Version effective as of September 23, 2026

TESS TECNOLOGIA LTDA. (“Tess,” “we,” “us,” or “our”) uses cookies, pixels, tags, SDKs, local storage, logs, and similar technologies (together, “Trackers”) on the Tess AI platform, its websites, applications, and related services (together, the “Services”).

This Cookie Policy explains what these technologies are, how Tess uses them, which categories of information may be involved, and the choices available to you, including the “Do Not Sell or Share My Personal Information” option under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”). This Policy should be read together with the Privacy Policy, the Terms of Use, the Privacy Notice, the Trust Center, and, where applicable, the privacy notices and terms of third-party providers.

The Tracker inventory described in this Policy consolidates the validation published on June 1, 2026 and the marketing, advertising, and remarketing partners listed below. Actual deployment may vary by page, campaign, location, device, feature flags, and the choices you make in the preference center. The live list of infrastructure processors and subprocessors is also available in the Trust Center.

How to read this Policy: Section 3 describes the inventory; Section 5 describes what may constitute a sale or sharing; Section 7 describes how to manage preferences, including Do Not Sell or Share and GPC.

1. WHAT ARE COOKIES AND SIMILAR TECHNOLOGIES?

Cookies are small text files stored in your browser or device when you visit a website or use an online service. Other technologies, such as pixels, tags, SDKs, local storage, and device identifiers, may perform similar functions. Depending on the technology and applicable configuration, they may recognize a browser or device, remember preferences, help protect the Services, measure usage, or support advertising and remarketing.

In this Policy, all of these technologies are referred to as “Trackers.”

2. HOW TESS USES TRACKERS

Tess may use Trackers to:

• provide, protect, maintain, and operate the Services;
• authenticate users, maintain sessions, remember essential settings, and prevent fraud, abuse, and security incidents;
• understand how visitors and users interact with our websites and Services, diagnose errors, and measure performance;
• where permitted, measure advertising campaigns, attribute conversions, create or update advertising audiences, and carry out remarketing; and
• comply with applicable legal obligations and honor privacy choices.

Tess does not use prompts, responses, files, or any content you submit or generate on the Platform (“Assets”) to train or improve its own artificial intelligence models or third-party models.

3. TRACKER CATEGORIES

3.1 Strictly Necessary Trackers

These Trackers are necessary to provide and protect the Services. They may be used to maintain sessions, authenticate access, record essential privacy choices, balance traffic, prevent fraud, protect against malicious activity, and preserve the integrity of the Platform.

Because they are essential to the operation or security of the Services, these Trackers generally cannot be disabled through the preference center. You may still block them in your browser, but doing so may prevent parts of the Services from working properly.

Tess (first party)

Tess sets first-party Trackers to maintain sessions, protect against CSRF attacks, and remember interface preferences.

• Information that may be processed: session identifiers and interface preferences
• Place of processing: Brazil / infrastructure regions used by Tess

Cloudflare (Cloudflare Inc.)

Cloudflare distributes traffic and protects the Services against abuse. Certain Cloudflare cookies are strictly necessary for security and routing.

• Information that may be processed: IP address, device/browser signals, and security tokens
• Place of processing: United States and Cloudflare’s global edge locations
• Cloudflare Privacy Policy

Google reCAPTCHA (Google LLC)

Used on sign-up, login, and certain public forms to prevent bots and abuse.

• Information that may be processed: interaction signals, IP address, and browser data
• Place of processing: United States
• Google Privacy Policy and Terms

3.2 Functional Trackers

These Trackers remember choices and settings that improve your experience, such as language, display preferences, support, onboarding, or other non-essential settings. Depending on applicable law, these Trackers may be used on the basis of your consent or another valid legal basis.

Gleap (Gleap GmbH)

Active on platform and authentication pages, not on the public marketing homepage.

• Information that may be processed: user ID, email, name, plan, workspace metadata, and support interaction data
• Place of processing: European Union / vendor infrastructure
• Duration: according to the session and the provider’s configuration
• Gleap Privacy Policy

Typeform (Typeform S.L.)

Used when you open forms hosted by Tess (for example, phone verification or cancellation feedback).

• Information that may be processed: form responses, email, name, phone, company, and Typeform Trackers
• Place of processing: Spain / European Union
• Duration: according to the session and the provider’s configuration
• Active only in specific flows (embedded iframe or external link), not across the entire site
• Typeform Privacy Policy

Cello (referral program)

Affiliate and referral widget when the affiliate hub feature is enabled.

• Information that may be processed: referral identifiers, usage signals, and Trackers
• Place of processing: United States / European Union (vendor infrastructure)
• Duration: according to the session and the provider’s configuration
• Active for authenticated users when the feature flag is enabled
• Cello Privacy Policy

3.3 Analytics and Performance Trackers

These Trackers help Tess understand how visitors and users interact with the Services, measure performance, identify technical issues, and improve features that do not involve model training. Information may include pseudonymized online identifiers, IP address, browser and device information, pages viewed, timestamps, referral information, and interaction events.

Tess may use Google Analytics 4 (“GA4”) and Google Tag Manager (“GTM”) for analytics and tag management. GTM is a technical tag-management tool; the technologies deployed through it may include analytics, security, functional, or marketing technologies, depending on the choices made in the preference center and applicable law.

Google Analytics 4 (Google LLC)

Loaded via gtag.js when a measurement ID is configured.

• Information that may be processed: usage data, device/browser data, and pseudonymous identifiers
• Place of processing: United States
• Google Privacy Policy
• Google Analytics Opt-out Browser Add-on

Google Tag Manager (Google LLC)

Used to manage analytics and digital marketing tags configured by Tess. These tags may set third-party cookies described in this Policy.

• Information that may be processed: depends on the tags configured in the container and on your preferences
• Place of processing: United States
• Google Privacy Policy

Sentry (Functional Software Inc.)

Error, performance, and diagnostic monitoring.

• Information that may be processed: pseudonymous user ID, email (when authenticated), stack traces, browser/device data, and IP address
• Place of processing: United States
• Sentry Privacy Policy

PostHog (PostHog Inc.)

Product analytics for authenticated users when the PostHog feature flag is enabled (typically trial/onboarding cohorts).

• Information that may be processed: user ID, email, workspace metadata, page views, product usage events, and session recording, when enabled
• Place of processing: United States / European Union (depending on project configuration)
• Duration: according to the provider’s configuration
• Opt-out: Section 7
• PostHog Privacy Policy

LogRocket (LogRocket Inc.)

Optional session replay on public pages when explicitly enabled by environment configuration.

• Information that may be processed: interaction recordings and device/browser data
• Place of processing: United States
• Duration: according to the provider’s configuration
• LogRocket Privacy Policy

3.4 Marketing, Advertising, and Remarketing Trackers

Where permitted by law and by your preferences, Tess may use marketing and advertising Trackers to measure campaigns, attribute conversions, create or update advertising audiences, limit ad frequency, and carry out remarketing or interest-based advertising across different websites, applications, or services. These activities may involve audiences based on engagement, page views, and video views.

The categories of information involved and the characterization as a sale or sharing are in Section 5. How to exercise the opt-out is in Section 7.

Google Ads and Google advertising technologies

• Information that may be processed: cookie/device identifiers, IP, browser/device information, pages viewed, and engagement and conversion events
• Place of processing: United States
• Google Privacy Policy and Google Ads Settings

Meta Pixel / Meta Platforms

• Information that may be processed: cookie/device identifiers, IP, browser/device information, pages viewed, video views, engagement, referral, and conversion events
• Place of processing: United States and other locations where Meta operates
• Meta Privacy Policy

ManyChat

Used for marketing communications, campaign engagement, audience management, remarketing, and measurement, when configured.

• Information that may be processed: contact or platform identifiers, campaign interaction data, engagement events, and applicable pseudonymized online identifiers
• Trackers: cookies, pixels, or identifiers set by ManyChat when the widget or campaign is active; duration according to the provider’s configuration
• ManyChat Privacy Policy

4. TRACKERS AND THIRD-PARTY PARTNERS

The table below summarizes the providers in Section 3. Actual deployment may vary by page, campaign, location, device, and the choices you make in the banner and preference center. Additional operational providers (hosting, payments, and cloud) are listed in the Trust Center.

Operational providers of infrastructure, hosting, security, connectivity, payments, support, and similar services may process personal information on Tess’s behalf as processors, service providers, or contractors, subject to contractual limitations and applicable law. The updated list of those processors is available in the Trust Center. Advertising processing by Meta, Google advertising technologies, and ManyChat is described in Section 5.

5. SALE AND SHARING OF PERSONAL INFORMATION

Tess does not sell personal information for money.

When marketing, advertising, or remarketing Trackers are enabled, Tess may disclose certain identifiers and online activity information to Meta, Google advertising technologies, and ManyChat for advertising measurement, conversion attribution, audience creation, remarketing, and cross-context behavioral advertising. Under the CCPA/CPRA, this activity may constitute “sharing” of personal information, even if Tess does not receive financial consideration.

These partners may receive the information as independent third parties for their own advertising purposes. Tess does not treat them as service providers or contractors for this specific advertising processing. Their use of the data is governed by their own policies and terms.

The categories of information that may be shared include identifiers and information about internet or other electronic network activity, such as cookie and device identifiers, IP address, browser and device information, pages viewed, video view events, engagement events, referral information, and conversion-related events.

Tess does not sell or share prompts, responses, files, submitted content, or content generated on the Platform for advertising purposes.

How to exercise the opt-out of sale or sharing is in Section 7.

6. LEGAL BASES AND PRIVACY CHOICES

Where required by applicable law, Tess uses one or more legal bases for the use of Trackers:

• Strictly necessary Trackers: performance of a contract, legitimate interest in the operation and security of the Services, legal obligations, or another basis permitted by law (Brazilian General Data Protection Law — “LGPD,” art. 7, II, V, and IX, and the European Union General Data Protection Regulation — “GDPR,” arts. 6(1)(b), 6(1)(c), and 6(1)(f), as applicable);
• Functional Trackers: consent or another legal basis permitted by applicable law;
• Analytics and performance Trackers: consent, where required, or another permitted legal basis;
• Marketing, advertising, and remarketing Trackers: consent, where required by the LGPD, GDPR, or other applicable law. For California residents, these Trackers may involve sharing subject to the CCPA/CPRA opt-out right, exercised as described in Section 7.

Where processing is based on consent, you may withdraw it at any time through the mechanisms in Section 7. Withdrawal does not affect the lawfulness of processing carried out previously.

7. HOW TO MANAGE YOUR PREFERENCES

This section describes how to exercise choices about Trackers, including the Do Not Sell or Share option. What Tess does with sale and sharing is in Section 5.

Banner and preference center

On first visit, the cookie banner lets you choose categories of non-essential Trackers. After that, you may withdraw or change those choices at any time through the preference mechanism on the site. The setting applies to the browser and device used to make the choice. If you delete cookies, switch browsers or devices, or access Tess from another environment, you may need to set your preferences again.

Strictly necessary Trackers generally cannot be disabled through the banner. Blocking them in the browser may prevent parts of the Services from working.

Do Not Sell or Share My Personal Information

For United States residents, on first visit to the site, the banner presents the “Do Not Sell or Share My Personal Information” option, in accordance with the CCPA/CPRA. This choice may also be changed at any time through the preferences on the site.

If you opt out, Tess will, to the extent technically feasible, stop enabling marketing, advertising, and remarketing Trackers that disclose personal information for cross-context behavioral advertising on that browser or device. The choice does not affect strictly necessary Trackers or processing required to provide, protect, maintain, or support the Services.

Global Privacy Control

Where required by law, Tess recognizes the Global Privacy Control (“GPC”) as a valid opt-out request for sale or sharing. Upon detecting a valid GPC signal, Tess will, to the extent technically feasible, disable marketing, advertising, and remarketing pixels, tags, and SDKs in this Policy for that browser or device, without requiring an additional opt-out. Strictly necessary Trackers may continue to operate.

Browser and third-party controls

Most browsers allow you to block, delete, or limit cookies. Blocking all cookies may impair the functionality, security, or availability of the Services.

Google advertising preferences: Ads Settings and Google Analytics Opt-out Browser Add-on.

Industry programs, which are complementary to and do not replace Tess’s banner or GPC:

• YourOnlineChoices (European Union / United Kingdom);
• Network Advertising Initiative – NAI (United States); and
• Digital Advertising Alliance – DAA (United States).

8. INTERNATIONAL TRANSFERS

Trackers may involve transfers of personal information to countries outside your country of residence, including the United States and other countries where Tess or the relevant provider operates. In the advertising and remarketing context, processing by independent third parties is described in Section 5.

Tess uses safeguards for international transfers where required by applicable law. In Brazil, these transfers observe arts. 33 to 36 of the LGPD and may include adequacy decisions, standard contractual clauses, contractual protections, and other valid transfer mechanisms, so as to maintain a level of protection compatible with that required by Brazilian law. Where the GDPR applies, Tess uses recognized mechanisms, such as European Commission adequacy decisions or standard data-protection clauses.

The legal basis for the transfer generally follows the legal basis of the Tracker itself, as described in Section 6. You may request information about the safeguard mechanisms used through the channels in Section 11.

9. PERSONS UNDER 18 YEARS OF AGE

The Services are intended exclusively for persons 18 (eighteen) years of age or older. Tess does not direct the Services to persons under 18 and does not knowingly solicit their personal information.

If Tess becomes aware that it has collected personal information from a person under 18 in a manner inconsistent with this Policy or the Terms of Use, it may take reasonable steps to delete such information and terminate or restrict the associated account, as applicable. If you believe that a person under 18 has provided personal information to Tess, please contact us through the channels in Section 11.

Nothing in this section limits Tess’s obligations under applicable law, including requirements regarding the sale or sharing of personal information of consumers under 16 years of age.

10. CHANGES TO THIS COOKIE POLICY

Tess may update this Cookie Policy to reflect changes in law, technology, Tracker deployment, advertising practices, or the Services. When changes are material, Tess will provide notice by updating the effective date and, where required, through additional notice or a renewed consent mechanism.

11. CONTACT

For questions about this Policy, please contact us through the channels below.

Tess Tecnologia LTDA
CNPJ: 60.806.420/0001-91
Address: Av. Prof. Pereira Reis, 76, Loja B, Santo Cristo, Rio de Janeiro, RJ, 20220-800, Brazil

Data Protection Officer (DPO): DPO services are provided on Tess’s behalf by Open CyberSecurity (https://opencybersecurity.com.br/), a privacy and information-security consultancy contracted to support LGPD/GDPR compliance.

Contact: [email protected]

Support: [email protected]