Política de Privacidad

Version 2.0 — Effective July 9, 2026

1. Who we are (controller) and contact

BACKSIDE (ADAP COBRANÇAS LTDA, CNPJ 28.417.870/0001-80) operates Panda and tspanda.com and is the controller of your personal data. This policy explains what we collect, why, and your rights under applicable data-protection law (including Brazil's LGPD, the GDPR and the CCPA, where applicable). Our Data Protection Officer / Encarregado can be reached at [email protected]; general privacy requests at [email protected].

2. What we collect

• Account data: your e-mail address and subscription status, used to issue your license (API key) and communicate about the Service.
• Payment data: processed entirely by Stripe. We receive subscription events (paid, failed, canceled) and the last 4 digits/brand of your card — never the full card number.
• Service logs: API-key requests (key, timestamp, endpoint, IP) for security, abuse prevention and support. The app sends minimal diagnostics; it does not read your trading account, positions or orders.
• Website: tspanda.com is a static site; we do not run advertising trackers and set no advertising or tracking cookies. The site stores only a functional language preference in your browser (localStorage), which never leaves your device. Basic access logs are kept by our hosting/CDN provider (Cloudflare).

3. What we do NOT do

We do not sell your personal data. We do not read or store your brokerage credentials — Panda never asks for them. AI commentary is generated from public market and filings data, not from your personal information. No decision about your account is made solely on an automated basis.

4. Legal bases and purpose (LGPD art. 7 / GDPR art. 6)

• Performance of the contract — to deliver the Service, provision and validate your API key, process billing and provide support (account and payment data).
• Legal obligation — to meet tax, accounting and consumer-law requirements (billing records).
• Legitimate interest — to keep the Service secure and prevent fraud and abuse (service logs), balanced against your rights.
• Consent — where we ask for it (e.g. optional communications); you may withdraw it at any time.

5. Sharing and sub-processors

We share data only with the processors required to run the Service, each under its own compliance terms:

• Stripe — payment processing and billing (United States / Ireland; Stripe Brasil for settlement).
• Cloudflare — website hosting, CDN and access logs (global edge; United States).
• Resend — transactional e-mail delivery, e.g. your API key and receipts (United States).
• Anthropic — public market and filings data is sent to Anthropic’s Claude models to generate the AI commentary (United States). Your personal data is not included in these requests.

Where our API runs. The API, the licence database and the diagnostics are not hosted with a cloud or VPS provider: they run on infrastructure we operate ourselves, located in Brazil, and are reached from the internet through Cloudflare. There is therefore no third-party hosting sub-processor holding that data — beyond Cloudflare, which is listed above.

International transfers. Some processors operate outside Brazil and the EU (notably in the United States). Where your data is transferred internationally, we rely on adequacy decisions, standard contractual clauses or equivalent safeguards as required by the LGPD (art. 33) and the GDPR.

6. Retention

Account and billing records are kept while your subscription is active and for the period required by tax and consumer law afterwards. As a Brazilian application provider, we retain application-access logs for at least six (6) months as required by the Marco Civil da Internet (Law No. 12.965/2014, art. 15); other service logs are retained for a limited operational window and then aggregated or deleted. When a legal basis no longer applies and no legal-retention duty remains, data is deleted or anonymized.

7. Your rights

You may request confirmation of processing, access, correction, portability, anonymization, blocking or deletion of your personal data, information about with whom we share it, and you may object to or restrict processing and withdraw consent — by contacting [email protected] or the DPO at [email protected]. We respond within the timelines of applicable law. You may lodge a complaint with your data-protection authority — in Brazil, the ANPD. Brazilian residents: see the Brazil Addendum for the full LGPD rights (art. 18) and DPO details.

8. Children

The Service is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal data from minors; if you believe a minor has provided us data, contact [email protected] and we will delete it.

9. Security

Keys and personal data are stored on access-controlled infrastructure; payment data never touches our servers. No system is 100% secure — report suspected issues to the contact above.

10. Changes

We may update this policy; material changes will be announced on the site or by e-mail. The version and date at the top reflect the latest revision.