legal
Privacy Policy
Cuanto AI Inc. — Privacy Policy
Cuanto AI Inc. ("Cuanto," "Company," "we," "us") is a Delaware corporation with registered address at 251 Little Falls Drive, Wilmington, DE 19808. This Privacy Policy describes how we collect, use, and share personal data in connection with our commerce-layer platform and related components (the "Services").
1. Who Controls End User Data
Cuanto's Partners deploy the Services (including the Chat Widget, Product Cards, Cashback Layer, and MCP Connector) within their own products, apps, websites, or agents. In most cases, the Partner is the controller (or business, under U.S. state privacy laws) of personal data collected from its End Users, and Cuanto acts as a processor (or service provider) on the Partner's behalf, except where Cuanto processes data for its own purposes (e.g., to prevent fraud, secure the Services, or comply with law), in which case Cuanto acts as an independent controller for that processing.
2. Information We Collect
2.1 Information collected directly. We may collect information that Partners or End Users provide directly, such as account registration details, contact information, billing and payout information, and communications with us.
2.2 Information collected automatically. When the Services are used, we may automatically collect device information, IP address, browser type, usage and interaction data, referral URLs, cookies and similar tracking technologies, and transaction/attribution data (clicks, orders, and commission events).
2.3 Information collected via embedded components. Where a Partner deploys the Chat Widget, Product Cards, Cashback Layer, or MCP Connector to its End Users, we may collect information about End Users' interactions with those components, including chat inputs, product views, clicks, and purchase/cashback events, as necessary to provide the Services.
3. How We Use Information
We use the information we collect to provide, operate, and improve the Services; process transactions, commissions, and redemptions; detect and prevent fraud and abuse; provide customer support; communicate with Partners and End Users; comply with legal obligations; and enforce our agreements.
3.1 Legal bases (EEA/UK). Where the General Data Protection Regulation (GDPR) or the UK GDPR applies, we rely on one or more of the following legal bases: performance of a contract, our (or a Partner's) legitimate interests, compliance with a legal obligation, and consent (where required, e.g., for certain cookies or marketing).
4. How We Share Information
We may share information with: Partners (for data generated through their deployment of the Services); Upstream Networks and merchants (to attribute and validate transactions); payment processors and banking partners (to process redemptions); service providers who support our infrastructure, analytics, and security; professional advisors and regulators as required by law; and successors in the event of a merger, acquisition, or asset sale. We do not sell personal data for money.
4.1 Cross-context behavioral advertising. To the extent our sharing of information with Upstream Networks or advertising partners constitutes a "sale" or "share" for cross-context behavioral advertising under applicable U.S. state privacy laws (e.g., the CCPA/CPRA), individuals may exercise applicable opt-out rights as described in Section 8 below.
5. International Transfers
We may transfer personal data to, and process it in, countries other than the country in which it was originally collected, including the United States. Where required, we use appropriate safeguards for such transfers, such as Standard Contractual Clauses or other lawful transfer mechanisms.
6. Data Retention
We retain Partner account and financial records for as long as necessary to comply with legal, tax, and accounting obligations, and in any event for at least seven (7) years after account closure. End User interaction data (e.g., Chat Widget conversations, click and attribution data) is retained by default for twenty-four (24) months, unless a longer period is required by law, requested by a Partner, or necessary to resolve a dispute or claim.
7. Your Rights
Depending on your jurisdiction, you may have rights to access, correct, delete, or port your personal data; to restrict or object to certain processing; and to withdraw consent where processing is based on consent. Where Cuanto acts as a processor or service provider on behalf of a Partner, we will direct such requests to the relevant Partner or assist the Partner in responding, as required by applicable law and our agreements with Partners.
8. Exercising Your Rights
To exercise applicable privacy rights, contact us at [email protected]. We will respond within the time periods required by applicable law and may need to verify your identity before fulfilling a request.
8.1 California residents (CCPA/CPRA). California residents have the right to know what personal information is collected, used, disclosed, or sold/shared; the right to delete personal information; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information and of targeted advertising; and the right to non-discrimination for exercising these rights. We do not sell personal information for money and do not knowingly sell or share the personal information of minors under 16.
9. Security
We use administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, disclosure, alteration, or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Children's Privacy
The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13 without verified parental consent, we will take steps to delete that information.
11. AI Features and Automated Processing
Certain Services (including the Chat Widget and MCP Connector) use artificial intelligence to generate recommendations, summaries, or other outputs based on End User inputs and Brand Catalog data. These outputs are generated automatically and may not always be accurate. We do not use AI features to make decisions that produce legal or similarly significant effects concerning individuals without appropriate human involvement, except as disclosed to and agreed with the relevant Partner.
12. Third-Party Links
The Services may contain links to third-party websites, merchants, or Upstream Networks. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies.
13. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will provide notice as required by applicable law (e.g., by posting an updated policy with a new effective date, or by direct notice where required). Continued use of the Services after an update becomes effective constitutes acceptance of the updated policy.
14. Contact
Questions about this Privacy Policy: [email protected]