Privacy Policy

Effective Date: 1 September 2026 Last Updated: 1 September 2026 Data Controller: Custody Agents S.L. Address: Avenida Diagonal, 449, 4a planta, 08036, Barcelona, Spain Contact: privacy@custodyagents.com

Introduction

This Privacy Policy describes how Custody Agents S.L. ("Custody Agents," "we," "us," or "our") collects, uses, discloses, and protects personal information through the Sentinel Platform (sentinel.custodyagents.com) across all service tiers: Sentinel Agents (free), Sentinel Pro, Sentinel Advisor, Sentinel Principal, and Sentinel Enterprise.

Language: This Privacy Policy is provided in English (authoritative), Spanish (ES), and Brazilian Portuguese (PT-BR). In the event of any conflict between translations, the English version prevails.

Scope: This policy applies to all users and service tiers globally, with regime-specific provisions for the European Union (GDPR), United Kingdom (UK GDPR), United States (CCPA/CPRA), Argentina (Ley 25.326), and Brazil (LGPD).

1. Data Controller and Data Protection Officer

Data Controller: Custody Agents S.L. (Registro Mercantil de Barcelona, IRUS 1000463163361, Hoja B-647008) Avenida Diagonal, 449, 4a planta, 08036, Barcelona, Spain

Data Protection Officer (DPO) / Encarregado: Custody Agents S.L. has not formally appointed a Data Protection Officer (DPO) or Encarregado de Proteção de Dados. The company qualifies for the small-scale processing agent relief under GDPR Art. 37(1) and ANPD Resolução CD/ANPD nº 02/2022, which permit publication of a data-protection contact channel in place of a formal appointment. All data-subject inquiries, including the exercise of rights under GDPR, UK GDPR, CCPA/CPRA, Ley 25.326, and LGPD, should be directed to privacy@custodyagents.com.

2. Personal Information We Collect

We collect personal information directly from you, automatically through your use of the Platform, and from third-party payment processors.

2.1 Information You Provide Directly

• Account Information: Name, email address, company name (for Advisor/Principal tiers), jurisdiction selection.
• Authentication Data: Microsoft Entra ID credentials (single sign-on). We do NOT store passwords; authentication is handled by Microsoft.
• Governance Assessment Data: Entity type, assets under management (AUM) range, custody configuration responses, risk scores, governance plans. We do NOT collect or store private keys, wallet addresses, or custody credentials.
• Payment Information: Processed by our payment processor (see Section 2.3 below). We do NOT store credit card numbers or bank account details.
• Communications: Messages you send to us via support channels, feedback forms, or email.

2.2 Information Collected Automatically

• Usage Data: Pages viewed, features used, time spent, interaction patterns, session duration.
• Device Information: IP address, browser type and version, operating system, device identifiers, screen resolution.
• Cookies and Tracking Technologies: See Section 5 (Cookies) below.

2.3 Information from Third-Party Processors

Paddle (Merchant of Record for Sentinel Pro and Sentinel Advisor): When you subscribe to Sentinel Pro or Sentinel Advisor, Paddle acts as the Merchant of Record and processes your payment. Paddle is an independent data controller for payment data, and Custody Agents S.L. is the data controller for Sentinel account and assessment data. Paddle collects payment information (billing address, VAT number if applicable, payment method) and shares transaction completion status and subscription metadata with us. Paddle's Privacy Policy: https://www.paddle.com/legal/privacy

Sentinel Principal and Sentinel Enterprise are not sold through public self-service checkout. Billing for these tiers is governed by the individual engagement letter or order form agreed with the client.

Azure OpenAI Service: We use Microsoft Azure OpenAI Service to power AI-generated governance plans and recommendations. Your governance assessment inputs are sent to Azure OpenAI for processing. Microsoft does NOT use your data to train its models. Azure OpenAI data, privacy, and security: https://learn.microsoft.com/en-us/legal/cognitive-services/openai/data-privacy

3. How We Use Personal Information

We use personal information for the following purposes:

• Service Delivery: To provide, operate, and maintain the Sentinel Platform; generate governance assessments and AI-powered plans; manage your account and subscriptions.
• Authentication: To verify your identity via Microsoft Entra ID single sign-on.
• Payment Processing: To process subscription payments via Paddle for Sentinel Pro and Sentinel Advisor subscriptions.
• Communications: To send service-related notifications, subscription confirmations, security alerts, and (for Pro/Advisor/Principal) intelligence briefings and happenings feed.
• Product Improvement: To analyze usage patterns, improve features, and develop new services.
• Compliance and Legal Obligations: To comply with applicable laws, respond to lawful requests, enforce our Terms of Service, and protect our legal rights.
• Security: To detect, prevent, and investigate fraud, abuse, or security incidents.

4. Legal Basis for Processing (EU/UK GDPR)

Where Custody Agents S.L. processes personal data of data subjects in the European Economic Area or the United Kingdom, processing is carried out on the following legal bases set out in GDPR Art. 6(1) and UK GDPR Art. 6(1):

(a) Performance of a contract, Art. 6(1)(b). Processing necessary for the performance of the user's subscription contract with Custody Agents S.L., or to take steps at the user's request prior to entering such a contract. This basis covers: account creation and authentication, governance assessment delivery, custody-plan generation by the Sentinel agent swarm, subscription billing, customer support, and contract administration.

(b) Legitimate interests, Art. 6(1)(f). Processing necessary for the legitimate interests pursued by Custody Agents S.L. or by a third party, except where overridden by the interests or fundamental rights and freedoms of the data subject. Specifically: platform security and fraud prevention, system integrity and abuse-detection monitoring, audit logging required by our internal security controls, aggregated and anonymised product-usage analytics, and the defence of legal claims. A Legitimate Interests Assessment (LIA) has been documented for each of these processing activities and is available to data subjects on request via privacy@custodyagents.com.

(c) Consent, Art. 6(1)(a). Processing for which consent is the most appropriate basis, namely: marketing communications, optional analytics cookies (per the cookie banner described in §5), and any optional features the user expressly opts into. Consent is freely given, specific, informed, and unambiguous, and may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawal mechanisms are available in the user's account settings and via privacy@custodyagents.com.

(d) Legal obligation, Art. 6(1)(c). Processing necessary for compliance with a legal obligation to which Custody Agents S.L. is subject. This basis covers: retention of billing and tax records under Spanish accounting and tax law, response to lawful regulatory and law-enforcement requests, security incident notification obligations under GDPR Art. 33 to 34 and corresponding national law, and record-keeping required by GDPR Art. 30 and equivalent provisions in the other regimes.

(e) Vital interests, Art. 6(1)(d). Not relied upon. Custody Agents S.L.'s processing activities do not require processing necessary to protect the vital interests of the data subject or another natural person.

(f) Public task / official authority, Art. 6(1)(e). Not relied upon. Custody Agents S.L. is a private commercial entity and does not perform tasks carried out in the public interest or in the exercise of official authority.

You have the right to withdraw consent at any time (see Section 8).

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate the Platform, analyze usage, and improve your experience.

5.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function and cannot be disabled:

• Authentication cookies: Session tokens from Microsoft Entra ID.
• Security cookies: CSRF tokens and session identifiers.

5.2 Analytics and Performance Cookies

Analytics cookies are treated as non-essential and are set only with your consent. We use Microsoft Azure Application Insights (Microsoft Ireland Operations Limited) to understand how users interact with the Platform. These cookies collect usage data, device information, and interaction patterns.

Your Choice: You can opt out of analytics cookies via the cookie consent banner (see Section 5.3).

5.3 Cookie Consent Banner

EU/UK/BR Users: When you first visit the Platform from the EU, UK, or Brazil, you will see a cookie consent banner. You can accept or reject non-essential cookies. Your choice is stored for 12 months.

US Users (California): California residents are notified of cookie use via the banner but are not required to consent under CCPA/CPRA.

AR Users: Ley 25.326 does not mandate cookie consent, but you may adjust your browser settings to block cookies.

To manage your cookie preferences after initial consent, visit https://sentinel.custodyagents.com/privacy#cookie-settings

6. Data Sharing and Disclosure

We do NOT sell personal information. We share personal information only in the following circumstances:

6.1 Service Providers

• Paddle: Payment processing and Merchant of Record for Sentinel Pro and Sentinel Advisor subscriptions (see Section 2.3).
• Microsoft Azure: Cloud infrastructure (data hosting, compute, AI inference via Azure OpenAI Service).
• Authentication Provider: Microsoft Entra ID for single sign-on.
• Analytics Provider: Microsoft Azure Application Insights (Microsoft Ireland Operations Limited). No other third-party analytics beyond Azure.

All service providers are contractually required to protect personal information and use it only for the purposes we specify.

6.2 Legal Requirements

We may disclose personal information if required by law, legal process, or government request, or to protect the rights, property, or safety of Custody Agents, our users, or others.

6.3 Business Transfers

If Custody Agents S.L. undergoes a merger, acquisition, or sale of assets, personal information may be transferred to the acquiring entity. You will be notified of any such change.

7. International Data Transfers

Data Location: Personal information is processed and stored on Microsoft Azure servers located in the West Europe region (Netherlands), with non-production Cosmos DB workloads in North Europe (Ireland) due to capacity constraints. Both regions are within the European Economic Area. We do not currently operate dedicated US, Argentina, or Brazil regions; transfers to and from these jurisdictions are governed by Sections 7.2 to 7.4 below.

7.1 EU/UK Transfers

Personal data transferred outside the European Economic Area (including the United Kingdom) to Microsoft Azure infrastructure is governed by the Standard Contractual Clauses (SCCs) set out in the Microsoft Products and Services Data Protection Addendum (DPA), incorporating the 2021 EC SCCs adopted by the European Commission under Implementing Decision (EU) 2021/914. For transfers from the United Kingdom, the UK International Data Transfer Addendum (IDTA) issued by the Information Commissioner's Office is incorporated by reference into the same DPA. Custody Agents S.L. pins its primary processing region to Microsoft Azure West Europe (Netherlands), with non-production workloads in Microsoft Azure North Europe (Ireland), to minimise cross-border transfer surface. Where personal data of Brazilian residents is transferred outside Brazil, transfers are additionally governed by the SCCs approved under ANPD Resolução CD/ANPD nº 19/2024.

7.2 US (CCPA/CPRA)

California residents: We do not "sell" or "share" personal information as defined by CCPA/CPRA. Service providers listed in Section 6.1 are bound by contractual obligations to protect your information.

7.3 Argentina (Ley 25.326)

Transfer of personal data of Argentine residents to the European Economic Area, and specifically to Microsoft Azure West Europe (Netherlands), Custody Agents S.L.'s primary processing region, is permitted under Art. 12 of Ley 25.326, which authorises transfers to jurisdictions providing an adequate level of data protection. The European Union has been recognised as an adequate-destination jurisdiction by the AAIP under Disposición 60/2016. No additional transfer instrument (for example, contractual safeguards under Art. 12.2) is therefore required for the EEA leg of the transfer chain. Onward transfers from the EEA to non-EEA Microsoft regions, where applicable, remain governed by the SCCs incorporated in the Microsoft DPA (see §7.1).

7.4 Brazil (LGPD)

For users in Brazil, we process personal information on Azure servers in the West Europe region (Netherlands). Brazil does not currently maintain an adequacy decision for the EU; international transfers therefore rely on LGPD Art. 33 safeguards, specifically ANPD-approved Standard Contractual Clauses (Resolução CD/ANPD nº 19/2024) executed between Custody Agents S.L. and Microsoft Ireland Operations Limited as part of the Microsoft Products and Services Data Protection Addendum.

8. Your Data Protection Rights

Your rights vary by jurisdiction. This section explains rights under each regime.

8.1 EU/UK GDPR Rights

You have the following rights under GDPR and UK GDPR:

• Right to Access (Art. 15): Request a copy of your personal information.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete information.
• Right to Erasure (Art. 17): Request deletion of your personal information ("right to be forgotten").
• Right to Restriction of Processing (Art. 18): Limit how we use your information.
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests.
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent for cookie tracking or other consent-based processing.
• Right to Lodge a Complaint: File a complaint with your national data protection authority (see Section 11).

How to Exercise Your Rights: Email privacy@custodyagents.com.

8.2 US (California CCPA/CPRA) Rights

California residents have the following rights under CCPA/CPRA:

• Right to Know: Request disclosure of categories and specific pieces of personal information collected.
• Right to Delete: Request deletion of your personal information.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do NOT sell or share personal information, so this right is not applicable.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes requiring opt-out.
• Right to Non-Discrimination: You will not be discriminated against for exercising your rights.

How to Exercise Your Rights: Email privacy@custodyagents.com.

Verification: We will verify your identity before processing requests. You may be required to confirm your email address or provide account information.

8.3 Argentina (Ley 25.326) Rights

Under Ley 25.326, you have the right to:

• Access: Request information about your personal data held by us.
• Rectification, Update, or Deletion: Correct, update, or delete your personal information.
• Confidentiality: Your personal information is treated as confidential.

How to Exercise Your Rights: Email privacy@custodyagents.com.

National Data Protection Authority: Agencia de Acceso a la Información Pública (AAIP): https://www.argentina.gob.ar/aaip

8.4 Brazil (LGPD) Rights

Under LGPD, you have the following rights (Art. 18):

• Confirmation and Access: Confirm whether we process your personal data and request access.
• Correction: Correct incomplete, inaccurate, or outdated data.
• Anonymization, Blocking, or Deletion: Request anonymization, blocking, or deletion of unnecessary or excessive data.
• Portability: Receive your data in a structured, commonly used format.
• Deletion of Consent-Based Data: Request deletion of data processed based on consent.
• Information on Public and Private Sharing: Learn which entities we share your data with.
• Refusal and Consequences: Refuse to provide consent and understand the consequences.
• Revocation of Consent: Withdraw consent at any time.
• Review of Automated Decision: Request review of decisions taken solely on the basis of automated processing of personal data that affect your interests (Art. 18, X and Art. 20). Note: Sentinel uses AI agents to generate policy recommendations, but all final decisions require approval from the responsible human consultant (Human-in-the-Loop architecture).

How to Exercise Your Rights: Email privacy@custodyagents.com.

National Data Protection Authority: Autoridade Nacional de Proteção de Dados (ANPD): https://www.gov.br/anpd/pt-br

9. Data Retention

We retain personal information for as long as necessary to provide services, comply with legal obligations, resolve disputes, and enforce agreements.

We apply the following retention periods by data category:

Deletion Requests: Upon receipt of a verified deletion request, Custody Agents S.L. will delete the user's account and associated personal data within 30 days. Encrypted backups are retained for an additional 90 days before being overwritten in the normal backup rotation; during that window, personal data is recoverable only in the event of a confirmed disaster-recovery restoration and is not used for any other purpose. Deletions subject to retention exceptions (billing records, security audit events tied to confirmed fraud, records of the deletion request itself) are handled per our internal record of processing activities retention exception table.

10. Security

We implement technical and organizational measures to protect personal information against unauthorized access, loss, or misuse:

• Encryption: Data in transit is encrypted via TLS 1.2 or higher, per our Azure infrastructure baseline. Data at rest is encrypted using Azure-managed keys.
• Access Controls: Role-based access control (RBAC) limits employee access to personal information.
• Authentication: Authentication is provided via Microsoft Entra External ID. Multi-factor authentication (MFA) is available for all accounts. Custody Agents S.L. strongly recommends that all users enable MFA.
• Monitoring: Security logs and anomaly detection via Azure Monitor.

Despite these measures, no system is completely secure. If you suspect unauthorized access to your account, contact us immediately at compliance@custodyagents.com.

11. Contact and Supervisory Authorities

11.1 Contact Us

For questions about this Privacy Policy or to exercise your data protection rights, contact:

Custody Agents S.L. Email: privacy@custodyagents.com Address: Avenida Diagonal, 449, 4a planta, 08036, Barcelona, Spain

11.2 EU/UK Supervisory Authorities

If you are in the EU or UK and believe we have not addressed your data protection concerns, you may lodge a complaint with your national supervisory authority:

• Spain (Custody Agents S.L. location): Agencia Española de Protección de Datos (AEPD): https://www.aepd.es/
• United Kingdom: Information Commissioner's Office (ICO): https://ico.org.uk/
• Other EU/EEA Member States: European Data Protection Board members directory: https://edpb.europa.eu/about-edpb/about-edpb/members_en

11.3 US (California)

California residents may contact the California Attorney General's Office regarding CCPA/CPRA complaints.

11.4 Argentina

Agencia de Acceso a la Información Pública (AAIP): https://www.argentina.gob.ar/aaip

11.5 Brazil

Autoridade Nacional de Proteção de Dados (ANPD): https://www.gov.br/anpd/pt-br

12. Children's Privacy

The Sentinel Platform is not intended for individuals under the age of 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us immediately and we will delete it.

Brazil, LGPD Art. 14. As required by Lei Geral de Proteção de Dados Pessoais (Lei n.º 13.709/2018), Art. 14, the Sentinel Platform does not process the personal data of children or adolescents (anyone under 18). At account creation we require an explicit confirmation that the user is 18 or older; sign-in cannot proceed without this confirmation. We do not maintain product surfaces designed to attract minors and we do not condition access to the Platform on the disclosure of any data beyond what is strictly necessary for the consultancy services we provide.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by:

• Posting the updated policy on this page with a new "Last Updated" date.
• Sending an email notification to your registered email address (for registered users).
• Displaying a banner notification on the Platform for at least 30 days before changes take effect.

Your continued use of the Platform after the effective date of changes constitutes acceptance of the updated policy.

14. Regime-Specific Provisions

14.1 European Union (GDPR)

This Privacy Policy complies with Regulation (EU) 2016/679 (General Data Protection Regulation). See Sections 4, 7.1, 8.1, and 11.2.

14.2 United Kingdom (UK GDPR)

This Privacy Policy complies with the UK General Data Protection Regulation and the Data Protection Act 2018. See Sections 4, 7.1, 8.1, and 11.2.

14.3 United States (California CCPA/CPRA)

This Privacy Policy complies with the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). See Sections 8.2 and 11.3.

Notice at Collection: At or before the point of collection, we inform you of the categories of personal information collected and the purposes of use (see Section 2).

Do Not Sell My Personal Information: We do NOT sell personal information. We do NOT share personal information for cross-context behavioral advertising.

14.4 Argentina (Ley 25.326)

This Privacy Policy is drafted to be consistent with Ley 25.326 (Ley de Protección de los Datos Personales) with respect to data subjects resident in Argentina. See Sections 7.3, 8.3, and 11.4. Argentine data subjects may exercise their rights of access, rectification, suppression, and confidentiality (Arts. 14 to 17) by contacting privacy@custodyagents.com, and may lodge a complaint with the Agencia de Acceso a la Información Pública (AAIP) at https://www.argentina.gob.ar/aaip

14.5 Brazil (Lei Geral de Proteção de Dados, LGPD)

This Privacy Policy complies with Lei nº 13.709/2018 (LGPD). See Sections 7.4, 8.4, and 11.5.

Em conformidade com o art. 41 da Lei nº 13.709/2018 (LGPD) e com a Resolução CD/ANPD nº 02/2022, que regulamenta a aplicação da LGPD para agentes de tratamento de pequeno porte, a Custody Agents S.L. não nomeou formalmente um Encarregado pelo Tratamento de Dados Pessoais. O canal privacy@custodyagents.com é o meio de comunicação publicado com os titulares de dados pessoais, conforme exigido pelo art. 11 da Resolução CD/ANPD nº 02/2022, e atende à função de canal de contato prevista no art. 41 da LGPD. Os titulares de dados residentes no Brasil podem exercer os direitos previstos no art. 18 da LGPD por meio desse canal e podem apresentar reclamação à Autoridade Nacional de Proteção de Dados (ANPD) em https://www.gov.br/anpd/pt-br

Regulatory disclaimer (ADR-006 W2-BR-01): Sentinel is a governance-tooling and assessment platform. Custody Agents S.L. does not provide digital-asset custody, brokerage, exchange, or value-transmission services and is not regulated by the Banco Central do Brasil under Lei 14.478/2022.

END OF PRIVACY POLICY