PANDA
← tspanda.com
Sign in

Privacy Policy

Version 2.2 — Effective October 2, 2026

1. Who we are (controller) and contact

BACKSIDE (ADAP COBRANÇAS LTDA, CNPJ 28.417.870/0001-80) operates Panda and tspanda.com and is the controller of your personal data. This policy explains what we collect, why, and your rights under applicable data-protection law (including Brazil's LGPD, the GDPR and the CCPA, where applicable). Our Data Protection Officer / Encarregado can be reached at [email protected]; general privacy requests at [email protected].

2. What we collect

  • Account data: your e-mail address, your subscription status and how you sign in — a password, which we keep only as a one-way hash, or, if you choose to sign in with Google, the account identifier, name, e-mail address (and whether Google has verified it) and profile-picture link that Google shares with us. Used to give you access to the Service and to communicate about it. If you choose to fill in the optional profile fields in your account — name, phone number, date of birth and postal address — we use them only to identify you and contact you about your account.
  • Sign-in sessions: each computer where you sign in to the app gets its own sign-in session, labelled with that computer's name so you can recognise it under "Your computers" in your account, together with when it was created and last used and the IP address it started from.
  • Free course: the lessons at tspanda.com/learn open with a free account. Besides the account e-mail, we ask once for a phone number and store it with your account. We do not send messages to it; you can change or delete it in your account area at any time.
  • Payment data: processed entirely by Stripe. We receive subscription events (paid, failed, canceled), the plan, and the billing name and country — never your card number.
  • Usage and service logs: each request from the app is logged with your account (its name or e-mail), the time, the endpoint and the ticker requested — that is, which tickers you opened and when — plus timing diagnostics; our server logs also record IP addresses. We keep a daily summary per account (number of requests, tickers opened and hours of use). We use this for security, abuse prevention, support and to improve the product. The app does not read your trading account, positions or orders.
  • Technical device identifier (free-trial eligibility): when the app starts — at most once a day — it reads identifiers of the computer it runs on: from the TPM security chip and the firmware, the SMBIOS UUID, the Windows installation identifier (MachineGuid) and the serial numbers of the mainboard and the system disk. Each value is reduced on your computer to a SHA-256 digest; only the digests are sent, and our server stores them only after re-hashing them with a server-side secret (HMAC-SHA256), so the original serial numbers cannot be recovered from what we keep. The app also sends a yes/no flag saying whether the computer appears to be a virtual machine (it carries no weight in the decision). This identifier is used only to check whether a computer has already used a free trial and to detect duplicated or abusive activations — never for advertising, profiling or pricing.
  • E-mail: we send account and subscription e-mails and, while you are on a trial or a customer, a short series of e-mails about using Panda. Every product e-mail has an unsubscribe link.
  • Website — analytics and advertising measurement: tspanda.com uses Google Analytics 4 to understand how the site is used and the X pixel (X Corp.) to measure and improve our advertising — including showing Panda again to people who visited the site (retargeting) and counting conversions such as the click to start a trial. They never receive your brokerage or trading data. In the EU/EEA, the UK, Switzerland, Brazil and the US states of California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania and Washington (and whenever we cannot tell your US state), they run only after you accept them in the cookie banner; elsewhere they run by default and you may opt out at any time via "Your Privacy Choices" in the footer. We honour the Global Privacy Control browser signal. Until you choose, Google Analytics runs in Google's consent mode, which sends cookieless measurement pings. Cloudflare Web Analytics (cookieless, no personal data) runs on every visit. The site also stores a functional language preference and your cookie choice in your browser (localStorage). Basic access logs are kept by our hosting/CDN provider (Cloudflare).
  • Support chat: if you use the chat widget on the site, we collect the name, e-mail address, optional phone number, the messages you type and any photo or video you attach (up to 8 MB each), plus the page, language and country you wrote from, to answer your request. Conversations are relayed to a private channel we control on Discord, where they stay until we delete them, and are kept for up to 90 days in our Cloudflare storage; your browser keeps a copy of the conversation in its local storage so it is still there when you come back. We may keep your e-mail to follow up on your request.

3. What we do NOT do — and the one automated decision

We do not sell your personal data. We do not read or store your brokerage credentials — Panda never asks for them. AI commentary is generated from public market and filings data, not from your personal information. We do not profile you, score you as a person, or price the Service differently for different people.

Automated decision: free-trial eligibility. The one decision about you that is made automatically is whether you get the free trial. When you subscribe, your e-mail address is compared with the record of trials already used; in the app, the technical device identifier is compared with computers that already used a trial. If either matches, the subscription starts without a free period: checkout charges you when you subscribe, and an app already running on that computer stops showing data until the subscription is paid. The sale is never refused and the price does not change, and identifiers that could not be read never count against you. You can ask for this decision to be reviewed by a person: write to [email protected] or to the DPO at [email protected] (LGPD art. 20 / GDPR art. 22).

4. Legal bases and purpose (LGPD art. 7 / GDPR art. 6)

  • Performance of the contract — to deliver the Service, sign you in and validate your access, process billing and provide support (account, profile and payment data).
  • Legal obligation — to meet tax, accounting and consumer-law requirements (billing records).
  • Legitimate interest — to keep the Service secure and prevent fraud and abuse, including one free trial per person and per computer (usage and service logs, the record of trials used and the technical device identifier); to improve the product; and to send e-mails about Panda to trial users and customers, who can unsubscribe at any time — always balanced against your rights.
  • Consent — for analytics and advertising cookies where the law requires it, and wherever we ask for it; you may withdraw it at any time.

5. Sharing and sub-processors

We share data only with the processors required to run the Service, each under its own compliance terms:

  • Stripe — payment processing and billing (United States / Ireland; Stripe Brasil for settlement).
  • Cloudflare — website hosting, CDN, access logs, bot checks on our forms and storage of support-chat conversations (global edge; United States).
  • Resend — e-mail delivery: account, subscription and product e-mails (United States).
  • Anthropic — public market and filings data is sent to Anthropic’s Claude models to generate the AI commentary (United States). Your personal data is not included in these requests.
  • Discord — support-chat conversations from the site widget (name, e-mail, optional phone, messages, attachments, page and country) are relayed to a private channel we control on Discord so we can answer you (United States).
  • Google (Google Analytics 4) — website analytics, subject to your cookie choice (United States).
  • X Corp. (X pixel / X Ads) — advertising measurement and retargeting audiences, subject to your cookie choice (United States).

Where our API runs. The API, the licence database and the diagnostics are not hosted with a cloud or VPS provider: they run on infrastructure we operate ourselves, located in Brazil, and are reached from the internet through Cloudflare. There is therefore no third-party hosting sub-processor holding that data — beyond Cloudflare, which is listed above.

International transfers. Some processors operate outside Brazil and the EU (notably in the United States). Where your data is transferred internationally, we rely on adequacy decisions, standard contractual clauses or equivalent safeguards as required by the LGPD (art. 33) and the GDPR.

6. Retention

Account and billing records are kept while your subscription is active and for the period required by tax and consumer law afterwards. As a Brazilian application provider, we retain application-access logs for at least six (6) months as required by the Marco Civil da Internet (Law No. 12.965/2014, art. 15). Usage logs and their daily summaries currently have no fixed deletion date; you can ask us to delete yours at any time. Technical device identifiers are deleted automatically 24 months after the last contact with that computer. The record of which e-mail addresses already used a free trial may be kept after an account is closed, for as long as it is needed to enforce one trial per person (LGPD art. 16). Support-chat conversations are kept for up to 90 days in our Cloudflare storage; the Discord copy stays until we delete it. When a legal basis no longer applies and no legal-retention duty remains, data is deleted or anonymized.

7. Your rights

You may request confirmation of processing, access, correction, portability, anonymization, blocking or deletion of your personal data, information about with whom we share it, and you may object to or restrict processing and withdraw consent — by contacting [email protected] or the DPO at [email protected]. We respond within the timelines of applicable law. You may lodge a complaint with your data-protection authority — in Brazil, the ANPD. Brazilian residents: see the Brazil Addendum for the full LGPD rights (art. 18) and DPO details.

8. Children

The Service is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal data from minors; if you believe a minor has provided us data, contact [email protected] and we will delete it.

9. Security

Account data and sign-in sessions are stored on access-controlled infrastructure; on our servers, passwords and sign-in tokens are kept only as one-way hashes, and payment data never touches them. No system is 100% secure — report suspected issues to the contact above.

10. Changes

We may update this policy; material changes will be announced on the site or by e-mail. The version and date at the top reflect the latest revision.