Privacy Policy

Version prepared on September 10, 2026. Describes the functions observed in the local copy and the points that need to be confirmed for the public web.

Responsible party and contact

Name or company name, address and email to exercise your rights: pending completion by the head of Cumbre Research.

Data processed and what it is used for

• Account: identifier, username, email, and profile data to manage account registration, access, and recovery.
• Subscription: plan, status, dates and associated identifiers to enable the contracted content and reconcile its payment.
• Personal follow-up: Saved reports, notes, reading status, and scenarios to recover your work when you return to the site.
• Inquiries: Data and content that you send through the contact channel to respond to your request. Email sending is disabled on the local copy.
• Technical information: The platform uses session mechanisms and may record technical activity necessary for its operation and security. The scope and retention of these logs on the public hosting server must be confirmed.

The data required to create an account and manage the service is separate from optional data. Without login credentials, an account cannot be activated. Promotional communications must include a separate opt-out option and method; creating an account does not automatically subscribe you to advertising.

Tracking, alerts, and metrics

The account remembers which review you marked as viewed and the notification frequency you chose for your saved reports. The initial frequency is «Do not receive emails.» You can change this in My Account. Sending these notifications is not yet activated and requires review by the provider and the unsubscribe mechanism before it can be enabled.

The sales dashboard stores daily counts of page views, reports opened, registrations completed, and clicks on sign-ups. These counts do not include user IDs, emails, IP addresses, sessions, referring URLs, or page parameters. Analytics cookies are not used, and these counts are kept separate between the local copy and the live website. Deletion of counts older than 90 days depends on the daily WordPress task execution; this should be verified in production. Technical server logs and logs from other plugins are reviewed separately.

Who can access

Notes and scenarios are associated with their owner. The responsible party and those authorized to manage the service may need access to data for support and operation. Credentials and data of other subscribers should not be shared.

The public website uses Hostinger hosting and plans to process payments through Mercado Pago. The production setup, email services, processing countries, sub-processors, and terms of international data transfers are... pending verification. Before publishing this policy, the list of recipients and their purposes must be completed. The site's code alone does not demonstrate what data each provider retains.

Preservation and disposal

Data should only be kept for as long as necessary for its purpose and for applicable obligations. Earring: Set and enforce retention periods for inactive accounts, subscriptions, inquiries, security logs, and backups. Canceling billing does not automatically delete the account. Automatic deletion of all backups is also not implemented.

Your rights

You can request access, rectification, updating, and, where applicable, deletion of your data. Access requests must be answered within ten calendar days; rectification, updating, or deletion requests, within five business days. Free access can be exercised every six months, unless there is a legitimate interest that justifies doing so sooner.

If the response is insufficient or does not arrive, you can turn to the Public Information Access Agency. Identity verifications should be proportionate; do not send passwords or payment information for a consultation.

Future tools and artificial intelligence

The document assistant, portfolio consolidation, and broker connections are not part of the functions described here. Before activating them, details must be provided regarding the data they process, the participating providers, and the applicable permissions. This policy does not authorize the advance transmission of private notes or portfolios to an artificial intelligence provider.

Regulatory framework and changes

Reference: Law 25.326 on the Protection of Personal Data and guidance from the enforcement authority. Consult: 10/09/2026. Before launch, the legal basis for each processing activity and the corresponding registration obligations must be verified. Revisions to this policy must state their date.

Optional browsing statistics

If you accept the optional statistics, Cumbre uses its own session cookie, cr_audience_session, to track page views, tool tests, and the creation of a Free account during that visit. The session ends after 30 minutes of inactivity and lasts a maximum of 24 hours. Your choice is remembered in this browser for 180 days.

A random session reference, dates, page IDs, actions, and approximate country (if provided by the hosting provider) are retained. This log does not store IP addresses, emails, names, note content, or values entered into simulators. It is not shared with any other provider. Logs are expected to be retained for 90 days, depending on scheduled site cleanup.

You can decline or change your choice from «Cookie Preferences» in the footer. Declining prevents further actions from being linked using this cookie. Previous aggregated request counters still do not identify visitors. Preferences do not affect access to features.