Privacy Policy

The controller of personal data processed on the Platform is Token Easily — Tokeneasily Desenvolvimento e Licenciamento de Softwares LTDA, CNPJ 54.214.443/0001-04, headquartered at Avenida Brigadeiro Faria Lima, 1572, Sala 1022, Jardim Paulistano, São Paulo/SP, CEP 01451-917, which develops FINAUTON.

This Policy applies to the FINAUTON website and waitlist and, once access is released, to the other Platform interfaces, integrations and APIs. It supplements the Terms of Use.

Waitlist data

When you join the waitlist, we process only what you provide in the form and the technical records of the submission:

• First name, last name and phone/WhatsApp number (required) and email (optional).
• Platforms and exchanges where you report trading, or an indication that you do not trade yet, and services you already use.
• Where you plan to use FINAUTON (centralized platform accounts, on-chain/Web3 environments or both) and the areas that interest you most.
• Optionally, a range you would consider setting aside to operate through a Smart Account. It is only an intention range: we do not ask for your balance or wallet address.
• Names of the wallets you use (no addresses), cryptoasset experience and optional notes.
• A referral code when you arrive through an invitation link, the source of the registration and the code generated for you to invite others.
• Consent record: date and time of acceptance and the version of this Policy.
• IP address of the submission and technical request records, used for security, abuse prevention and evidence of consent.

Data collected once access to the Platform is released

The data below is processed only after your access is released and according to the features you use.

Account and Platform use

• Name and email address when provided during account registration.
• Password, stored only as a cryptographic hash, never in readable form.
• Public wallet address when you sign in with a wallet signature, link a wallet or register one to receive commissions.
• API keys and other integration credentials made available by the exchange, when you choose to connect an integration (see section 4).
• Configured Permissions and parameters: protocols, tokens, value limits, expiry, leverage and other operational limits.
• Requests sent to Agents and FIN, including natural-language commands when available, and each execution's audit record: intent, validations, quote, result and transaction identifiers.
• Messages you send through support channels.
• Exchange and UID submitted for partnership review, request date, ownership and relationship checks, administrative decisions, validity and review history.

Data collected automatically during Platform use

• IP address at account registration and the date, time and version of accepted Terms, used as evidence of consent.
• Application access and event logs, including dates, times and actions.
• History of operations initiated through the Platform: assets, prices, quantities, fees and results.
• Public blockchain data associated with connected wallets, such as balances and transactions, queried to display information and validate operations.

Each processing activity has a specific purpose and legal basis:

• Managing the waitlist and contacting you about the release of access: consent requested in the form (article 7(I)). Platform, service and interest answers help prioritize integrations and organize invitations. Consent may be withdrawn at any time with a request to delete waitlist data.
• Protecting the waitlist form against automated, duplicate or abusive submissions using IP addresses and technical records: legitimate interest (article 7(IX)).
• Creating and maintaining your account, authenticating access and providing the service: performance of a contract (article 7(V)).
• Connecting integrations and executing authorized actions: contract performance and specific consent expressed when granting each Permission (article 7(I) and (V)).
• Validating permissions and compatibility controls and keeping execution audit records: contract performance, exercise of legal rights and legitimate interest in operational security (article 7(V), (VI) and (IX)).
• Sending operational communications, such as account alerts and Terms changes: contract performance (article 7(V)).
• Recording acceptance of Terms, IP and version: legal obligations and exercise of legal rights (article 7(II) and (VI)).
• Keeping application access logs for 6 months: the legal obligation in article 15 of Brazil's Internet Civil Framework (article 7(II)).
• Preventing fraud and abuse and protecting Platform security: legitimate interest (article 7(IX)).
• Sending marketing communications: consent (article 7(I)), revocable at any time.

The remaining purposes in this section apply once access to the Platform is released.

We do not sell personal data. Depending on the feature and the data available to it, FIN may perform automated processing of user configurations, instructions, strategies, parameters, positions, operational context, risk conditions, limits, permissions and market data to analyze conditions, structure actions and use authorized capabilities. Using public market data does not exclude consideration of individual context available to the feature.

Automated processing does not in every case imply a decision made solely by automated means. The degree of User involvement and the authorization and confirmation mechanisms depend on the feature and configuration used. Where applicable law grants rights relating to automated decisions or processing, data subjects may exercise the corresponding rights through the channels provided by the Platform.

• Secret exchange integration keys are encrypted before storage and are not displayed again after registration.
• Public API keys are displayed only in masked form.
• API keys and other integration credentials made available by the exchange are stored protected and used only for actions permitted by the Third-party Platform, which in supported integrations exclude withdrawals.
• Keys and credentials are used only to query balances and positions and execute actions within your Permissions.
• We instruct users to generate API keys without withdrawal permission and display a prominent warning if it is detected.
• You may revoke keys, integration credentials and token approvals directly in the exchange, protocol or wallet at any time, ending our access to that integration.

We share data only as necessary to provide the service, with these recipient categories:

• Connected Third-party Platforms, including exchanges and protocols: they receive instructions authenticated with your credentials or transactions from your wallet. Their processing is governed by their own policies, which we do not control.
• RPC node, quote and market data providers: they receive the queried public address and operation parameters to read balances, calculate routes and submit transactions.
• AI providers: when used for market analysis or command interpretation, they receive the data needed for the task, without keys, passwords or credentials.
• Infrastructure and messaging providers: hosting, databases and email delivery, acting as processors.
• Public blockchains: transactions are recorded publicly and permanently on the network used.
• Network-fee payment or sponsorship services: when an integration offers this mechanism and you choose to use it, the provider processes the data needed to quote and execute the service under its own policy.
• Public authorities: pursuant to a court order, a competent authority's request or a legal or regulatory obligation.

In a corporate reorganization, merger or acquisition, data may be transferred to the successor while maintaining this Policy's commitments and giving data subjects advance notice.

We use only cookies necessary for the service. We do not use advertising, behavioral tracking or third-party profiling cookies.

• Session cookie: keeps you signed in after access is released. It is not accessible to page scripts, has a limited lifetime and contains only a signed session token.
• Referral code: temporary storage in the browser session for one waitlist submission. The code received through a link is consumed after a successful submission; a new registration without a referral does not inherit a previously used code. Clear site data to delete it.
• Interface preferences: local storage that remembers the selected language, appearance and environment. It grants no authorization or access.

Blocking the session cookie prevents authentication and consequently Platform use. You can end your session at any time with the logout button.

• Waitlist data: retained while the waitlist is active, until your access is released, or until you withdraw consent or request deletion, whichever comes first; deleted if the waitlist ends. Technical security records of the submission follow the access-log retention period.
• Registration data: retained while the account remains active.
• Application access logs: 6 months, under article 15 of Brazil's Internet Civil Framework.
• Terms acceptance records: retained during the contractual relationship and the applicable limitation period.
• Operation history and execution audit records: retained while the account is active and as needed for legal obligations and the exercise of legal rights.
• API keys and integration credentials: deleted when you remove them or close your account.

After account closure, data is deleted or anonymized except where retention is required under LGPD article 16. On-chain records are unaffected because they are outside our control.

• Traffic encrypted in transit using TLS.
• Passwords stored only as cryptographic hashes.
• Secret API keys encrypted at rest.
• Sessions kept in cookies that page scripts cannot read, mitigating token theft.
• Account isolation: each user can access only their own data, checked on every request.
• Validation of permissions and compatibility controls before any execution, with audit records.
• Rate limits on authentication attempts and requests to contain automated attacks.
• Waitlist form with server-side validation, size and submission limits and protection against automated submissions.

No system is completely immune. Use a strong, unique password, enable two-factor authentication on your exchanges and periodically review wallet token approvals. Never share your recovery phrase; our team will never request it.

Under LGPD article 18, you may request at any time:

• confirmation of whether processing occurs;
• access to your data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data;
• portability to another provider upon an express request;
• deletion of data processed on the basis of consent;
• information about whom we share your data with;
• information about refusing consent and the consequences;
• withdrawal of consent;
• objection to processing based on legitimate interest.

To exercise these rights, including withdrawing consent and deleting your waitlist data, write to founder@finauton.com. We will respond as promptly as possible within legal deadlines and may request additional information to verify your identity.

You may also file a complaint with Brazil's National Data Protection Authority (ANPD).

Where LGPD article 20 applies, data subjects may request review of decisions based solely on automated processing of personal data that affect their interests. They may also request clear and adequate information about the criteria and procedures used, subject to commercial and industrial secrecy and other applicable legal conditions.

Infrastructure, node, AI and email providers, and Third-party Platforms, may process data outside Brazil. In those cases, we adopt the applicable safeguards under LGPD articles 33–36. Public blockchains are globally replicated by nature.

The Platform is exclusively for people aged 18 or older and does not intentionally collect children's or adolescents' data. If such a registration is identified, the account or registration is closed and data deleted. Guardians who identify this situation should contact founder@finauton.com.

If a security incident may cause significant risk or harm to data subjects, we will notify the ANPD and affected individuals within a reasonable time, explaining the data involved, risks and measures taken, under LGPD article 48.

This Policy may be updated. Material changes will be communicated by email or a prominent Platform notice. The current version is the one published on this page, identified by its version number and update date.

Tokeneasily receives data processing requests through the privacy channel below.

Privacy matters and exercise of rights: founder@finauton.com.

General support: founder@finauton.com.

Token Easily — Tokeneasily Desenvolvimento e Licenciamento de Softwares LTDA — CNPJ 54.214.443/0001-04 — Avenida Brigadeiro Faria Lima, 1572, Sala 1022, Jardim Paulistano, São Paulo/SP, CEP 01451-917.