Data Processing Agreement

1. Parties and roles

The customer is the controller of the personal data of the people it verifies. [a preencher] ([a preencher]) is the processor and processes that data only on the customer's documented instructions, which are the API calls and the account settings.

2. Purpose, nature and duration

Purpose

Verify the identity of people the customer chooses, through document reading, live movement check and 1:1 face comparison.

Nature

Collection by the capture page, reading, rule checks, comparison, storage, retrieval by the customer and deletion.

Duration

While the contract is in force, plus the retention configured for the account.

3. Data subjects and categories of data

Data subjects

People the customer asks to verify (applicants, users, providers, account holders).

Identification data

Name, CPF, date of birth, document number and expiry date read from the document.

Images

Document images and frames captured during the live movements.

Biometric data

Face comparison scores. Face templates exist only in memory during comparison and are never stored.

Technical data

IP address, user agent, timestamps and consent record.

4. Processor obligations

• Process the data only on the customer's instructions and inform the customer if an instruction appears to infringe the law.
• Ensure that people with access are bound by confidentiality.
• Help the customer answer data subject requests and carry out impact assessments.
• Never use the data to train models or for any purpose of its own.

5. Security measures

• Application-level encryption of every image with AES-256-GCM before storage; the bucket holds only ciphertext.
• Private storage; images leave only through an authenticated API route.
• Isolation per customer in every query.
• Capture token kept in the URL fragment, out of server logs.
• Append-only audit trail of session events, with IP and user agent.

6. Sub-processors

The current sub-processors, with their countries, are listed in the Privacy Policy. The customer authorizes them and will be notified of any new sub-processor [a preencher] days in advance, with the right to object.

7. International transfers

Document reading may take place outside Brazil. Transfers rely on [a preencher], such as the standard contractual clauses of Resolution CD/ANPD 19/2024.

8. Retention and deletion

Retention is configured per customer. A daily job deletes images whose period has ended and records an audit event. The customer can delete a session's images and personal data at any time through the API. At the end of the contract, remaining data is deleted within [a preencher] days.

9. Incident notification

The processor notifies the customer of a security incident affecting the customer's personal data within [a preencher] hours of becoming aware of it, with the information available at that time.

10. Evidence and audits

Each session keeps its checks, reason codes, the thresholds in force and an audit trail the customer can read through the API. Audit requests beyond that: [a preencher].