Privacy policy.

Who we are

Criabiz Ventures Participações S.A., CNPJ (Brazilian company registration number) 18.360.356/0001-00, is responsible for the personal data processed on this site. Under the Brazilian General Data Protection Law (LGPD), this role is called the controller.

For any matter concerning your data, contact our data protection officer, Christian Pensa, at christian@criabiz.com.

This policy applies to the criabiz.com site. The Criabiz Investor Hub platform, at investidor.criabiz.com, has its own rules, presented to those who use it.

What data we collect and why

We collect only what you send us through the forms and the technical minimum for the site to work securely.

Where	Data	Purpose	Legal basis
Criabiz Angels Educa form	Name, email and WhatsApp	Introduce the group and send the access invitation	Your consent
Contact form	Name, email, company (optional), subject and message	Reply to your message	Your consent
Protection against automated submissions	Technical data from the browser and device, such as IP address	Prevent abuse of the forms	Legitimate interest in keeping the site secure
Access logs	IP address, date, time and page accessed	Security and operation of the site	Legitimate interest and legal obligation to retain logs

Companies are presented through a Criabiz Investor Hub form, which states its own terms when it is filled in.

We do not ask for sensitive data, such as information on health, religion or political opinion. We ask that you also do not include it in your messages.

What this site does not do

• It does not sell or rent personal data.
• It does not display advertising and does not use advertising cookies.
• It measures visits in aggregate, without cookies and without identifying who visits, through Cloudflare Web Analytics. It does not use tools that track a person’s browsing across the site or other sites.
• It does not make automated decisions about you.
• It does not use your data for any purpose other than the one stated in section 2.

The protection against automated submissions may store a piece of technical information in your browser, strictly necessary to confirm that the submission comes from a person.

Who we share data with

Your data is seen only by the people at Criabiz who need it to handle your request. To operate the site, we rely on providers that process data on our behalf and under our instructions.

Provider	What it does for Criabiz
Cloudflare	Hosts the site, provides the protection against automated submissions and measures visits in aggregate
Supabase	Stores, on the Criabiz platform infrastructure, the data sent through the forms

These providers may process data outside Brazil. In such cases, the transfer follows the safeguards required by the Brazilian General Data Protection Law.

Apart from that, we only share data when the law or an order from a competent authority requires it.

How long we keep data

We keep each piece of data for as long as necessary for the purpose for which it was sent.

Data	Period
Interest in Criabiz Angels Educa	While you take part in the group. With no reply to the invitation, 12 months
Contact messages	6 months after the last exchange of messages
Access logs	6 months, the retention period set by the Brazilian Internet Civil Rights Framework (Marco Civil da Internet)

Once the period ends, the data is deleted or anonymized, unless the law requires it to be kept longer. You can ask for deletion before then, as explained in section 6.

Your rights

The data is yours. At any time, you can:

• confirm whether we process your data and have access to it;
• correct incomplete, inaccurate or outdated data;
• ask for the deletion of the data you sent;
• withdraw the consent you gave;
• know who we share your data with;
• ask for data portability;
• ask for the anonymization or blocking of unnecessary data.

To exercise any of these rights, write to christian@criabiz.com. We reply within 15 days. We may ask for additional information to confirm that the request comes from you.

If you believe we have not met your request, you can appeal to the Brazilian National Data Protection Authority (ANPD).

How we protect data

• All communication with the site is encrypted.
• Form data reaches the platform through a single entry point, protected against automated submissions.
• Internal access is restricted by role and is logged.

No system is immune to failure. If an incident occurs that may bring you significant risk or harm, we will notify you and the Brazilian National Data Protection Authority, as the law requires.

Children and adolescents

This site is intended for adults. We do not intentionally collect data from people under 18. If we learn that this has happened, we will delete the data.