Políticas En - Bianchi Capital

1Who we are and scope of this Policy

Bianchi Capital is the controller of personal data processed in connection with the Zayion AI Platform — a software platform (SaaS) for generating signals and automating the execution of orders in crypto assets, sold by subscription.

This Policy applies: (i) to registered users of the Platform; (ii) to visitors to Zayion AI sales and content pages; and (iii) to leads who provide data in forms, groups or acquisition channels linked to the Platform.

Important: the Platform connects to third-party exchanges chosen by the user. Exchanges are independent controllers of the data you provide directly to them, under their own privacy policies.

2Data we collect

2.1. Data provided by you

Registration: name, email, telephone/WhatsApp and, where applicable, CPF/CNPJ (Brazilian taxpayer numbers) and identification data required for invoicing and compliance.
Contracting and payment: payment data (card, PIX, etc.) is collected and processed directly by the payment platform (Hotmart or another designated processor). Bianchi Capital does not store full credit card data; it receives only information on the status of the transaction and the subscription.
Suitability questionnaire: answers on experience, objectives and risk tolerance, used to assign the indicative Risk Profile.
Exchange API key: technical credential provided by you for integration with your exchange account (see Section 4).
Communications: messages exchanged with our support and community channels (email, WhatsApp, application).

2.2. Data collected automatically

Access and usage data: IP address, date and time of access, device, browser, pages visited and actions taken on the Platform.
Acceptance record: date, time, IP and identification captured upon electronic acceptance of the Terms, for evidentiary purposes (Brazilian Law No. 14,063/2020 and Provisional Measure No. 2,200-2/2001).
Operational data: strategy settings, accepted signals, orders executed via API, operation history and actual results of your operations, necessary for the functioning of the dashboards and the service.
Cookies and identifiers: as set out in Section 6.

3Purposes and legal bases of processing

We process your personal data for the purposes below, on the legal bases provided for in the LGPD:

Purpose	Data involved	Legal basis (LGPD)
Provision of the contracted service (access, execution of authorised orders, dashboards, support)	Registration, API key, operational data	Performance of a contract
Billing and management of the recurring subscription	Registration, payment status	Performance of a contract
Authentication, security and fraud prevention	Access data, acceptance record	Legitimate interest and compliance with a legal obligation
Evidentiary record of electronic acceptance of the Terms	Date, time, IP, identification	Compliance with a legal obligation / regular exercise of rights
Suitability assessment and risk warnings	Profile questionnaire answers	Performance of a contract and legitimate interest
Operational communications (service notices, changes to terms, alerts)	Email, telephone, account data	Performance of a contract
Marketing and news communications	Email, telephone/WhatsApp	Consent and/or legitimate interest, with an opt-out option at any time
Anti-money laundering and responding to authorities	Registration, operational data	Compliance with a legal / regulatory obligation
Platform improvement and aggregate statistics	Usage data, preferably anonymised	Legitimate interest

Bianchi Capital does not sell users' personal data.

4API keys — special treatment

The API key you provide is a technical credential that is sensitive to the functioning of the service. It is processed exclusively to: (i) query data from your exchange account; and (ii) execute buy and sell orders previously authorised by you, when in live mode. The Platform does not accept keys with withdrawal or transfer permission — keys with such permissions are actively rejected at registration, as an additional safeguard.

Keys are stored in encrypted form in our infrastructure, with restricted access controls.
Keys are used only for the authorised execution of orders and the reading of data from your account — never to move funds out of the exchange.
You may revoke the API key at any time, directly at your exchange, immediately ending the Platform's ability to access your account.
Upon cancelling your Platform account, the linked API keys are deleted, except for records necessary for legal obligations.

5Data sharing

We share personal data only to the extent necessary for the purposes of this Policy, with:

Payment processors (Hotmart or another designated one): for processing the contracting, recurring billing, refund and cancellation, in accordance with the processor's policies.
Integrated exchanges: API integration transmits to the exchange only the order instructions authorised by you; the exchange already holds your data through a direct and independent relationship with you.
Infrastructure and technology providers: hosting, servers, email tools, messaging, CRM and analytics, engaged as processors, under confidentiality and security obligations.
Public authorities: where required by law, court order or request from a competent authority, including in anti-money laundering matters.
Professional advisers: lawyers, accountants and auditors, where necessary for the defence of rights or compliance with obligations.

We do not share personal data with third parties for third-party advertising purposes and we do not sell personal data.

6Cookies and tracking technologies

Our pages and the Platform use cookies and similar technologies for:

Essential cookies: authentication, session and security — necessary for functioning and which cannot be disabled without impairing the service.
Performance and analytics cookies: usage and navigation metrics, to improve the experience.
Marketing cookies: campaign measurement and remarketing (for example, advertising platform pixels), where applicable.

You may manage cookies in your browser settings. Disabling essential cookies may impair the functioning of the Platform.

7Storage and retention period

We keep your personal data for as long as necessary to fulfil the purposes of this Policy, observing in particular:

Account and operational data: during the term of the contractual relationship and, after its end, for the period necessary to comply with legal, regulatory and tax obligations and to exercise rights in proceedings.
Electronic acceptance record: for the period necessary for its evidentiary function.
Marketing data: until consent is withdrawn or an opt-out is exercised.

Once the applicable periods have elapsed, the data is securely deleted or anonymised.

7.1. Account deletion — specific retentions

When you request deletion of your account, your personal and operational data is deleted. Only two retentions remain, both with a declared and delimited purpose:

Deletion record: email, date/time, IP of the request and a summary of what was deleted, kept to evidence compliance with your request (art. 16 of the LGPD).
List of remaining orders: where the Platform has left orders at your exchange, the list of those orders (exchange, pair, side, size and order number) is kept for up to 90 (ninety) days, for the exclusive purpose of allowing you to cancel them manually, since after deletion we no longer have access to your exchange account. Once the period has elapsed, this list is deleted and only the record above remains. We do not keep the size of your open positions at the exchange.

The treatment of these orders upon termination of access is described in clause 18.4 of the Terms of Use.

8Information security

We adopt technical and organisational measures compatible with the nature of the data processed, including: encryption of sensitive credentials (such as API keys), access control by profile, activity logging, protected communications (HTTPS/TLS) and internal security policies.

No system is absolutely immune to incidents. In the event of a security incident that may entail relevant risk or harm to data subjects, we will take the measures provided for in the LGPD, including notification to the Brazilian National Data Protection Authority (ANPD) and to affected data subjects, where applicable.

9International transfer of data

Some of our infrastructure and service providers, as well as the exchanges integrated with the Platform, may be located outside Brazil. In such cases, the international transfer of data observes the mechanisms provided for in the LGPD, such as contractual clauses and adequate protection safeguards, seeking a level of protection compatible with Brazilian legislation.

10Your rights as a data subject

Under article 18 of the LGPD, you may request at any time:

confirmation of the existence of processing of your data;
access to the data we hold about you;
correction of incomplete, inaccurate or outdated data;
anonymisation, blocking or deletion of unnecessary or excessive data or data processed in breach of the law;
portability of the data, subject to applicable regulations;
deletion of data processed on the basis of your consent, save for the legal grounds for retention;
information about with whom we share your data;
withdrawal of consent and objection to processing based on legitimate interest.

Requests are handled within the deadlines and conditions of the LGPD, through the channels indicated in Section 13. We may request proof of identity to protect your data against improper access.

11Minors

The Platform is intended exclusively for persons aged 18 (eighteen) or over with full legal capacity. We do not intentionally collect data from minors. Should we identify a minor's registration, the account will be terminated and the data deleted, save for legal obligations.

12Changes to this Policy

This Policy may be updated at any time to reflect changes in the Platform, in legislation or in our practices. Substantial changes will be communicated with reasonable advance notice through the registered channels. The version in force will always be available on this page, with the version indicated.

13Contact and data protection officer (DPO)

To exercise your rights, ask questions or make requests about this Policy and the processing of your personal data, contact Bianchi Capital's data protection officer (DPO) at: suportecursos@bianchicapital.com

If you believe your rights have not been adequately addressed, you may lodge a complaint with the Brazilian National Data Protection Authority (ANPD).