Por ahora esta política está disponible en inglés; la versión en español viene en camino.

Cerrito Privacy Policy

Effective date: July 8, 2026 · Last updated: July 8, 2026

---

In plain terms

Here is the short, human version. The formal policy below is the one that legally controls, but this is the honest summary of it:

• Two different places, two different levels of data. Our public marketing website (cerritocattle.com) collects almost nothing — if you ask for early access we take an email, we remember your language choice with a cookie, and we may count visits with privacy-first, anonymous analytics. The app (app.cerritocattle.com), which you use after you log in, is where your real ranch data lives.
• Your ranch data is yours. The animals, weights, treatments, costs, your traced ranch boundary, your records — you own them. We are the custodian that stores and processes them for you. We do not sell your data. You can export it, and when you close your account we return or delete it.
• We never store your card number. Payments run through Stripe. Your full card details go straight to Stripe; we never see or keep them.
• What we do with satellite imagery is an estimate, not a visit. We read imagery of the land you mapped and combine it with your records to surface figures like cost per pound, grazing runway, and drought/water signals. We are never physically on your ranch. These are decision-support estimates with real limits — see the disclaimer in the Terms of Service.
• We use a small set of trusted vendors (for payments, email, hosting, imagery, analytics, and an on-page assistant) to run the service. They only get what they need to do their job.
• You have rights over your data — to see it, correct it, export it, and delete it — and we tell you below how to use them.

Questions? Contact us at support@cerritogroup.com.

---

1. Introduction and scope

This Privacy Policy ("Policy") explains how Cerrito Group LLC ("Cerrito," "we," "us," or "our"), a Texas limited liability company with a registered address at 5900 Balcones Drive, STE 100, Austin, TX 78731, collects, uses, discloses, and protects personal information in connection with:

• the marketing website located at cerritocattle.com and related public pages (the "Site"); and
• the Cerrito application located at app.cerritocattle.com and its associated features, mobile and web interfaces, and APIs (the "App").

The Site and the App are together the "Service." This Policy covers the whole Service, but it distinguishes clearly between the two, because the Site collects very little and the App is where substantive data is handled.

By using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with it, please do not use the Service. This Policy is incorporated into and subject to our Terms of Service ("Terms").

Bilingual note. Cerrito operates in English and Spanish. This English version is the reference text; a Spanish translation is provided for convenience, and in the event of a conflict between the versions, the English version controls.

2. Who this Policy applies to

This Policy applies to:

• Visitors to the Site;
• Prospective customers who submit an early-access or contact request;
• Account holders ("Customers"), typically the ranch owner or operator who subscribes to the App; and
• Authorized users ("Users") whom a Customer invites to their account (for example, ranch crew members).

Where a Customer sets up an account and invites Users, the Customer is generally responsible for the personal information of the Users it adds and for having an appropriate basis to add them. Cerrito processes that information on the Customer's behalf as described in Section 9 (Roles) and, where applicable, under a data processing agreement.

3. The two environments at a glance

4. Information we collect

4.1 Information the Marketing Site collects

• Early-access / contact information. If you submit an early-access or contact request, we collect the email address you provide. The Site's request form is designed to collect only your email; if we later add optional fields, we will update this Policy.
• Language preference. We store a small cookie recording your English/Spanish choice so the Site shows the right language.
• Anonymous analytics. We use privacy-first, self-hosted Umami analytics that measure aggregate usage (pages viewed, approximate region, device type) without cross-site tracking cookies and without selling data. Because our analytics are cookieless, no analytics cookie banner is required. We configure analytics to avoid collecting directly identifying information where feasible.
• Server logs. Our hosting infrastructure may automatically log technical data such as IP address, browser/user-agent, and timestamps for security and reliability. These logs are retained for 90 days.

4.2 Information the App collects

When a Customer uses the App, we collect and process:

• Account and contact information — name, email, password credentials (stored hashed/salted), preferred language, and role.
• Ranch profile and boundary — the ranch's name, location, and the boundary/parcel you trace on a map, along with derived geospatial data about that area.
• Herd and operational records — records about individual animals (identifiers, births, weights, treatments and medical notes, movements, family tree/lineage) and other operational records you create.
• Cost and financial records — operating costs and expenses you enter to support cost/breakeven and related figures. (Note: this is your operational financial data, not your payment-card data — see 4.3.)
• Satellite-derived readings — data we derive from third-party satellite/aerial imagery of the area you mapped, such as vegetation/grass indicators (versus the same ranch's own history), surface-water status, and rainfall/drought signals. These describe the land you mapped, not other properties.
• Voice inputs — audio you provide to create records by voice. Cerrito converts your speech to text using its own implementation and does not retain the raw audio; only the resulting text record is stored. No third-party transcription provider is used.
• Imported files — spreadsheets (Excel/CSV), photos, and other files you upload, plus the data extracted from them.
• Usage and device data — how you interact with the App (features used, actions taken, timestamps), device/browser information, and log data, used to operate, secure, and improve the App.
• Support communications — messages, requests, and attachments you send us for support.
• On-page assistant interactions — if you use our on-page assistant, the questions you type and the assistant's responses. The assistant is a public greeter that answers from a curated public knowledge base; it is not fed your private ranch data and does not require it to function; see Section 8.

4.3 Payment information

Subscriptions are billed through Stripe, Inc. ("Stripe"). When you subscribe or start a trial, you enter your payment-card details directly with Stripe. Cerrito does not collect, process, or store your full payment-card number or CVC. We receive from Stripe only limited billing metadata needed to manage your subscription — for example, a customer/subscription identifier, card brand, last four digits, expiration month/year, billing status, and country. Stripe's handling of your payment data is governed by Stripe's own privacy policy.

4.4 Information from third parties

We may receive information about the Service from our subprocessors and integrations (Section 10) — for example, satellite imagery and derived layers from an imagery provider, delivery/bounce status from our email provider, and payment status from Stripe.

4.5 Sensitive information

We do not intentionally collect government-issued identifiers, health information about individuals, precise real-time device geolocation of users, or other categories of sensitive personal information beyond what is described here. Please do not submit sensitive personal information that the Service does not request.

5. How we use information

We use personal information to:

1. Provide the Service — create and manage accounts, deliver the App's features, generate the estimates and figures described above, and enable multi-user, bilingual access.
2. Process payments — manage subscriptions, trials, renewals, and cancellations through Stripe.
3. Communicate — respond to early-access requests and support inquiries; send service, security, billing, and administrative messages; and, where permitted, send product updates you can opt out of.
4. Secure and maintain — monitor for fraud, abuse, and security incidents; debug; and maintain reliability.
5. Improve and develop — analyze usage to improve features and develop new ones, including creating aggregated and de-identified data as described in Section 6.
6. Comply and enforce — meet legal obligations, enforce our Terms, and protect the rights, safety, and property of Cerrito, our Customers, and others.

5.1 Legal bases (where GDPR/UK GDPR applies)

GDPR/UK GDPR is not currently in scope: Cerrito serves users in the US and Mexico only. This section is retained in case EU/UK users are added in the future — counsel to confirm before relying on it. Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases: performance of a contract (to provide the Service you request); legitimate interests (to secure, maintain, and improve the Service, and to market to businesses, balanced against your rights); consent (for example, certain optional communications or cookies, where required); and legal obligation (to comply with applicable law). You may withdraw consent at any time where processing is based on consent.

6. Aggregated and de-identified data

We may create and use aggregated or de-identified data that does not identify you or any individual — for example, benchmarks, statistics, and model-improvement datasets derived from usage and records. We maintain such data in de-identified form, do not attempt to re-identify it except as permitted by law, and may use and share it for any lawful business purpose. We do not sell your personal data, and aggregated/de-identified data is not personal data.

7. How we share information

We share personal information only as described here. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

• Subprocessors / service providers. With the vendors listed in Section 10, who process data on our behalf under contract and only to provide services to us.
• Payment processor. With Stripe, to process payments and manage subscriptions.
• Within your account. Data you enter in the App is accessible to the Customer account it belongs to and to the Users that account authorizes, according to the roles and permissions set within the account.
• Legal and safety. When we believe disclosure is reasonably necessary to comply with law, legal process, or a lawful government request; to enforce our Terms; or to protect the rights, safety, and property of Cerrito, our users, or the public.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to this Policy's protections. We will notify affected Customers as required.
• With your direction or consent. When you ask us to share information or otherwise consent.

8. The on-page assistant

The Service may offer an on-page assistant powered by a third-party large-language-model provider, Groq. The assistant is a knowledgeable greeter that answers from a curated public knowledge base about what the product does and how it works. It is not fed your private ranch records, customer data, or our proprietary internals. The text you type into the assistant is processed to generate a response and may be transmitted to Groq as a subprocessor under contract. Cerrito uses assistant prompts only to improve and refine the assistant's models, retains them for no more than 90 days for that purpose, and then deletes them. Please do not enter sensitive personal information into the assistant.

9. Roles: controller and processor

• Marketing Site. For information collected on the Site (early-access email, language cookie, analytics), Cerrito acts as the controller/business.
• App. For personal information that a Customer enters into the App about the Customer's business, animals, costs, and Users, Cerrito generally acts as a processor/service provider processing that data on the Customer's behalf and under the Customer's instructions and our Terms (and, where applicable, a data processing agreement). The Customer is the controller/business for that data. For account administration, billing, security, and our own improvement of the Service, Cerrito acts as a controller/business for the associated data.

10. Subprocessors and third-party services

We rely on the following categories of subprocessors. The founder must confirm this list and keep it current.

Voice-to-text is performed by Cerrito's own implementation; there is no third-party voice-transcription subprocessor, and raw audio is not retained (see Section 4.2).

An up-to-date list of subprocessors is available on request at support@cerritogroup.com.

11. Cookies and similar technologies

The Site and App use a limited set of cookies and similar technologies:

• Strictly necessary — for example, a language-preference cookie and session/authentication cookies that keep you logged in.
• Analytics — as described in Section 4.1, our analytics (self-hosted Umami) are cookieless, so they set no analytics cookies and no analytics cookie banner is required.

We do not use third-party advertising or cross-site tracking cookies. You can control cookies through your browser settings; disabling strictly necessary cookies may break parts of the Service.

12. Data retention

We keep personal information only as long as needed for the purposes described in this Policy, then delete or de-identify it. Indicative periods (to be confirmed):

• Early-access / lead data: kept until you unsubscribe or after 24 months of inactivity, whichever comes first.
• Account and App data (active accounts): for the life of the account.
• After account closure: we keep your data available for export for 60 days, then delete it, except where we must retain limited records to comply with law, resolve disputes, or enforce agreements (legal holds). See Section 14 (Data ownership).
• Billing records: retained for 7 years as required by tax and accounting law.
• Server logs / security data: 90 days.
• On-page assistant prompts: no more than 90 days, then deleted (see Section 8).
• Backups: retained on an approximately 35-day rolling basis and then overwritten.

13. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information — including encryption in transit (TLS), access controls and authentication, hashed passwords, strict isolation of the marketing site from the App, and activity logging and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential and for managing the Users you invite. If we become aware of a breach affecting your personal information, we will notify you and authorities as required by applicable law.

14. Your data ownership, portability, and deletion

You own your data. The records and operational data you enter into the App are yours. Cerrito acts as custodian and does not sell them. You may:

• Export your data in CSV and Excel formats at any time through the App or by request; and
• Request return or deletion of your data on account closure, subject to the retention exceptions in Section 12.

15. Your privacy rights

Depending on where you live and applicable law, you may have some or all of the following rights. To exercise them, contact support@cerritogroup.com; we will verify your request and respond within the timeframes required by law. For data we process on a Customer's behalf (App data), we will refer or forward User requests to the relevant Customer where appropriate.

15.1 All users

• Access a copy of your personal information.
• Correct inaccurate information.
• Delete your information (subject to legal retention).
• Export/port your data.
• Opt out of non-essential marketing emails via the unsubscribe link.

15.2 California residents (CCPA/CPRA)

The CCPA/CPRA applies. If you are a California resident, you may have the right to know/access, delete, and correct personal information; to opt out of "sale" or "sharing" (we do not sell or share personal information as those terms are defined); to limit use of sensitive personal information (we do not use sensitive information for such purposes); and to be free from discrimination for exercising your rights. You may make requests via support@cerritogroup.com, and may use an authorized agent. Categories collected, used, and disclosed are described in Sections 4–7. We have not sold or shared personal information in the preceding 12 months.

15.3 EU/UK/EEA residents (GDPR/UK GDPR)

GDPR/UK GDPR is not currently in scope — Cerrito serves users in the US and Mexico only. This section is retained in case EU/UK users are added in the future; counsel to confirm before relying on it. If GDPR/UK GDPR applies, you also have rights to restriction, objection, and withdrawal of consent, and the right to lodge a complaint with your supervisory authority. Our legal bases are in Section 5.1. International transfers are addressed in Section 16.

15.4 Mexico (LFPDPPP)

The Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) applies. If you are in Mexico, you may have "ARCO" rights — Access, Rectification, Cancellation, and Opposition — and the right to revoke consent and limit use/disclosure of your data. Requests may be sent to support@cerritogroup.com.

16. International data transfers

The Service is operated from Germany (App hosting via Hetzner) and the United States (marketing-site hosting via AWS), and our subprocessors may process data in the United States and other countries. Our users are located in the United States and Mexico; if you use the Service from Mexico, your information may be transferred to and processed in the United States and Germany, which have different data-protection laws. Where required, we use appropriate safeguards for such transfers.

17. Children's privacy

The Service is a business tool intended for adults and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact us and we will delete it.

18. Third-party links

The Service may link to third-party websites or services (for example, Stripe's checkout). This Policy does not cover those third parties; their own privacy policies govern. We encourage you to review them.

19. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, provide additional notice (for example, by email or an in-Service notice). Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

20. Contact us

Cerrito Group LLC Attn: Privacy 5900 Balcones Drive, STE 100, Austin, TX 78731 Email: support@cerritogroup.com

(No Data Protection Officer or EU/UK representative is appointed, as GDPR/UK GDPR is not currently in scope. Counsel to revisit if EU/UK users are added.)

---