, subject to verification.

12. Children's Privacy

The Platform is not directed to children under 18 years of age. We do not knowingly collect Personal Data from children. If you believe a child has provided us with Personal Data, please contact us at admin@cantoscrypto.com and we will delete the relevant information.

13. Automated Decisions and AI

The Platform uses automated processing and artificial-intelligence models (such as large language models) to classify events, compute the Context Signal Score (CSS) and generate narratives. These outputs are informational only and do not produce legal effects or significantly affect you in a way comparable to a human decision. Where the applicable law grants you the right to request human review of a purely automated decision, you may contact us at admin@cantoscrypto.com.

14. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, services or applicable law. We will indicate the revised "Effective date" at the top of the document and, where appropriate, notify you through the Platform.

15. Contact

If you have any question or request regarding this Policy or the processing of your Personal Data, please contact us at admin@cantoscrypto.com.

If you are a California resident, you may also designate an authorized agent to make a request on your behalf, subject to identity verification.