Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how Fabiana A. D'Agostino da Silva(Brazilian business registration number/CNPJ 15.010.336/0001-02), an individual entrepreneur (sole proprietor), domiciled in Goiânia - GO, Brazil, operator of the Track.BI.AI platform under the trade name "Track.BI.AI" ("Track.BI.AI", "we", "our platform") and, as controller of the personal data, a software-as-a-service (SaaS) platform focused on real estate data intelligence and analytics, collects, uses, stores, shares, and protects the personal data of its users ("you", "data subject").

As a service operated from Brazil that serves users in multiple countries, this Policy seeks to observe Brazil's General Data Protection Law (Law No. 13,709/2018 — LGPD) and, by reason of its extraterritorial application, applicable United States privacy legislation (including, where applicable, state privacy laws such as the California Consumer Privacy Act — CCPA/CPRA) for data subjects located in that country, as well as the European Union General Data Protection Regulation (GDPR), where applicable to data subjects located in the European Economic Area.

By creating an account, accessing, or using the Track.BI.AI platform, you represent that you have read, understood, and agreed to the terms described herein.

2. Collection of Personal Data

Track.BI.AI collects personal data at different points in the relationship with the user, always limited to what is necessary for the provision of the service. The principal data collected include:

a) Data provided upon registration

• Full name;
• Email address;
• Telephone number (when provided);
• Company name and job title (where applicable);
• Access password (stored in encrypted form).

b) Billing and payment data

• Billing data, such as tax address and tax identification document applicable to the user's country (e.g., CPF/CNPJ for users in Brazil, EIN/SSN where applicable to users in the United States);
• History of subscriptions, contracted plans, and invoices issued.

Important: Track.BI.AI does not store complete credit card data or sensitive financial information on its own servers. Payment processing is performed entirely by Stripe, our payment processor, which maintains its own privacy policy and security certifications (such as PCI-DSS).

c) Browsing and platform usage data

• IP address;
• Browser type and version and operating system;
• Access logs, date and time of login;
• Pages and features accessed within the platform;
• Session identifiers and cookies (see Section 5).

d) Support and communication data

• Records of interactions with our technical support team (emails, chats, tickets);
• Feedback and satisfaction surveys;
• Telephone number, when voluntarily provided for receipt of product news and updates via WhatsApp and/or text message (SMS), subject to explicit and channel-specific consent, with opt-out available at any time (by replying STOP to an SMS received, or via the channel indicated in WhatsApp messages).

3. Purpose of Collection

The personal data collected are used exclusively for the following purposes:

• Service provision:to enable the operation of the user's account, access to real estate analytics tools, and the contracted features;
• Subscription billing: to process payments, issue invoices, and manage plan renewals or cancellations;
• Technical support: to identify, diagnose, and resolve issues reported by users;
• Account security: to prevent unauthorized access, detect suspicious activity, and protect the integrity of the platform and the data stored therein;
• Operational communications: sending essential notices regarding the service, such as contractual changes, scheduled maintenance, security updates, and payment confirmations;
• Marketing communications (subject to consent): sending product news and market insights by email or WhatsApp, only when the user provides explicit consent therefor;
• Continuous product improvement: aggregated and statistical analysis of platform usage to improve features (whenever possible, in anonymized form).

Track.BI.AI does not use personal data for purposes incompatible with those described above without the prior consent of the data subject, except where required by legal or regulatory obligation.

4. Distinction Between Personal Data and Public Real Estate Data

It is essential to clarify the distinct nature of the information processed by Track.BI.AI:

4.1.The personal data processed under this Policy refer exclusively to information related to the identification and use of the user's platform account (name, email, billing data, access logs, etc.), as described in Section 2.

4.2.The real estate data made available and processed by the tool — such as tax deeds records, tax assessments ("assessments"), zoning information, emergency/flood management data (FEMA), property history, cadastral real estate data, and other public records — currently relate to properties located in the State of Florida, United States(coverage of the state's 67 counties, with planned expansion to other U.S. states), and are obtained exclusively from U.S. governmental public sources (Property Appraiser's Office, Tax Collector, Clerk of Court, municipal/county zoning authorities, and other official U.S. public repositories).

4.3. Such real estate data do not constitute confidential personal data of Track.BI.AI users, nor are they owned by the users. They are public-domain information relating to third-party property owners, processed by Track.BI.AI solely for the purposes of aggregation, organization, and provision of real estate market intelligence.

4.4. Track.BI.AI acts as an organizer and processor of pre-existing public data and is not responsible for the accuracy, currency, or original veracity of the information contained in the governmental databases consulted, although it makes reasonable efforts to keep the data updated and intact.

5. Sharing of Data with Third Parties

Track.BI.AI does not sell, rent, or commercialize its users' personal data to third parties for marketing purposes or any other purpose unrelated to the provision of the service.

Personal data may be shared, on a limited and strictly necessary basis, with the following types of partners:

• Stripe, our payment processor, to enable subscription billing and the issuance of receipts/invoices;
• Cloud infrastructure and hosting providers (e.g., VPS servers, transactional email providers), for secure data storage and operational continuity of the platform;
• Usage analytics tools, currently limited to Track.BI.AI's own internal measurement (no Google Analytics or advertising networks); should third-party tools be adopted, this Policy and the list of subprocessors below will be updated;
• Support and communication service providers (e.g., transactional email platforms, WhatsApp Business, customer service systems), strictly for users who consent to that communication channel;
• Public or judicial authorities, when required by law, court order, or request of a competent authority, whether in the United States or in another applicable jurisdiction.

All of the aforementioned third parties are contractually obligated to treat the data with the same level of confidentiality and security required by Track.BI.AI, using the information exclusively for the purpose for which it was shared.

SMS (text message) opt-in data. When you opt in to receive text messages (SMS) from Track.BI.AI, we collect only the phone number provided and the record of your consent (opt-in). This text message opt-in and originator data is not shared with third parties or affiliates for marketing or promotional purposes; none of the sharing categories described in this Section includes SMS consent/opt-in data. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the categories of information sharing described in this Privacy Policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Subprocessors currently used

• Stripe (Stripe Brasil Soluções de Pagamento Ltda., Brazil, and Stripe, Inc., United States) — payment processing, receipt issuance, and subscription management;
• Hetzner Online GmbH(Germany, European Union) — hosting of the Platform's servers and storage of security backups;
• Cloudflare, Inc. (United States; global network) — CDN, reverse proxy, and attack protection; processes the IP address of requests for security and routing purposes;
• Resend (United States) — delivery of transactional emails, such as password resets.

Mapping services (Google Maps Platform) receive only geographic coordinates and property addresses — third-party public data, as set out in Section 4 — and do not receive users' personal account data. This list may be updated; relevant changes will be communicated as provided in Section 9.

6. Use of Cookies and Tracking Technologies

Track.BI.AI uses cookies and similar technologies to ensure the proper and secure operation of the platform. The principal types used are:

• Session cookies: essential to keep the user authenticated after login, retained only for the period indicated in the table below;
• Security cookies:used to detect suspicious behavior, prevent fraud, and protect the user's account against unauthorized access;
• Performance and analytics cookies: collect statistical and anonymous information about use of the platform, enabling identification of usability and performance improvements.

The cookies actually used by the Platform and by the trackbiai.com website are:

The user may manage or disable cookies directly in their browser settings. In addition, when using the Platform, the user is shown a cookie notice with the option to allow or decline performance and analytics (non-essential) cookies; this preference can also be revisited at any time under Profile → Cookie preferences, within the Platform itself. Essential cookies (session and security) cannot be disabled this way, as they are indispensable for the account to function.

We do not sell or share your personal data ("Do Not Sell or Share My Personal Information"). As already stated in Section 5, Track.BI.AI does not sell, rent, or share personal data with third parties for advertising purposes or in any way that would fall under the concept of a "sale" or "sharing" under the CCPA/CPRA. There is therefore no "sale opt-out" mechanism to offer — the only non-essential data collection that exists is internal usage analytics cookies, controllable through the cookie notice described above.

7. Storage and Information Security

Track.BI.AI adopts technical and organizational measures consistent with industry best practices to protect personal data against unauthorized access, loss, alteration, or breach, including, among others:

• Encryption of data in transit (TLS/SSL) and, where applicable, at rest;
• Role-based access control (RBAC), restricting internal access only to authorized personnel and on a need-to-know basis;
• Storage of passwords by means of secure hashing algorithms, without access to the password in plain text;
• Continuous security monitoring and audit records (logs);
• Periodic backups and business continuity plans;
• Regular vulnerability assessments and testing of the infrastructure.

In the event of a security incident that may entail a relevant risk to data subjects, Track.BI.AI undertakes to notify affected users and the competent authorities in accordance with the timeframes and criteria established by law — including, where applicable, Brazil's National Data Protection Authority (ANPD), for data subjects located in the country, and the competent U.S. state authorities.

Data retention and deletion

Personal data is retained only for as long as necessary for the purposes of this Policy or to comply with a legal obligation:

• Account data (registration, favorites, notes, comparisons, and imported lists): retained while the account is active. It is deleted immediately when the user deletes their own account (a feature available under Profile), or within 30 days of a deletion request made through the contact channel. Copies in security backups are overwritten in the regular retention cycles, within 7 days;
• Access and usage records (request logs): automatically deleted after 12 months, with only aggregate and anonymous statistics remaining, without identification of the data subject;
• Billing data: retained for the period required by applicable tax law; payment history is kept by Stripe in accordance with its own privacy policy;
• Support records: retained for as long as necessary to handle the request and improve the service, and subsequently deleted or anonymized.

Once the periods above have elapsed, data is securely deleted or irreversibly anonymized.

8. Rights of the Data Subject

Depending on your location, the data subject has rights that may include, under applicable law (LGPD, CCPA/CPRA, GDPR, or another pertinent state/national privacy law):

• Confirmation and access: to obtain confirmation of the existence of processing and access to their personal data;
• Correction: to request correction of incomplete, inaccurate, or outdated data;
• Deletion and withdrawal of consent: to request deletion of personal data processed on the basis of consent, as well as to withdraw previously given consent, without prejudice to the lawfulness of processing carried out beforehand;
• Portability: to request portability of account data to another service provider, upon express request;
• Objection: to object to processing carried out in nonconformity with applicable law;
• Non-discrimination: not to suffer discriminatory treatment for exercising any of the rights above (a right expressly provided by CCPA/CPRA);
• Information regarding sharing: to obtain information about the public and private entities with which Track.BI.AI has shared their data.

To exercise any of these rights, the user may contact us through the official channel:

✉ [email protected]

Requests will be reviewed and responded to within the timeframes established by the legislation applicable to the data subject's location, and Track.BI.AI may request additional information to confirm the requester's identity before processing the request.

9. Updates to this Privacy Policy

Track.BI.AI may update this Policy periodically in order to reflect changes in its data processing practices, applicable law, or its features.

In the event of material changes, users will be notified by means of:

• A prominent notice within the platform itself; and/or
• Communication by email to the address registered on the account.

The "last updated" date indicated at the beginning of this document will always be revised with each newly published version. Users are encouraged to review this Policy periodically. Continued use of the platform after the changes take effect constitutes tacit acceptance of the new terms.

10. Contact

For questions regarding this Privacy Policy or the processing of personal data carried out by Track.BI.AI, please contact:

✉ Email: [email protected]

⌂ Owner / Controller:Fabiana A. D'Agostino da Silva (individual entrepreneur / sole proprietor) — CNPJ 15.010.336/0001-02

⚑ Domicile: Goiânia - GO, Brazil

◑ Data Protection Officer (DPO):Fabiana A. D'Agostino da Silva — [email protected]