You are reading the Privacy Policy (“Privacy Policy”) of BALYSTA LTDA., a limited liability company enrolled with the National Register of Legal Entities (Cadastro Nacional das Pessoas Jurídicas) of the Brazilian Ministry of Finance (“CNPJ”) under No. 66.521.821/0001-81, with its registered office at Rua Pais Leme, nº 215, Conj. 1713, Pinheiros, Município de São Paulo, Estado de São Paulo, CEP 05424-150 (“Balysta”), a platform based on Artificial Intelligence.

This Privacy Policy applies to the use of the website (“Website”) and of the Balysta digital platform, its systems, interfaces and other features made available during the testing phase (“Platform”), as well as to interactions conducted through its official communication channels.

This Policy must be read together with Balysta’s Terms of Use (https://balysta.ai/en/legal/terms).

Acceptance of this Privacy Policy is absolutely indispensable for accessing and using the Website and the Platform. Accordingly, use of the Website and the Platform implies that you have read, understood and fully accepted this Privacy Policy. You must read, make sure you have understood and accept all of the conditions established in this document, as well as in the other documents incorporated by reference, before registering as a User. If you do not agree with any of its terms, even in part, you must not use the Website and the Platform.

The Website and the Platform must not be used by persons under 18 (eighteen) years of age.

This Privacy Policy contains clear and complete information about the collection, use, storage, processing and protection of Users’ personal data (“Personal Data”), with the purpose of demonstrating absolute transparency on this important matter, as provided for in Lei nº 13.709/2018 (the “General Data Protection Law” or “LGPD”).

1. WHY DO WE COLLECT DATA?

1.1. To enable the technical operation of the Website and the Platform, Balysta processes data provided by registered users (“Users” or “You”), strictly for the purposes of extracting, structuring and analyzing financial information contained in submitted documents. To carry out these activities while continuing to respect your privacy, Balysta has developed this Privacy Policy, which applies to the personal data processing activities relating to everyone who in any way provides us with their data, of whatever kind. Personal data are collected for the purposes specified in Section 4.

2. DEFINITIONS

2.1. Before you continue reading this Privacy Policy, please note that the terms listed below are used throughout this Privacy Policy, in the singular and in the plural, in the masculine or feminine form, with the meaning established in this Clause 2, as follows:

2.2. “ANPD”: the Brazilian National Data Protection Authority (Autoridade Nacional de Proteção de Dados), the public-administration body responsible for safeguarding, implementing and monitoring compliance with personal data protection legislation in Brazil, pursuant to the General Data Protection Law;

2.3. “Balysta”: has the meaning ascribed to it in the preamble;

2.4. “Support Channels”: as indicated in Section 9.2;

2.5. “Personal Data”: has the meaning ascribed to it in the preamble;

2.6. “User Personal Data”: has the meaning ascribed to it in Section 3.2;

2.7. “External Personal Data”: has the meaning ascribed to it in Section 3.2;

2.8. “User Professional Data”: has the meaning ascribed to it in Section 3.2;

2.9. “Data Processing Agreement” or “DPA”: has the meaning ascribed to it in Section 3.4;

2.10. “Communication Information”: has the meaning ascribed to it in Section 3.1;

2.11. “Browsing Information”: has the meaning ascribed to it in Section 3.1;

2.12. “General Data Protection Law” or “LGPD”: has the meaning ascribed to it in the preamble;

2.13. “Platform”: has the meaning ascribed to it in the preamble;

2.14. “Website”: has the meaning ascribed to it in the preamble;

2.15. “Corporate Use”: has the meaning ascribed to it in Section 3.2;

2.16. “User”, “You”, “your”: has the meaning ascribed to it in Section 1.1.

3. HOW WE COLLECT AND STORE PERSONAL DATA

The following may also be collected: file name, upload date and time, processing records, and anonymized or aggregated usage data, wherever technically possible. Balysta may retain the User’s Inputs, outputs, records, histories, logs, metadata, technical signals and other information related to the use of the Platform for as long as necessary to fulfill the legitimate purposes described in these Terms and in the Privacy Policy (“Metadata and Technical Records”).

You warrant and are responsible for the truthfulness, accuracy, currency and authenticity of the Personal Data, and you undertake to keep it duly up to date. In the case of Corporate Use, you further represent that you have the necessary powers, authorizations and legitimacy, where applicable, to act on behalf of the legal entity or organization to which you are affiliated, being aware that your use on behalf of a business entity will bind that entity to this Privacy Policy with respect to the data you enter into the platform.

3.1 Data collected on the Website

3.1.1. If you accept Cookies, Balysta will automatically collect and store certain information about your activity on the Website and/or the Platform. In this context, Browsing Information means: IP address, browser type, pages visited, date and time of access, mobile device model, connection provider, User actions on the Website and the Platform, time spent on the website, and other location statistics, such as country, city and state.

3.1.2. Communication Information means: information contained in any communications sent by the User, whether by e-mail, contact forms or social media.

3.2 Data collected on the Platform

3.2.1. If you use the Platform as an individual, your Personal Data, such as full name, e-mail address, mobile phone number and IP address (“User Personal Data”), may be collected when you register on the Platform digitally (“Registration”), voluntarily providing your personal information, as well as browsing information, communication information and any other data that may be necessary for the purposes of the registration to be fulfilled.

3.2.2. You represent and undertake to update the Personal Data entered in your Registration whenever necessary.

3.2.3. For payment processing and subscription management on the Platform, financial information will be collected. Balysta uses a specialized third-party payment service provider (Stripe, Inc.) to ensure the security of transactions. (a) Third-Party Processing: Full credit card details (such as card number, CVV and expiry date) are collected and processed directly by the payment provider in a secure environment certified under the PCI DSS Level 1 standard. Balysta does not access, view or store sensitive credit card data on its servers. (b) Tokenization: The payment provider uses tokenization technology, replacing sensitive card data with a unique digital identifier (token), which is used by Balysta solely for recurring billing and subscription management purposes. (c) Data Stored by Balysta: For administrative management, customer support and financial record-keeping purposes, Balysta will store only: the customer’s unique identifier with the payment provider; subscription status and contracted plan; payment history (amounts, dates and transaction statuses); invoices issued; the last 4 (four) digits of the credit card, exclusively for identification purposes and for display to the User in the Platform interface.

3.2.4. If you use the Platform within a corporate access governance structure (“Corporate Use”), professional data, such as job title, company, field of activity and organizational affiliation (“User Professional Data”), may be collected in addition to the personal data already indicated, provided at the time of registration or in the course of using the Platform.

3.2.5. User Professional Data may be used for purposes of identification, access management, organization of permissions, structuring of corporate environments (such as workspaces and teams) and the proper operation of the Corporate Account.

3.2.6. The User undertakes to keep their Professional Data up to date and is responsible for the truthfulness and accuracy of the information provided.

3.2.7. If the User acts as the administrator or principal holder of a Corporate Account, they will be responsible for managing the data and access of the users linked to it, including, where applicable, adding, removing and updating users, as well as defining and modifying access permissions to the Platform.

3.2.8. Personal Data of third parties may also be collected as a result of documents and information entered in the course of using the Website and the Platform (“External Personal Data”). Although Balysta does not actively request such data, uploaded documents may incidentally contain information such as names, CPF numbers, signatures or professional data. Such data is processed exclusively for the technical purpose requested by the User. In this context, the User declares that they are aware that, when entering, uploading or processing personal data of third parties, including sensitive personal data, especially in the context of Corporate Use, they must act in compliance with applicable law, and they are fully responsible for ensuring the existence of a legal basis, authorizations and all other requirements necessary for such processing, as well as for any resulting consequences with respect to the subjects of that data.

3.3 Balysta’s Role (Controller/Processor)

3.3.1. For the purposes of applicable data protection legislation, you acknowledge that Balysta may act: (i) as a controller with respect to the data necessary for the creation, authentication, administration, billing, security, support and management of the User’s account and of the contractual relationship; and/or (ii) as a processor with respect to the data contained in the User’s Inputs processed on behalf of and under the instructions of the User, as applicable and, where formalized, under the relevant DPA; and/or (iii) as a controller of aggregated data with respect to anonymized or aggregated data used for sector benchmarking, market intelligence and the development of new products and features, such processing being carried out primarily pursuant to Art. 12 of the LGPD and, on a subsidiary and precautionary basis, on the grounds of Balysta’s legitimate interest (Art. 7 (IX) of the LGPD), with a view to the continuous improvement of the Platform and the provision of strategic insights to the sector.

3.4 Corporate Use and DPA

3.4.1. In cases of Corporate Use, the parties may enter into a specific personal data processing instrument (“Data Processing Agreement” or “DPA”), as applicable.

3.4.2. The DPA will govern, among other aspects, the parties’ responsibilities, the processing instructions, the security measures, the sharing rules and the conditions for the processing of personal data, in accordance with applicable law.

3.4.3. The User declares that they will assess, at their sole responsibility, the need to formalize additional data protection instruments, including specific terms, a DPA, internal policies, clauses with third parties or governance measures compatible with their activity.

3.4.4. In the context of Corporate Use, responsibility for the legitimacy of the data entered may rest with the organization to which the User is affiliated, as applicable.

3.4.5. Balysta may make available features that allow data and activities to be viewed by other users of the same Corporate Use account, subject to the configured access levels.

3.5 Subprocessors and storage

3.5.1. All User information or Personal Data is stored on cloud infrastructure and processed through subprocessors engaged by Balysta, with access restricted to authorized persons. Balysta maintains contracts and/or terms of use with each subprocessor that include data protection, confidentiality and information security obligations.

3.5.2. The complete and up-to-date list of the subprocessors used by Balysta, including name, purpose, location and applicable protection measures, is available at https://balysta.ai/en/legal/third-party-providers. The User will be notified of the addition of new subprocessors that entail a change in the purpose of the processing or substantial changes to security practices at least 30 days in advance, via the registered e-mail address or a notice on the Platform. The User’s silence after the notification period will be construed as acceptance of the new list.

4. PURPOSES AND LEGAL BASES

4.1 Common purposes

4.1.1. For you to interact with the Balysta team, we ask that you provide certain Personal Data in accordance with the purposes of your interaction. Balysta may request your Personal Data for:

4.1.2. Communication through the Support Channels: to answer Users’ questions and requests, through any available physical or virtual means, with e-mail being the primary channel for this purpose.

4.1.3. Marketing: to send newsletters, promotional materials and updates, where the User has opted in to receive them; Cookies and Browsing Information are used for this purpose.

4.2 Website purposes

4.2.1. Service improvement and analysis of behavior on the platforms: to understand how the Website is being used and to improve the browsing experience; Cookies and Browsing Information are used for this purpose.

4.3 Platform purposes

4.3.1. To complete your registration as a User;

4.3.2. To enable you to make use of the Website and the Platform;

4.3.3. To extract, standardize and structure financial information;

4.3.4. To generate organized outputs as requested by the User;

4.3.5. To ensure the stability, security and performance of the Platform;

4.3.6. To analyze technical records and anonymized data for the continuous improvement of the service.

4.3.7. To process payments on the Platform and generate financial documents, such as payment slips (boletos) and invoices.

4.4 Legal bases

4.4.1. To carry out the purposes mentioned in the preceding sections, Balysta processes Users’ Personal Data on the following legal bases: (i) upon the provision of your consent; (ii) for the performance of a contract, or of preliminary procedures relating to a contract, to which you are a party, at your request; (iii) to meet the legitimate interests of Balysta or of a third party, except where the User’s fundamental rights and freedoms requiring the protection of personal data prevail.

4.4.2. In exceptional situations, Balysta may process your Personal Data on the following legal bases: (i) compliance with a legal or regulatory obligation; (ii) the regular exercise of rights in judicial, administrative or arbitration proceedings; (iii) the protection of your life or physical safety or that of third parties; (iv) the carrying out of studies.

4.5 Sharing

4.5.1. Your data may be shared with:

4.5.2. Partner companies, which act as subprocessors and/or participate directly or indirectly in Balysta’s operations, for purposes specifically tied to such operations;

4.5.3. Companies responsible for audits or for carrying out studies and similar work, for purposes tied to the security of Balysta’s business and of its data, as well as strategic purposes for improving Balysta’s activities and your experience;

4.5.4. Business parties, courts, supervisory bodies and regulatory authorities: for purposes relating to the performance of contracts, Balysta’s legitimate interests and compliance with legal provisions and/or court orders;

4.5.5. Payment service providers and/or banking institutions, for the generation and control of payments;

4.5.6. Balysta reserves the right to transmit Users’ Personal Data to other Users, entities or third parties where there are sufficient grounds to consider that a User’s activity is potentially unlawful or harmful to other persons.

4.6 International transfers

4.6.1. The Personal Data collected by Balysta may be transferred to, stored and processed in foreign countries, notably in the European Union (European Economic Area) and in the United States, to enable the use of the cloud infrastructure and of the subprocessors described in Clause 3.5. Balysta ensures that such transfers take place strictly in compliance with the LGPD, adopting appropriate measures to guarantee the protection of the data. The service providers used by Balysta, such as Hetzner, adopt internationally recognized data protection standards, including compliance with the General Data Protection Regulation (GDPR).

4.7 Third-party links and content

4.7.1. The Website may contain links to other websites, which does not mean that those websites are owned or operated by Balysta. As it has no control over such third-party websites, Balysta will not be liable for the content, practices and services offered on third-party websites. The presence of links to other websites does not imply any relationship of partnership, supervision, complicity or joint liability of Balysta with respect to those websites and their content. You acknowledge and accept that the links are provided solely as a convenience and that your access and use (i) will be entirely at your own risk; (ii) will be subject to the terms of use and privacy policies of the relevant third parties.

4.7.2. This Website may include embedded content such as videos, images, articles, etc. from other websites. In that case, such content behaves in exactly the same way as if the User were visiting the other website, which may collect data, use cookies, embed additional third-party tracking and monitor the User’s interaction with that embedded content.

5. ARTIFICIAL INTELLIGENCE AND DATA PROCESSING

5.1 Use of artificial intelligence

5.1.1. Balysta employs artificial intelligence technologies to extract, structure and organize information contained in the documents and data entered by the User on the Platform. Data processing by means of these resources takes place in an automated manner and may involve the generation of results, inferences and classifications based on the data provided by the User. Balysta does not use the data entered by the User, in identified form, to train third-party artificial intelligence models, subject to the provisions of this Policy and of the Terms of Use. Balysta shall not be liable for damage, losses or violations of the privacy of the User or of third parties arising from the use, interpretation or disclosure of the information generated by the Platform, including where such information is used for purposes that go beyond the technical extraction and structuring purpose originally requested. The list of the AI technology providers used, including their respective purposes and locations, is available and kept up to date at https://balysta.ai/en/legal/third-party-providers. AI processing takes place exclusively through application programming interfaces (APIs) of specialized providers. Balysta maintains contractual guarantees with such providers to ensure that the data submitted is not used to train third-party foundation models. Balysta adopts logical isolation measures per account (tenant isolation), ensuring that each User’s data is processed in a segregated environment, without any sharing of, or cross-access to, data of other Users of the Platform.

5.2 Platform improvement

5.2.1. Balysta may use technical, behavioral, statistical, structural, documentary and operational patterns for the systemic improvement of the Platform, as set out in the Terms of Use.

5.3 Benchmarking and anonymization

5.3.1. Any sector benchmarking, comparisons and related analyses provided by the Platform will not directly use your personal data, but may be based on aggregated, anonymized, statistical, standardized, inferential, historical or sample-based data, or on data derived from patterns identified in the platform’s ecosystem, which does not entail the identification of any specific user or third party, pursuant to Art. 12 of the LGPD.

6. SECURITY OF INFORMATION AND RESULTS

6.1 Technical and organizational measures

6.1.1. Balysta is required to comply with the applicable rules on Personal Data security measures. In addition, it employs advanced industry standards for the protection of personal information, including, among other measures, firewalls and Transport Layer Security (TLS 1.2+). Balysta regards its Users’ Personal Data as an asset that must be protected from any loss or unauthorized access, and therefore employs security techniques to protect such data from unauthorized access; even so, it is acknowledged that absolute security does not exist on the internet.

6.1.2. Balysta adopts appropriate technical and organizational measures, including: restricted access control; logical segregation of environments; monitoring and logging of technical activities; encryption at rest (AES-256); logical tenant isolation (Row Level Security); role-based access control (RBAC); and automated backups.

6.2 Prohibition on the commercialization of data

6.2.1. Balysta will not sell, rent, assign, transfer or share your Personal or Professional Data, as applicable, except as set out in this Privacy Policy.

6.3 User responsibility

6.3.1. You are responsible for keeping the environment of your access devices secure, through the use of appropriate available tools, such as antivirus software and firewalls, among others.

6.3.2. Balysta will not be liable for any breach of duties of confidentiality, secrecy or privacy owed to third parties arising from the upload, by the User, of documents containing External Personal Data or other confidential information, whether personal or professional, especially where the User does not have legal authorization, a legal basis or valid consent for the processing of such information. The User is fully and solely responsible for the data they enter into the Platform, including inputs, commands, prompts, parameters, questions and instructions, and must ensure that their submission and processing comply with applicable law and with any contractual obligations undertaken with third parties. The User is also fully and solely responsible for the uses, interpretations, decisions, sharing and disclosure of the outputs generated from the data they enter, even where carried out through or on the basis of the Platform, in accordance with the Terms of Use.

6.4 Limitation of liability

6.4.1. Balysta will not be liable for any losses arising from your exclusive fault and/or from unlawful interceptions of, or breaches of, the systems or databases owned by Balysta by unauthorized persons who circumvent the security systems used.

6.5 Security incidents

6.5.1. In the event of any security incident that may give rise to relevant risk or damage to any User, Balysta will promptly notify those affected and the Brazilian National Data Protection Authority (“ANPD”) of the occurrence, in accordance with the provisions of the LGPD.

7. COOKIES

7.1. Users and visitors of the Website acknowledge and accept that a system for collecting browsing data through the use of cookies may be employed, on an optional and consent-based basis. Cookies are small files that are installed on the hard drive, with a limited lifespan, and that help personalize services and features. Certain features will also be offered that are only available through the use of cookies. The information obtained through cookies may be used to understand Users’ interests, behavior and characteristics, analyze pages visited and searches performed, enhance the browsing experience, personalize content, offers and communications, display communications and content related to Balysta, and contribute to the security of the Website and compliance with its rules of use.

7.2. Cookies may be added to the e-mails you send in order to measure the effectiveness of promotions.

7.3. Cookies will not be used for purposes unrelated to their operation.

7.4. The installation, persistence and existence of cookies on your computer or mobile device depend solely on your own choice. Accordingly, cookies may be deleted from your computer or mobile device whenever you wish. You may object to the setting of cookies by the site simply by disabling this option in your own browser. More information on how to do this in some of the most widely used browsers can be found at the following links: (i) Microsoft Edge; (ii) Safari; (iii) Google Chrome; (iv) Mozilla Firefox; (v) Opera.

7.5. Disabling cookies may affect the availability of certain tools and features of the Website, compromising its correct and expected operation. Another possible consequence is the removal of any User preferences that may have been saved, impairing your experience.

7.6. You may also, at any time, review or change your cookie consent directly on the Website, through the “Cookie Settings” option available in the footer of the Website and in Balysta’s legal center (https://balysta.ai/en/legal).

8. DATA RETENTION AND DELETION

8.1 Retention periods

8.1.1. Without prejudice to the right of deletion provided for in Clause 8.2, Balysta may retain certain data, for as long as necessary, for the following legitimate purposes: (i) compliance with legal or regulatory obligations; (ii) the regular exercise of rights in judicial, administrative or arbitration proceedings; (iii) fraud prevention and safeguarding the security of the Platform; (iv) auditing, control and logging of activities; (v) resolution of disputes, complaints or incidents; and (vi) preservation of evidence and of system integrity.

8.2 Data deletion

8.2.1. You may request the deletion of your personal data, documents, information and content submitted to the Platform, in which case Balysta will use its efforts to comply with the request, subject to the applicable technical and legal limitations.

8.2.2. Depending on the case, the deletion request may not extend to: (i) audit and security records; (ii) temporary backups; (iii) data that has already been anonymized or aggregated; and (iv) information whose retention is necessary for the purposes described in this Policy.

8.2.3. The User acknowledges that the requested deletion may not entail the immediate, absolute or simultaneous erasure of all records existing in the environments of Balysta and of its subprocessors, in particular due to technical routines, backup windows, contingency, security and system integrity.

9. YOUR RIGHTS

9.1. By providing Personal Data, you acknowledge the following rights conferred by the LGPD: (i) confirmation of the existence of processing; (ii) access to the data; (iii) correction of incomplete, inaccurate or outdated data; (iv) anonymization, blocking or deletion of data that is unnecessary or excessive or processed in breach of the provisions of the law; (v) portability of the data to another service or product provider, upon express request, in accordance with the regulations of the national authority, subject to commercial and industrial secrecy; (vi) deletion of personal data processed with the data subject’s consent, except in the cases provided for by law; (vii) information about the public and private entities with which the controller has shared data; (viii) information about the possibility of not providing consent and about the consequences of refusal; (ix) withdrawal of consent.

9.2. Consent may be withdrawn at any time through the Support Channel via WhatsApp or by e-mail at [email protected] (“Support Channels”). To ensure that the User seeking to exercise their rights is in fact the subject of the personal data covered by the request, documents or other information that may assist in proper identification may be requested, in order to safeguard the rights of Balysta and of third parties.

9.3. At any time, you may unsubscribe from receiving e-mails by clicking the unsubscribe option at the bottom of any e-mail received. Subscriptions will be cancelled only for e-mails that are not directly related to your use of the Website or the Platform. Essential e-mails, such as login verification, invoices, etc., will continue to be sent, since cancelling them would make it impossible to use the Website and the Platform.

9.4. To request the modification, removal or a copy of your personal data, simply contact the Support Channels indicated in Section 9.2.

10. GENERAL PROVISIONS

10.1. Balysta may amend this Policy at any time. The version in force will be the one made available on the Platform or through a channel indicated by it. Whenever changes to this Policy are materially relevant, Balysta will use reasonable efforts to notify the User at least 30 (thirty) days in advance. In such cases, the changes will take effect after that period has elapsed, and a User who does not agree with the new conditions may, within that period, cease using the Platform or, in the case of Users on a paid plan, choose not to renew their subscription or request early termination, free of charge, with a proportional refund of any amounts paid in advance and not yet used. Continued use of the Platform after the changes take effect will be deemed acceptance of the new Policy.

10.2. The provisions of the Terms of Use apply in addition to those of this Privacy Policy, including, but not limited to, the limitations of liability.

10.3. Any questions regarding this Privacy Policy and/or the processing of Personal Data may be resolved through the Support Channels available in Section 9.2 or directly with the Balysta representative appointed for that purpose.

DPO

Name: Fabian Eberle

Contact: [email protected]

10.4. This Privacy Policy shall be governed by and construed in accordance with the laws of the Federative Republic of Brazil.

10.5. Any disputes arising from this Privacy Policy shall be settled in the courts of the City of São Paulo, State of São Paulo, to the exclusion of any other venue, however privileged it may be.