Privacy policy

Last updated: 5 November 2026.

Who is responsible

A-REX (company in formation) runs this site, platform.a-rex.org, and A-REX Platform, the traceability service companies use through the console, the API and the assistant. Until A-REX is constituted, its founders act for it. For any question or request about your personal data, write to [email protected].

This policy applies Brazil's General Data Protection Law (LGPD, Law 13.709/2018), the European General Data Protection Regulation (GDPR) for people in the European Economic Area, and the consumer privacy laws of the US states that have them. It applies to everyone, wherever they are.

The open A-REX standard and its site, standard.a-rex.org, are kept by the A-REX Foundation, which has its own privacy policy.

Two roles

A-REX decides (controller). For this site, the contact form, your user account, the security of the service, support requests and billing, A-REX decides why and how your data is processed.
A-REX acts for a company (processor, or operador under the LGPD). The records a company keeps in A-REX Platform (its lots, deliveries, certificates, and the people and companies in its directory, such as suppliers, farmers and buyers) belong to that company. The company decides what it records and why; A-REX processes those records only on its instructions. If a company holds your data, write to that company first; we help it answer.

On this site

The site sets no cookies and runs no analytics or advertising trackers. Your browser keeps the colour theme you chose in its local storage; it never leaves your device.

Cloudflare hosts the site. To deliver and protect it, Cloudflare processes technical data such as your IP address, your browser and the pages you request.

When you write to us through the contact form, we keep your name, work e-mail, company, what it does, country, products, message, the plan you asked about and the language of the page. To limit abuse we keep a one-day fingerprint of your connection, never the address itself. Cloudflare Turnstile checks that a person sent the form; it processes technical data about your browser and connection, and we receive only the result.

In A-REX Platform

Your account. Your name, e-mail, language, the companies and roles you were given, your sign-in methods (passkeys and the second factor, never a password in clear), sessions, and a record of what you did in the console: every proposal, approval, download and change keeps who made it. Sign-in uses cookies that are strictly necessary for the service.

A company's records. What the company records: lots, quantities, deliveries, certificates, documents, field events and the people and companies in its directory. Names, tax numbers, contacts, addresses and plot coordinates are stored encrypted, with keys kept in a key management service.

The assistant, Humboldt and agents. When you ask the assistant a question, or an agent works for your company, the question and the records needed to answer it are sent to Anthropic, which provides the AI models. Tax numbers and similar identifiers are replaced with placeholders before they reach the model. Anthropic processes this data as our subprocessor and does not use it to train its models. The assistant only prepares proposals; people approve every change.

Support. What you write in a support request, and what you choose to attach. Support never sees an assistant conversation unless you include it in a problem report.

Billing. The organization's name, billing contact and plan. Stripe processes payments; A-REX never sees card numbers. During the alpha, billing runs in Stripe's test mode and nothing is charged.

Maps and weather. To show the weather of a field event, its location and date, without any name, are sent to OpenWeather and to Copernicus (ERA5). When you open a map with satellite imagery from Esri, your browser requests the images from Esri, which sees your IP address.

Messages. If a company connects its own e-mail or WhatsApp channel, messages sent to that channel are processed for the company, which is responsible for them. WhatsApp messages pass through Meta.

Public ledgers: what stays forever

Each company's records are also written to public ledgers so that anyone can check them without trusting A-REX: the company's own ledger on an EVM-compatible network, and daily fingerprints published on Hedera and on Bitcoin (through OpenTimestamps). During the alpha, only test networks are used.

What is written on a public ledger cannot be changed or deleted by anyone, A-REX included. That is why the ledger holds no names, tax numbers, contacts, addresses, coordinates or documents: only lot records without personal data, fingerprints, and the public addresses of the keys that approve. Those addresses carry no name, but the company and A-REX can link a key to the member who holds it. If you ask us to erase your data, we delete that link and everything else we hold; the address itself stays on the ledger, without your name.

Why we use it, and on what basis

Purpose	Legal basis
Run the service a company signed up for: accounts, records, approvals, reports	Performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b))
Process a company's records on its instructions	The company's own basis, as its processor (LGPD art. 39; GDPR art. 28)
Keep the service secure, record who did what, prevent abuse	Legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f))
Answer the contact form and support requests	Steps you asked for before a contract, or the contract (LGPD art. 7, V; GDPR art. 6(1)(b))
Billing, invoices and tax records	Legal obligation and the contract (LGPD art. 7, II and V; GDPR art. 6(1)(b) and (c))
Comply with a court order or an authority's lawful request	Legal obligation (LGPD art. 7, II; GDPR art. 6(1)(c))

We do not sell personal data, share it for cross-context behavioural advertising or use it for advertising. We do not make decisions with legal or similar effects about you by automated means alone: people approve every change.

Who helps us (subprocessors)

Cloudflare: hosting of this site, the contact form's database, Turnstile.
Anthropic: the AI models behind the assistant, Humboldt and agents.
Stripe: billing and payments.
Resend: delivery of e-mails.
Esri: satellite imagery for maps.
OpenWeather and Copernicus (ERA5): weather for field events.
Meta: WhatsApp messages, only for companies that connect that channel.
Hedera, Bitcoin (OpenTimestamps) and EVM-compatible networks: the public ledgers described above.

Before the production service starts, this list will also name where the console, its database and its keys are hosted. We update this list before adding a subprocessor.

Transfers outside your country

Some of these providers process data outside Brazil and the European Economic Area, including in the United States. Where the law requires it, we rely on standard contractual clauses (those of the European Commission and those approved by Brazil's ANPD in Resolution CD/ANPD 19/2024) or on another transfer mechanism the law allows.

How long we keep it

Contact form: twelve months after our last message, unless your company becomes a customer.
Account: while the account exists. When you leave a company, your access ends; your name stays in the history of the approvals you made, because that history is the company's evidence.
A company's records: for as long as the company keeps them and its contract runs, then deleted after the company has had the chance to export them, except what the law requires us to keep.
Support requests: three years after they are closed, unless a legal hold applies.
Billing records: as long as tax law requires.
Public ledgers: permanently, as explained above, without personal data.

Your rights

You can ask us to confirm whether we process your data, to give you access to it or a copy, to correct it, to delete it, to anonymize it, to restrict or object to its use, to move it to another provider, and to know with whom we shared it. You can withdraw your consent at any time where we rely on it. Write to [email protected]; we answer within 15 days and may ask you to confirm who you are.

If your data is in a company's records, we pass your request to that company and help it answer.

In the United States, under the consumer privacy laws of states such as California, Virginia, Colorado, Connecticut and Texas, you can ask to know, access, correct and delete your personal information, and to opt out of its sale, sharing or use for targeted advertising (we do none of these). You may use an authorized agent, and we will verify the request. We never treat you differently for using these rights. If we decline a request, you can appeal by replying to our answer.

You can also complain to a data protection authority: in Brazil, the ANPD (Autoridade Nacional de Proteção de Dados); in the European Economic Area, the authority of your country; in the United States, your state's attorney general or, in California, the California Privacy Protection Agency.