Privacy Policy

Canastra Ventures ("Canastra", "we") is an early-stage venture capital firm. We are the controller of the personal data collected through apply.canastra.ventures (the "Application"), the form used to apply to the AI Residency and for investment.

For anything related to your data, write to privacidade@canastra.ventures.

• Account data. If you sign in with Google, we receive your name, email address and profile picture from your Google account. If you use email and password, we receive your name, email and password, which our authentication provider stores only in hashed form.
• Application data. What you type into the form: your name, email, phone, LinkedIn, city and country; information about your company, such as name, website, stage, traction, financial figures and fundraising; information about your co-founders; and your answers to open questions.
• Files. Pitch deck, financial statements, cap table and video, when you upload them.
• Usage data. Progress events inside the form (for example, when a step is started or completed), linked to your account, and aggregated page analytics from Vercel Web Analytics, which does not use cookies.
• Cookies. Only the ones the Application needs to work: your login session, your language choice and the track you picked. We do not use advertising or cross-site tracking cookies.

• To evaluate your application and decide on the AI Residency or on an investment.
• To contact you about your application.
• To save your progress so you can continue later, on any device.
• To read your pitch deck, when you upload one, and suggest answers to some questions. Suggestions are only shown to you; nothing is saved unless you accept it.
• To improve the form, using aggregated metrics such as where applicants drop off.
• To keep aggregated, non-identifying statistics about the startups that apply to us.

We do not sell your data, we do not use it for advertising, and we do not use it to train AI models.

When you choose "Continue with Google", the Application requests only your basic profile: name, email address and profile picture. We use it to create your account, identify you when you come back and pre-fill your name and email in the form.

We do not access your Gmail, Drive, Calendar, contacts or any other Google data. Google user data is not shared with third parties other than the service providers listed below, is not used for advertising and is not sold. Our use of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

Under Brazil's General Data Protection Law (LGPD, Law 13,709/2018), we process your data based on: your consent, given when you submit the application (art. 7, I); steps taken at your request before a possible contract, such as an investment or a place in the Residency (art. 7, V); and our legitimate interest in keeping the Application secure and measuring how it performs (art. 7, IX).

Your application is read by the Canastra team. To run the Application, we rely on service providers that process data on our behalf and only under our instructions:

• Supabase: authentication, database and file storage.
• Vercel: hosting and aggregated analytics.
• Google: sign-in, when you choose it.
• Anthropic: reading your pitch deck to generate answer suggestions, when you upload a deck. Under its commercial terms, this data is not used to train models.
• Notion: the internal workspace where our team reviews applications.

We will not share your application with co-investors or partners without asking you first. We may disclose data when required by law or by a competent authority.

Some of these providers store or process data outside Brazil, mainly in the United States. These transfers follow article 33 of the LGPD and rely on the contractual safeguards each provider offers.

• Unsubmitted drafts are kept until you submit them or ask us to delete them.
• Financial statements and cap tables are deleted 12 months after upload.
• Submitted applications are kept for 24 months. After that, the record is anonymized: we keep only aggregate fields (such as stage, business model, traction figures, thesis and how you heard about us) that no longer identify you.
• Copies in our internal review workspace are deleted when they are no longer needed for the evaluation, or when you ask.

If you join the Residency or we invest in your company, the data needed for that relationship is then governed by the agreements we sign with you.

Data travels encrypted. Files are stored in a private bucket and moved only through temporary signed links. Database access rules ensure that each account can only see its own application, and access to confidential documents is logged. No system is perfectly secure, but we limit access to the people who need it to evaluate your application.

Under the LGPD, you can ask us to:

• confirm whether we process your data and give you access to it;
• correct incomplete, inaccurate or outdated data;
• anonymize, block or delete unnecessary or excessive data, or data processed based on consent;
• transfer your data to another provider;
• tell you who we have shared your data with;
• withdraw your consent, without affecting processing done before it.

Send your request to privacidade@canastra.ventures from the email address linked to your account. We reply within 15 days. You can also file a complaint with Brazil's National Data Protection Authority (ANPD).

When you add information about co-founders or other team members, you confirm that they know about it and agree that you share it with us for the purpose of the application.

We may update this policy. The date at the top always shows the latest version. If a change materially affects how we use your data, we will let applicants know by email.