Privacy Policy

1. Scope

This policy applies to all users of the Platform — buyers, sellers, trade coordinators, logistics providers, service partners, and API users — in all 12 countries where Open Americas operates: United States, Mexico, Canada, Colombia, Brazil, Peru, Chile, Argentina, Ecuador, Guatemala, Costa Rica, and the Dominican Republic.

This policy does not apply to third-party websites or services that may be linked from the Platform. Open Americas is the data controller for personal data processed through the Platform.

2. Data We Collect

We collect the following categories of personal information:

3. Legal Basis for Processing

Where data protection law requires a legal basis for processing personal data — including under the GDPR, Brazil’s LGPD, Mexico’s LFPDPPP 2025, and similar laws — we process your data on the following bases:

4. How We Use Your Data

5. Service Providers

We do not sell your personal data. We share data only with the following service providers, each engaged under data processing agreements that restrict their use of your data to providing services to Open Americas:

6. International Data Transfers

Open Americas is incorporated in the United States. Our platform infrastructure is hosted primarily in the United States. By using the Platform, you acknowledge that your personal data will be transferred to and processed in the United States.

When we transfer data internationally, we apply the following protections depending on where you are located:

Note: USMCA Article 19.11 prohibits data localization requirements for digital trade services between the US, Mexico, and Canada. Our cross-border data flows within North America are consistent with this framework.

7. Data Retention

We retain personal data for as long as necessary to fulfill the purposes described in this policy, or as required by applicable law. Our retention periods are:

We may retain data longer when required by a legal hold, ongoing litigation, regulatory investigation, or other legal obligation. When we no longer need data, we securely delete or anonymize it.

8. Your Rights by Jurisdiction

Your privacy rights depend on your location. Below we describe the rights available to you under applicable law. To exercise any right, contact us at privacy@openamericas.com. We will respond within 30 days (or the timeframe required by applicable law).

9. Sensitive Personal Information

To comply with KYC and AML requirements, we collect certain categories of sensitive personal information:

• ·Government-issued identification numbers (passport, national ID, RFC, CURP, NIT, CUIT, CPF, or equivalent)
• ·Biometric data — specifically, facial scan data processed by Stripe Identity for buyer identity verification
• ·Financial account information (bank account and routing numbers for seller payouts via Stripe Connect)
• ·Business ownership structures and beneficial ownership information

We apply the following heightened protections to sensitive data:

• ·We collect biometric data only for the purpose of identity verification — we do not use it to track, profile, or market to you
• ·Biometric data is processed by Stripe under its own privacy controls and is not stored on Open Americas' servers
• ·Sensitive data is accessible only by personnel with a legitimate business need
• ·We never sell or share sensitive personal information with third parties for their own marketing purposes
• ·California users: we limit our use of sensitive personal information to the purposes specified in this policy, consistent with the CPRA

10. Automated Decision-Making

We use automated systems to assist with two types of decisions that may significantly affect you:

If you believe an automated decision has significantly and adversely affected you, you have the right to request human review. Contact privacy@openamericas.comwith the subject line “Automated Decision Review Request.”

11. Cookies & Tracking Technologies

We use a minimal set of cookies to operate the Platform:

We do not use advertising cookies, cross-site tracking pixels, third-party analytics (e.g., Google Analytics), or any non-essential tracking technology. If we introduce any in the future, we will update this policy and provide appropriate consent mechanisms.

12. Security

We implement technical and organizational security measures appropriate to the risk, including:

• ·TLS encryption for all data in transit
• ·SHA-256 hashing of session tokens stored in the database
• ·Role-based access controls — each user type sees only the data relevant to their role
• ·Webhook signature verification on all inbound payment and KYC webhooks
• ·Parameterized database queries to prevent SQL injection
• ·Dependency monitoring and regular security reviews

While we take security seriously, no system is completely secure. We cannot guarantee that your information will not be accessed, disclosed, altered, or destroyed. If you discover a potential security vulnerability, please report it to security@openamericas.com.

13. Children

The Platform is intended solely for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. In compliance with the Children’s Online Privacy Protection Act (COPPA) and equivalent laws in other jurisdictions, if we learn that we have collected personal information from a person under 18 without verified parental consent, we will promptly delete that information. If you believe a minor has registered on our Platform, please contact privacy@openamericas.com immediately.

14. Marketing Communications

We will only send you marketing communications if you have opted in. We comply with the following frameworks:

We do not share your contact information with third-party marketers. To manage your communication preferences, visit your account settings or email privacy@openamericas.com.

15. Data Breach Notification

We maintain a breach response plan. In the event of a personal data breach, we will:

• ·Notify affected users promptly — within the timeframe required by applicable law, and no later than 72 hours after discovery where feasible
• ·Notify the relevant supervisory authorities within the required timeframes: GDPR (72 hours to supervisory authority); LGPD Brazil (72 hours to ANPD and affected users); LFPDPPP Mexico (notification to SABG and affected users); CCPA (expedient notice); PIPEDA (notification to OPC when there is real risk of significant harm)
• ·Describe in the notification: the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the measures taken or proposed to address the breach
• ·Cooperate fully with any regulatory investigation

To report a potential security incident or data breach, contact security@openamericas.com.

16. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes — those that significantly affect how we use your data or your rights — we will provide at least 30 days’ notice via email and a prominent notice on the Platform before the changes take effect. For non-material clarifications, we will update the policy and revise the “Effective” date at the top. Continued use of the Platform after the notice period constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

17. Contact & Regulatory Authorities

For privacy questions, data subject requests, or concerns about how we handle your personal data:

Data Protection Supervisory Authorities