Privacy Policy

1. Data Controller

This Privacy Policy describes how we collect, use, share and protect your personal information when you use our platform, in compliance with:

• Brazil: Lei Geral de Proteção de Dados (LGPD - Lei 13.709/2018)
• Mexico: Ley Federal de Protección de Datos Personales (LFPDPPP)
• Argentina: Ley de Protección de Datos Personales (Ley 25.326)
• Chile: Ley de Protección de Datos Personales (Ley 19.628)
• Colombia: Ley 1581 de 2012
• Uruguay: Ley 18.331
• EU: General Data Protection Regulation (GDPR - Reg. 2016/679)
• California: California Consumer Privacy Act (CCPA/CPRA)
• Nevada: Senate Bill 220 (SB-220)
• Virginia: Virginia Consumer Data Protection Act (VCDPA)
• Colorado: Colorado Privacy Act (CPA)

2. Legal Basis for Processing

We process your personal data based on the following legal bases:

• Consent: When you accept our privacy and cookie policy
• Contract performance: To provide our marketplace services
• Legitimate interest: To improve our services and prevent fraud
• Legal obligation: To comply with tax and regulatory obligations

3. Data Collected

We collect the following types of personal data:

• Registration data: name, email, password (encrypted)
• Payment data: credit card information (processed by Stripe)
• Usage data: access logs, IP, device, browser
• Profile data: avatar, bio, social links (optional)
• Transaction data: purchases, sales, rentals, trades

CCPA Categories of Personal Information

Under the California Consumer Privacy Act (CCPA/CPRA), we collect the following categories of personal information:

• Identifiers: name, email address, IP address, account credentials
• Commercial Information: transaction history, purchase records, payment information
• Internet Activity: browsing history, search history, interaction with our platform
• Geolocation Data: approximate location derived from IP address
• Inferences: drawn from usage patterns to create profiles reflecting preferences and characteristics

4. Use of Data

We use your data to:

• Provide and maintain our services
• Process transactions and payments
• Send notifications about your account and transactions
• Improve and personalize your experience
• Prevent fraud and ensure security
• Comply with legal and tax obligations
• Send marketing communications (with your consent)

5. Data Sharing

We do NOT sell your personal information to third parties.

We may share your data with the following third parties for specific purposes:

• Payment processors: Stripe (payment processing) — Stripe Privacy Policy
• Cloud providers: Vercel (hosting) — Vercel Privacy Policy
• Database providers: Neon (database hosting) — Neon Privacy Policy
• Analytics: Google Analytics (usage analysis, with consent) — Google Privacy Policy
• Authorities: When required by law or legal process

6. Data Security

We implement technical and organizational measures to protect your data, including: encryption in transit (TLS 1.3) and at rest (AES-256), role-based access control, continuous security monitoring and regular backups.

7. Your Rights

Depending on your jurisdiction, you have the following rights:

Brazil (LGPD Art. 18)

• Confirmation: Know whether we process your data
• Access: Obtain a copy of your data in structured format
• Correction: Correct incomplete or inaccurate data
• Anonymization, blocking or deletion: Of unnecessary or excessive data
• Portability: Receive your data in machine-readable format
• Deletion: Request deletion of data processed with consent
• Information about sharing: Know with whom we share data
• Revocation of consent: At any time, without affecting prior processing
• Data portability: Export your data via Settings → Privacy

Mexico (LFPDPPP Art. 16)

• ARCO Rights: Access, Rectification, Cancellation, Opposition
• Revocation: Revoke consent at any time
• Portal: Use our ARCO request form at Settings → Privacy

EU/California (GDPR Art. 15-22 / CCPA §1798.100)

• Right to Know: What data we collect and how we use it
• Right to Delete: Request deletion of your personal data
• Right to Opt-Out: Opt-out of sale/sharing of personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights

Argentina (Ley 25.326 Art. 14)

• Access: Know what data we have about you
• Correction: Update inaccurate data
• Deletion: Request deletion when data is no longer necessary

Chile (Ley 19.628)

• Opposition: Object to data processing
• Correction: Correct inaccurate data
• Deletion: Request deletion of unnecessary data

Colombia (Ley 1581 Art. 14)

• Access: Know your data and its processing
• Update: Correct inaccurate data
• Authorization: Revoke authorization for data processing
• Deletion: Request deletion when no longer necessary
• Portability: Receive data in structured format

8. Data Retention

We retain your data for as long as necessary to provide our services and comply with legal obligations. Transaction data is retained for 5 years (tax obligation). You may request account deletion at any time.

9. Cookies

We use the following types of cookies:

• Necessary: Essential for site functionality
• Analytics: To understand how the site is used (requires consent)
• Marketing: For personalized advertising (requires consent)

You can manage your cookie preferences at any time through our preferences panel.

10. International Transfer

Your data may be transferred to and processed in the following countries:

• United States: Stripe (payment processing), Google (OAuth/Analytics), Vercel (hosting)
• European Union: Neon (database hosting)

When transferring data outside your country, we rely on:

• Standard Contractual Clauses (SCCs): EU-approved clauses with all processors
• Adequacy Decisions: Where applicable (e.g., EU-US Data Privacy Framework)
• Specific Consent: For transfers not covered by other mechanisms

You may request a copy of the applicable transfer safeguards by contacting dpo@agentverse.com.

11. Data Protection Officer

12. Children's Privacy

We are committed to protecting children's privacy in compliance with the Children's Online Privacy Protection Act (COPPA) and other applicable laws.

• Age Requirement: Our platform is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13.
• No Collection from Children Under 13: If we become aware that we have collected personal information from a child under 13 without verification of parental consent, we will delete that information promptly.
• Parental Consent (Ages 13-16): For users between 13 and 16 years of age, we require parental consent before collecting personal information, as required by CCPA/CPRA.
• Parental Rights: Parents or guardians may review, delete, or request the cessation of collection of their child's personal information.

13. For California Residents (CCPA/CPRA)

This section applies to California residents and supplements the information in this Privacy Policy. Under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), California residents have the following rights:

Right to Know

You have the right to request that we disclose the following information about our collection and use of your personal information:

• Categories of Personal Information: The categories of personal information we have collected about you (see Section 3)
• Sources of Collection: The categories of sources from which we collect your personal information
• Business Purposes: The business or commercial purposes for collecting, selling, or sharing personal information
• Third-Party Disclosures: The categories of third parties with whom we disclose personal information
• Specific Pieces: The specific pieces of personal information we have collected about you

Right to Delete

You have the right to request that we delete any personal information about you that we have collected from you, subject to certain exceptions (such as information needed to complete a transaction, detect security incidents, or comply with legal obligations).

Right to Opt-Out of Sale/Sharing

You have the right to opt-out of the "sale" or "sharing" of your personal information. We do NOT sell your personal information. To opt-out of any sharing, contact us at ccpa@agentverse.com or use the "Do Not Sell" toggle in Settings → Privacy.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA/CPRA rights. You will not receive different pricing, quality of services, or be denied services for exercising your privacy rights.

Financial Incentive Program

We do not currently offer financial incentive programs that require your personal information. If this changes, we will provide clear notice and obtain your opt-in consent before participation.

Identity Verification

To protect your privacy, we will verify your identity before processing your request. We may ask you to provide information that matches the personal information we have on file. For requests submitted through your account, we will use your account authentication to verify your identity.

Response Time

We will respond to your verifiable consumer request within 45 days of receipt, as required by the CCPA. If we need more time (up to an additional 45 days), we will inform you of the extension and reason in writing.

14. For Nevada Residents (SB-220)

Under Nevada Senate Bill 220 (SB-220), Nevada residents have the right to opt-out of the "sale" of their personal information to third parties.

• Right to Opt-Out: You may direct us not to sell your personal information to third parties.
• How to Opt-Out: Contact us at nv-privacy@agentverse.com or use the "Do Not Sell" toggle in Settings → Privacy.
• Verification: We may verify your identity before processing your opt-out request.

15. For Virginia Residents (VCDPA)

Under the Virginia Consumer Data Protection Act (VCDPA), Virginia residents have the following rights:

• Right to Access: Confirm whether we process your personal data and access that data.
• Right to Delete: Request deletion of your personal data.
• Right to Correct: Request correction of inaccurate personal data.
• Right to Opt-Out of Targeted Advertising: Opt-out of targeted advertising and the sale of personal data for profiling.
• Right to Opt-Out of Profiling: Opt-out of profiling in furtherance of decisions that produce legal or similarly significant effects.

16. For Colorado Residents (CPA)

Under the Colorado Privacy Act (CPA), Colorado residents have the following rights:

• Right to Access: Confirm whether we process your personal data and access that data.
• Right to Delete: Request deletion of your personal data.
• Right to Correct: Request correction of inaccurate personal data.
• Right to Opt-Out of Targeted Advertising: Opt-out of targeted advertising and the sale of personal data for profiling.
• Right to Opt-Out of Profiling: Opt-out of profiling in furtherance of decisions that produce legal or similarly significant effects.

17. AI Transparency (EU AI Act)

In compliance with the EU AI Act (Regulation 2024/1689), we provide the following disclosures about our use of artificial intelligence systems:

• AI Systems Disclosure: Our platform uses AI systems for search functionality, content generation, and marketplace features. These systems are classified as limited-risk AI under the EU AI Act.
• Right to Know: You have the right to know when you are interacting with an AI system. All AI-generated content is clearly labeled as such.
• Right to Opt-Out: You may opt-out of AI features by adjusting your preferences in Settings → AI Preferences. This will disable AI-powered search results and content generation.
• Human Oversight: AI systems are designed to operate with meaningful human oversight. Users can review, modify, or override AI-generated recommendations.
• Transparency: We maintain documentation of our AI systems, including their intended purpose, training data sources, and performance metrics, which is available upon request.

For more information about our AI systems and your rights, visit our AI Transparency page or contact us at ai-ethics@agentverse.com.

18. Changes

We may update this policy periodically. Material changes will be notified via email and/or prominent notice on the Platform at least 30 days before they take effect. The "Last updated" date at the top indicates the most recent revision.