These Terms of Use and Privacy Policy (“Terms”) govern access to and use of the Stakeholders Mapper, a product operated by GarciAIgnacio Network Thinking Treinamentos e Consultoria Ltda., registered under CNPJ No. 51.843.593/0001-99, hereinafter referred to as “Stakeholders Mapper,” “GarciAIgnacio,” “we,” or “our.”

These Terms apply to the website, application, dashboards, reports, APIs, exports, and other features made available within the scope of Stakeholders Mapper (“Platform”).

By creating an account or using the Platform, the user declares that they have read and accepted these Terms and acknowledges that they have been made aware of this Privacy Policy.

In the event of a contract, commercial proposal, service order, Data Processing Agreement (DPA), or other specific instrument entered into between GarciAIgnacio and the client, that instrument shall prevail over these Terms in the event of a conflict regarding the respective subject matter.

TERMS OF USE

1. Purpose of Stakeholders Mapper

Stakeholders Mapper is a stakeholder intelligence platform that uses artificial intelligence, network science, data analysis, and other computational techniques to support organizations and professionals in understanding ecosystems, actors, organizations, relationships, narratives, risks, and opportunities related to topics of interest.

Among other features, the Platform can:

• identify and prioritize relevant individuals and organizations;
• organize information from public sources;
• generate indicators, scores, and rankings;
• analyze digital presence, relevance, contextual authority, articulation, and network positioning;
• identify and infer connections between stakeholders;
• visualize networks and ecosystems;
• analyze themes, narratives, risks, and opportunities;
• generate reports, hypotheses, insights, and actionable recommendations;
• enable filters, queries, and exports.

The scope and results of each mapping depend, among other factors, on the objective defined by the user, topics and subtopics, types of stakeholders, territory, period analyzed, hypotheses, available sources, search parameters, and configurations used.

2. Account and eligibility for use

The user must provide truthful information and keep their access credentials secure.

Credentials are personal and may not be shared beyond the limits permitted by the applicable plan or contract.

When a person uses the Stakeholders Mapper on behalf of a company, agency, consultancy, or other organization, they declare that they have sufficient authority or authorization to bind that organization to these Terms.

The user is responsible for all activities performed through their account until they report any potential compromise of their credentials.

3. Responsibility for mapping configuration

The user plays an active role in defining the purpose and context of each project.

The user is responsible for the following, as applicable:

• the objective of the mapping;
• the topics and subtopics researched;
• the hypotheses entered;
• the types of stakeholders requested;
• the territory and time frame;
• names, lists, documents, or data that may be provided;
• the interpretation and subsequent use of the results.

The user must ensure that their objectives, instructions, provided data, and use of the results are lawful and compatible with third-party rights and applicable legislation.

The Platform may block, limit, or reject requests or projects when it identifies a potential violation of these Terms, applicable law, third-party rights, or its security and responsible use policies.

4. Public information and external sources

The Stakeholders Mapper can locate, organize, process, and analyze information that is publicly available on the internet or obtained legitimately through third parties, including, subject to availability:

• websites;
• search engines;
• news and media outlets;
• institutional pages;
• public documents and databases;
• academic publications;
• publicly accessible profiles and content on digital platforms;
• professional registries;
• government sources;
• APIs and authorized data providers.

Stakeholders Mapper is not intended to intentionally bypass passwords, access controls, privacy settings, or other barriers designed to restrict private content.

The fact that certain information is publicly available does not mean it can be used for any purpose. The processing performed by the Platform must observe the applicable legal bases, principles, rights, and limitations.

5. Artificial intelligence, inferences, and scores

Stakeholders Mapper uses automated systems and artificial intelligence models to analyze information and produce results.

These results may include inferences, classifications, scores, rankings, relationships, and recommendations.

Indicators such as Relevance, Authority, Digital Presence, Brokerage, Articulation, Total Score, or equivalent metrics, represent assessments contextual to the analyzed project.

These indicators:

• are calculated in relation to the objective, topic, period, sources, and parameters of the respective mapping;
• do not constitute an absolute, universal, or permanent assessment of the person or organization;
• may vary when parameters or sources are changed;
• should not be interpreted in isolation as a definitive judgment on a person's competence, character, reputation, reliability, or value.

The presence of a stakeholder in a higher or lower position in a ranking does not represent approval, disapproval, or a definitive factual statement by Stakeholders Mapper.

6. Networks and connections

Connections presented in network maps may derive from public evidence, institutional ties, citations, interactions, co-occurrences, documented relationships, or inferences produced by the Platform's methodology.

A visual connection between two stakeholders does not necessarily imply a direct personal relationship, agreement, support, partnership, proven influence, or formal association between them.

Whenever available, users should consider the evidence and sources underlying a given analysis before using it externally.

7. Reports and recommendations

Reports, insights, hypotheses, and recommendations produced by Stakeholders Mapper are intended for supporting human intelligence and decision-making.

Results may contain errors, omissions, inferences, outdated information, or interpretations resulting from the limitations of the sources and models used.

Users must perform human evaluation proportional to the importance of the decision and, when necessary, verify original sources before taking action.

Stakeholders Mapper does not provide legal, financial, medical, credit, labor, or regulatory advice through its outputs.

8. Prohibited uses

The use of Stakeholders Mapper is prohibited for:

• stalk, harass, threaten, intimidate, or cause harm to individuals;
• engage in doxxing or disclose personal information in an abusive manner;
• access or attempt to access content, systems, or accounts without authorization;
• conduct illicit individual surveillance;
• engage in discrimination;
• infer sensitive personal attributes for harmful targeting;
• use characteristics such as race, ethnicity, religion, health, sexual orientation, sex life, biometric data, trade union membership, or other legally protected categories for discriminatory treatment;
• infer a person's private political beliefs for adverse targeting;
• use scores or rankings as a "social credit" system or general classification of an individual's social value;
• make exclusively automated decisions that produce legal effects or significantly adverse impacts on a person;
• use the results as the sole criterion for hiring, firing, promotion, granting credit, insurance, housing, education, medical care, public benefits, or equivalent high-impact decisions;
• perform biometric recognition or biometric identification through the Platform, except for specific functionality legally provided;
• use the Platform for illegal activity;
• infringe upon the intellectual property, privacy, reputation, image, or other rights of third parties;
• resell or make available personal databases extracted from the Platform as a data brokerage service;
• use reverse engineering or other means to copy the Platform's technology, models, methodologies, or architecture;
• use unauthorized automated access, bots, or mass extraction mechanisms outside of the provided functionalities.

The analysis of public professional or institutional activities, including those of public officials, experts, executives, or other relevant actors in public affairs, is not prohibited by this clause when conducted in a lawful and proportionate manner.

9. Sensitive data

Stakeholders Mapper was not designed to create rankings or scores of individuals based on sensitive personal data.

If sensitive information appears incidentally in public content, its presence in the source does not mean it can be used freely.

Stakeholders Mapper may limit, delete, block, or cease processing such information whenever it deems its processing unnecessary, disproportionate, or legally inappropriate.

Users must not enter sensitive personal data into the Platform unless they have an appropriate legal basis and the processing is expressly compatible with the Platform's purpose and applicable law.

10. Children and adolescents

The Platform is intended for professional and business use and is not directed at children.

Projects must not aim to evaluate individuals or create profiles of children or adolescents, except in exceptional circumstances, for a legitimate purpose, and with a specific legal basis.

Stakeholders Mapper may refuse such projects.

11. Outputs, exports, and subsequent use

Authorized users may use the outputs generated by the Platform in accordance with the applicable plan or contract.

When reports, XLSX files, CSV files, charts, rankings, or other outputs contain personal data, the user must:

• restrict access to individuals who have a legitimate need to use them;
• adopt appropriate security measures;
• use them only for lawful purposes;
• respect third-party rights;
• observe applicable retention periods;
• avoid the indiscriminate publication or disclosure of individualized rankings.

The external publication of scores or individualized assessments that may affect the rights, reputation, or interests of individuals must be preceded by human review and verification of an appropriate legal basis by the party responsible for the publication.

The user assumes responsibility for the processing, redistribution, and use of data after it has been exported to environments under their control.

12. Third-party content and services

Information provided through third parties remains subject to the rights, terms, conditions, and restrictions applicable to the respective sources.

Stakeholders Mapper does not guarantee the permanent availability of external sources.

Content may cease to be displayed, be updated, or be removed due to changes in sources, provider requirements, technical limitations, requests from rights holders, third-party rights, or legal obligations.

Trademarks, text, images, content, and other third-party rights remain the property of their respective owners.

13. Stakeholders Mapper Intellectual Property

The Platform, software, interface, models, algorithms, methodology, architecture, dashboards, design, trademarks, code, data structures, and other technologies developed by Stakeholders Mapper are protected by intellectual property rights.

Nothing in these Terms transfers ownership of these elements to the user.

The user is granted only a limited, revocable, non-exclusive, and non-transferable license to use the Platform during the term and under the conditions of the contracted plan.

14. Client data and content

The client retains ownership of the rights they hold over their own information, documents, and content submitted to the Platform.

By submitting information, the user grants Stakeholders Mapper authorization to process it to the extent necessary for service execution, maintenance, security, support, and compliance with legal obligations.

The user declares that they possess the necessary rights and legal basis to provide such information.

Confidential information provided by clients will be handled in accordance with the applicable contract and reasonable confidentiality and security measures.

15. Plans, payments, and commercial terms

Plans, pricing, limits, number of stakeholders, exports, access duration, and other commercial terms shall be those indicated at the time of purchase or in a specific proposal.

Cancellation, refund, and renewal terms may vary depending on the plan or contract.

Where mandatory legislation grants additional rights to the user, such rights shall prevail.

16. Service availability and changes

Stakeholders Mapper may update, modify, add, or remove features for technical evolution, security, regulatory compliance, or product improvement.

We may temporarily suspend the service for maintenance, security, vulnerability patching, third-party outages, or events beyond our reasonable control.

We do not guarantee uninterrupted availability or the continued existence of any specific third-party source, integration, or functionality.

17. Account suspension and termination

We may restrict or suspend an account in the event of:

• violation of these Terms;
• security risk;
• illicit or abusive use;
• non-payment;
• determination by a competent authority;
• significant risk to third parties or to the Platform itself.

In serious situations, suspension may occur without prior notice.

18. Warranties and inherent limitations of results

Stakeholders Mapper uses advanced data analysis and artificial intelligence techniques, but no methodology can guarantee absolute accuracy.

Information may be incomplete, outdated, or incorrect at the original source.

Automated inferences and analyses are probabilistic and depend on the available evidence.

To the maximum extent permitted by applicable law, the Platform is provided according to the terms of the contracted service, without any guarantee that a specific result will lead to a particular commercial, reputational, institutional, or strategic decision.

19. Limitation of liability

To the maximum extent permitted by applicable law, Stakeholders Mapper shall not be liable for:

• decisions made exclusively based on the outputs;
• use of results for purposes other than those originally analyzed;
• disclosure made by the user;
• errors existing in third-party sources;
• unavailability of external sources;
• acts committed by third parties;
• damages resulting from prohibited or illicit use of the Platform;
• lost profits, loss of opportunity, indirect loss of revenue, or indirect damages arising from the use of the Platform, except where such exclusion is legally prohibited.

Where legally permitted, Stakeholders Mapper's aggregate liability arising from the service shall be limited to the total amount actually paid by the client for the service related to the claim during the 12 months preceding the event that gave rise to it.

No limitations shall apply where mandatory legislation expressly prohibits their application.

20. Indemnification for misuse

When acting in a business or professional capacity, the user agrees to indemnify and hold harmless Stakeholders Mapper and its directors, employees, and suppliers against third-party claims arising from:

• data provided by the user without a legal basis or necessary authorization;
• illegal use of outputs;
• unlawful publication or redistribution of information;
• violation of third-party rights;
• violation of these Terms.

This provision does not transfer to the user any liability arising exclusively from an unlawful act directly attributable to Stakeholders Mapper.

21. General provisions

A Party's failure to enforce any obligation shall not constitute a waiver of rights.

If any provision of these Terms is held to be invalid, the remaining provisions shall remain in full force and effect.

Stakeholders Mapper may transfer these Terms to a company within the same economic group, a successor, an acquirer, or an entity resulting from a corporate reorganization, in compliance with applicable law.

Events of force majeure, widespread infrastructure unavailability, telecommunications failures, third-party cyberattacks, or other occurrences beyond reasonable control may temporarily affect service provision without constituting a breach, provided that reasonable mitigation measures are taken.

22. Governing law and jurisdiction

These Terms are governed by the laws of the Federative Republic of Brazil.

The courts of the Judicial District of Rio de Janeiro, State of Rio de Janeiro, are elected as the venue for any disputes, unless mandatory regulations require a different jurisdiction.

Where mandatory legislation in the user's country or region grants rights that cannot be contractually waived, those rights will be respected.

If these Terms are made available in other languages, the Portuguese version shall be considered the governing version, unless otherwise provided by law or contract.

PRIVACY POLICY

23. Who is covered by this Policy

This Policy describes data processing activities regarding two main categories.

23.1. Platform users

People who:

• visit our website;
• create or use accounts;
• purchase services;
• work for clients or partners;
• contact us;
• use dashboards or reports.

23.2. Individuals identified in public sources

Individuals who may appear as stakeholders, authors, experts, executives, researchers, professionals, public officials, or other actors based on publicly available information analyzed by the Platform.

These individuals may have never created an account or had a direct relationship with us.

This section also serves as our Privacy Notice for Stakeholder Data from Public Sources.

24. Roles in data processing

The definition of controller and processor will depend on the specific activity.

Account and Platform operation data

GarciAIgnacio generally acts as the controller of the data necessary to manage accounts, billing, security, support, and the operation of the Platform itself.

Data provided by the client

When a client provides private personal data and determines the purposes and instructions for processing, GarciAIgnacio may act as a processor, depending on the context and the applicable contract.

Business clients may enter into a specific Data Processing Agreement (DPA).

Public stakeholder data

When GarciAIgnacio determines the essential means for the collection, organization, enrichment, methodology, scoring, or standardized analysis of publicly available information, it may act as the controller for those operations.

The client, in turn, is responsible for the specific purposes of the project they define, the parameters they provide, and the subsequent use of the results, and may act as an independent controller regarding these operations.

The legal nature of each Party shall be determined by their actual activities and applicable law, rather than solely by the terminology used in these Terms.

25. Data processed about users

Depending on how you use the Platform, we may process:

• name;
• email;
• company;
• job title;
• phone number when provided;
• account credentials and identifiers;
• project history;
• payment and billing data;
• support interactions;
• IP address;
• access logs;
• device, browser, and technical information;
• security logs;
• communication preferences.

26. Data processed in projects

We can process information defined or provided by the user, including:

• mapping objective;
• topic and subtopics;
• hypotheses;
• countries or territories;
• time frame;
• types of stakeholders;
• names of organizations;
• names of individuals;
• lists, documents, or instructions;
• parameters used for project generation.

27. Data from public sources

Depending on the project and available sources, we can process information such as:

• name;
• job title and professional activity;
• organization and institutional affiliations;
• professional and academic information;
• participation in organizations, events, or projects;
• publications;
• interviews;
• articles;
• public statements;
• references in news and websites;
• public professional profiles;
• public interactions or relationships;
• digital presence;
• topics associated with public or professional activities;
• relationships between people and organizations;
• indicators and inferences produced by the Platform.

The Platform may generate new information by combining or analyzing this evidence, including scores, classifications, network positioning, and contextual inferences.

28. Data sources

Data may be obtained:

• directly from the user;
• from the client responsible for a specific project;
• from publicly accessible sources;
• from public agencies or registries;
• from search engines;
• from academic and professional publications;
• from media outlets;
• from digital platforms;
• from APIs;
• from authorized service providers or suppliers;
• from other legally accessible sources.

When required by applicable law, we will adopt additional transparency measures or other safeguards regarding the indirect collection of data.

29. Purposes of processing

Data may be processed to:

• create and manage accounts;
• authenticate users;
• execute requested mappings;
• identify stakeholders;
• enrich and organize information;
• produce metrics and rankings;
• analyze connections and networks;
• generate reports and recommendations;
• provide support;
• ensure security;
• prevent fraud and misuse;
• comply with contractual obligations;
• comply with legal obligations;
• exercise or defend legal rights;
• improve the reliability, security, and performance of the Platform;
• produce aggregated or anonymized statistics;
• communicate information about services, when permitted.

29.1. Communications

We may send users service-related communications that are necessary for the operation, security, and administration of their accounts. When permitted by applicable law, we may also send information about features, updates, events, and services related to Stakeholders Mapper. Users may opt out of receiving marketing communications at any time via the unsubscribe link included in those communications.

30. Legal bases

Depending on the activity and applicable law, processing may be based on, among other valid bases:

• performance of a contract or procedures related to a contract;
• compliance with a legal or regulatory obligation;
• regular exercise of rights;
• legitimate interest;
• consent, when actually necessary;
• other bases provided for by applicable law.

Creating an account and accepting these Terms does not mean that all data processing performed by the Platform is based on consent.

Each activity must have a legal basis compatible with its nature and purpose.

31. Publicly available data and legitimate interest

When permitted by applicable law, we may rely on legitimate interest for certain processing of non-sensitive personal data obtained from public sources.

In these situations, we consider factors such as:

• specific purpose of the processing;
• necessity of the information;
• context in which it was made available;
• professional or public nature of the information;
• reasonable expectations of the data subject;
• potential impacts on the data subject;
• proportionality;
• minimization;
• transparency;
• available safeguards.

The public availability of information does not eliminate the data subject's rights.

Processing based on legitimate interest may be subject to balancing tests or equivalent assessments.

32. Profiling, scoring, and automated processing

The Platform may perform profiling or other forms of automated analysis, as defined by the applicable jurisdiction.

This may involve a contextual assessment of relevance, authority, digital presence, brokerage, articulation, centrality, or other factors related to a stakeholder's role in a given ecosystem.

These indicators are produced for strategic intelligence and human support.

Stakeholders Mapper does not intend to use its scores to independently make exclusively automated decisions that produce legal effects or similarly significant effects on the individuals analyzed.

Where applicable law grants rights related to automated decision-making or profiling, those rights will be respected.

33. Sensitive data

We do not use legitimate interest as a general basis for processing data categories for which the law requires a specific legal basis.

Stakeholders Mapper is not designed to infer sensitive attributes about individuals.

If data of this nature is found incidentally, we may limit, delete, or cease using such information.

Clients must not request the classification, scoring, or segmentation of individuals based on sensitive characteristics when such activity is prohibited or lacks an appropriate legal basis.

34. Sharing

We may share data with third parties when necessary for the operation of the Platform, including providers of:

• hosting and infrastructure;
• storage;
• artificial intelligence;
• search and information retrieval mechanisms;
• security;
• analytics;
• support;
• payments;
• communications;
• professional services.

These providers may act as operators/processors or independent controllers, depending on the nature of the service.

When acting on our behalf, we seek to require appropriate confidentiality, security, and data protection obligations.

A list of material subprocessors may be made available to clients when necessary or upon request.

We may also share data when required by law, court order, or competent authority, or when necessary to protect legitimate rights.

35. International transfers

The technological infrastructure of the Platform and its providers may involve processing in other countries.

When an international transfer of personal data is subject to the LGPD, we will adopt mechanisms recognized by applicable laws and regulations, including, when necessary, adequacy decisions, standard contractual clauses, specific clauses, or other authorized mechanisms.

When the GDPR, UK GDPR, or other international laws are applicable, the transfer mechanisms required by the respective legislation will be used.

36. Security

We adopt reasonable and risk-proportionate technical and organizational measures designed to protect data against:

• unauthorized access;
• misuse;
• loss;
• alteration;
• disclosure;
• destruction;
• security incidents.

These measures may include, as applicable, access controls, authentication, encryption, environment segregation, logs, backups, vulnerability management, and incident response procedures.

No system connected to the internet can offer an absolute guarantee of security.

In the event of a security incident involving personal data, we will take the measures required by applicable law.

37. Retention

Data is kept only for a period compatible with its respective purpose, contractual obligations, security, the exercise of rights, and legal requirements.

In general:

• account data may be retained during the contractual relationship and subsequently for the period necessary to comply with legal obligations or to defend legal claims;
• project information will be retained for as long as necessary to provide the service or in accordance with applicable commercial terms;
• logs may be retained for the period necessary for security, auditing, and fraud prevention;
• Public stakeholder data may be updated, replaced, blocked, or deleted when it is no longer relevant, when there is a legal obligation to do so, or when a valid request from the data subject is granted.

Data may be anonymized and kept in a non-identifiable form when permitted by law.

38. Data subject rights

Depending on applicable law, data subjects may request:

• confirmation of the existence of processing;
• access;
• correction;
• updating;
• information about the source and purpose of processing;
• information about data sharing;
• anonymization or blocking;
• erasure, where applicable;
• restriction of processing;
• objection to processing;
• data portability, where applicable;
• withdrawal of consent, when this is the legal basis for processing;
• information about the criteria used for automated decision-making;
• review of automated decisions when provided for by law.

Requests will be analyzed in accordance with applicable law, the identity of the requester, the rights of third parties, and legitimately protected trade or industrial secrets.

We may request information necessary to verify the identity of the requester.

39. Correction, objection, and deletion of public data

A person identified in Stakeholders Mapper results may contact us if they believe that information is:

• incorrect;
• outdated;
• excessive;
• used out of context;
• being processed in non-compliance with the law.

The request will be evaluated on a case-by-case basis.

When appropriate or legally required, we may correct, restrict, block, delete, or stop displaying certain information in our systems.

Removing information from the Stakeholders Mapper does not mean it is removed from the original public source, over which we may have no control.

40. Cookies

The website and the Platform may use cookies and similar technologies to:

• authentication;
• session maintenance;
• security;
• Platform functionality;
• preferences;
• analytics;
• other permitted purposes.

When required by applicable law, non-essential cookies will be used in accordance with the options and consents provided to the user.

41. Additional rights in other jurisdictions

Individuals located outside of Brazil may have additional rights in accordance with local legislation.

When such laws are applicable to the processing performed by Stakeholders Mapper, we will respect the corresponding mandatory rights.

No provision of these Terms is intended to limit rights that, by law, cannot be contractually waived.

42. Changes to this Policy and the Terms

These Terms may be updated due to:

• legal or regulatory changes;
• technological advancements;
• new features;
• changes in processing practices;
• security;
• service improvements.

The current version will be available on the website.

When a change is material and requires new consent under the law or due to the nature of the change, we may ask the user to re-accept the Terms before continuing to use certain features.

43. Contact and privacy requests

Questions, legal notices, or requests regarding privacy and data protection may be sent to:

Stakeholders Mapper
GarciAIgnacio Network Thinking Treinamentos e Consultoria Ltda.
Tax ID (CNPJ) 51.843.593/0001-99
Brazil

Email: info@stakeholdersmapper.com

Stakeholders Mapper may provide additional or specific privacy channels in the future.

‍