Privacy Policy

Last updated: October 15, 2026

This Policy explains how Third Factor Authentication Inc.(“Autenti.ca”, “we”) — a Canadian corporation with its head office at 306 East 26th Street, Hamilton, Ontario, L8V 3E1, Canada — handles personal data on the autenti.ca website and in the Autenti.ca platform used by schools, including the Autenti.ca app for guardians. It is written to meet Brazil's Lei Geral de Proteção de Dados (LGPD, Lei nº 13.709/2018) and Canada's federal privacy law (PIPEDA).

1. Roles: who answers for what

• School community data (students, guardians, staff) processed in the platform: the School is the controllerand we are the processor/operator, handling data on the School's instructions under the Data Processing Addendum in theTerms of Service. Requests about this data should go first to the School — and we help it respond.
• We are the controller for: data about visitors to this website; contact and billing data of School administrators; and training images retained with specific consent (section 5).
• Stripe (our payment processor at checkout) is anindependent controller of payment data — section 7.

2. What data we process

• Palm biometric templates — mathematical representations of palm vein patterns and palmprints, used for recognition and protected by cryptographic measures and access controls. Image processing and its purposes are described separately in this policy.
• Encrypted palm images — only with the specific, separate consent described in section 5.
• School identification data — student name, class and identifier, provided by the School.
• Attendance events — date and time of recognitions, terminal used and outcome.
• Guardian contact details — WhatsApp number and email, recorded by the School, for arrival notifications, the consent flow and signing in to the app for guardians.
• Guardian app data — sessions, notification tokens and guardians' responses (section 6).
• Administrative data — name, email and credentials of School administrators; billing data.
• Technical records — application access logs, kept for 6 months (the retention period of Marco Civil da Internet, art. 15), and error diagnosticswithout personal identifiers.
• Website cookies — analytics only, with consent (section 13).

3. Children and adolescents

Biometric data is sensitive personal data (LGPD, art. 5(II)) and most data subjects in the platform are children and adolescents — so the processing is designed around thebest interest of the minor (LGPD, art. 14; ECA):

• Biometric enrollment happens only with the specific, highlighted consent of at least one parent or legal guardian(arts. 11(I) and 14 §1), collected by the School — for example via the platform's WhatsApp flow, which records the response.
• Consent is free: using biometrics is never a condition of enrollment or of taking part in school life. Students without consent — or who choose to stop — have their attendance recorded manually by the teacher, a feature included in the platform, with no detriment.
• To withdraw consent, review your choices through the link sent onWhatsApp, deselect the authorization and save, or ask the School for guidance. Once consent is withdrawn, the biometric template is deleted (timelines in section 9).
• We do not use student data for advertising or commercial profiling, consistent with the LGPD and with Lei nº 15.211/2025 (Brazil's Digital ECA).

For you, the student: when you present your palm to the reader, you know when recognition takes place. Your Parêa represents you on the celebration screen. Your data is protected, and using images for improvement requires separate family consent. You and your family can choose an alternative way to identify yourself, according to your school’s procedures.

4. Purposes and legal bases

• Recognition and attendance — consent of parents or guardians (LGPD, arts. 11(I) and 14 §1).
• WhatsApp notifications to families — the same consent, explained when it is given.
• Gamification and engagement — class points and achievements derived from attendance events, in the student's interest and under the same consent; no rankings that expose individual absences.
• Administrator accounts and billing — performance of a contract (LGPD, art. 7(V)) and legal obligations.
• Security, logs and abuse prevention — legal obligation to retain access records (Marco Civil, art. 15) and legitimate interest for non-sensitive data.
• Model improvement — specific, separate consent (section 5).

5. Images for model improvement (optional)

With the additional, separate, revocable consent of parents or guardians, we retain encrypted palm images to train and improve our recognition models. For that processing, Autenti.ca is thecontroller. The rules:

• it is an opt-in per student — without this consent no images are retained and the platform works normally;
• in Brazil, the images are stored encrypted with segregated keys; they are never used for advertising or shared with third parties;
• for training, the images are transferred to Canada, where Autenti.ca decrypts and processes them on its own access-restricted equipment; the models trained with them are used in the product. The international transfer is disclosed before consent is given and covered by it (LGPD, art. 33(VIII)) — safeguards in section 8;
• maximum retention of 3 years from capture — or less, if the student leaves the school or consent is withdrawn;
• withdrawal (via WhatsApp or through the School) deletes the student's images, including working copies in Canada and backups, within the timelines in section 9.

6. The Autenti.ca app for guardians

The Autenti.ca app (Android and iOS) is a channel between the School andguardians, alongside WhatsApp. It processes school community data — so the School is the controller and we are the processor/operator (section 1). The app is meant for adult guardians, not for children.

• Password-free sign-in — a guardian signs in with the email the School has on file. We send that email a sign-in link and a code, valid for 15 minutes and usable once.
• What the app shows — data the School already processes in the platform: the student's name and class, attendance notices (late arrivals and absences), justifications, family authorizations and the student's Parêa.
• What the app records — the guardian's responses (“ciente” / “não ciente”, justification text, authorization choices, Parêa customization) and, per device: a random session identifier (kept in the device's secure storage; the server holds only a cryptographic hash of it), the push-notification token, the platform (Android or iOS), the app version and the chosen language.
• Notifications — carry only the student's first name and the type, date and time of the notice, and are delivered through Apple's and Google's notification services. You can turn them off in the device settings; the School can keep notifying you on WhatsApp.
• What the app does not collect — location, contacts, photos, camera, microphone or advertising identifiers. There are no ads and no cross-app tracking, and we do not sell data.
• Error diagnostics — app crashes are sent to Sentry without personal identifiers (section 7).
• Signing out and deletion — “Sign out” and “Sign out of all devices” in the app settings end the sessions and stop notifications. The School can disconnect the app or remove the email at any time. To delete the data processed through the app, contact the School or write toola@autenti.ca (section 12).

7. Sharing and sub-processors

We do not sell personal data. We share only with:

• Google Cloud — platform hosting in a data centre in the School's region (the São Paulo region for Schools in Brazil); operational logs in Cloud Logging's global location; website infrastructure.
• Meta (WhatsApp) — delivery of notifications and the consent flow; Meta receives the phone numbers and message content needed for that delivery.
• Stripe — checkout payment processor, as anindependent controller: it receives name, email, billing address, payment details and CPF/CNPJ (required for Pix). SeeStripe's Privacy Policy.
• TRST Tecnologia Ltda (CNPJ 64.966.968/0001-50, Brasília – DF) — responsible for sales and billing in Brazil: it receives Brazilian Schools' contact and billing data for invoicing and Brazilian tax documents.
• Apple and Google (Firebase Cloud Messaging) — delivery of app notifications; they receive the device token and the short notification text (section 6).
• Resend — delivery of app sign-in emails; receives the guardian's email address and the sign-in link/code.
• Expo — delivery of app updates; receives only technical request data (such as IP address and app version).
• Sentry — software error diagnostics, receiving technical data only; our systems strip personal identifiers before sending, and biometric data is never sent.
• Authorities — where required by law or court order, to the extent required.

8. International data transfers

Public international-transfer notice (Resolução CD/ANPD nº 19/2024). Autenti.ca is operated by Third Factor Authentication Inc., which is based in Canada. The platform's personal data is held in a Google Cloud data centre in the School's region, encrypted at rest and in transit: data of Brazilian Schools is stored in Brazil (São Paulo region), and data of Schools in the United States in the United States. The exceptions are those described in this section, plus error diagnostics, processed in the United States by Sentry, and operational logs, kept in Google Cloud's global Cloud Logging location. Schools in Canada and Mexico will be served from data centres in those countries; other countries are evaluated on request. For Brazilian Schools, data is processed fromCanada in two situations:

• Remote access for support and engineering — our team in Canada may remotely access platform data stored in Brazil to operate, maintain and support the service the School has contracted. For this processing, the School is the controller and we are the processor. Because Canada does not have an ANPD adequacy decision, this transfer is covered by the ANPD standard contractual clauses (controller → processor module), incorporated into our contract with each School.
• Training images (optional, section 5) — only where parents or guardians have authorized it, palm images are transferred from Brazil to Autenti.ca-controlled equipment in Canada anddecrypted there to train and improve our recognition models; the resulting models are used in the product. For this processing, Autenti.ca is the controller, and the transfer is covered by the parents' or guardians' specific, highlighted consent, given after prior notice of the international character of the operation (LGPD, art. 33(VIII)).

Safeguards for training images: they travel encrypted and remain encrypted on the platform; decryption takes place only on access-restricted Autenti.ca equipment, for training. Working copies held on that equipment in Canada are deleted within30 days of consent withdrawal or the student leaving, and are never kept beyond 3 years from capture (section 9). Deletion does not reach models already trained before it. The images are never used for advertising or shared with third parties.

Law applicable in Canada: data processed or accessed from Canada is also subject to Canadian law, including PIPEDA, and may be the subject of lawful access requests from Canadian authorities. Your rights under the LGPD continue to apply (section 12).

Copy of the clauses: the full text of the ANPD standard contractual clauses and of our international-transfer annex is available to any data subject on request fromola@autenti.ca.

Payment data is handled by Stripe under its own policy; Sentry's technical diagnostics (without personal identifiers) are processed in the United States.

9. How long we keep data

Deletion requests — consent withdrawal, a student leaving or the School's instruction — are reviewed by Autenti.ca's administrators and executed within 30 days of the request, automatically if not executed earlier, unless retention is required by law or for the establishment, exercise or defence of legal claims (a legal hold). Backup copies expire within 35 days after the deletion.

• Biometric templates — deleted within 30 days of consent withdrawal, the student leaving, or the School's instruction; recognition stops immediately.
• Training images (opt-in), including working copies in Canada — maximum 3 years from capture; deleted within 30 days of consent withdrawal or the student leaving.
• Backups — copies expire within 35 days of deletion of the primary data.
• Attendance events and school records — kept for the duration of the contract, under the School's control; returned or deleted on the School's request, within a reasonable time after the end of the contract, except where retention is required by law.
• App: sessions and notification tokens — until the guardian signs out, the School disconnects the app or the guardian is removed; sign-in links and codes expire after 15 minutes.
• App: notices and responses — part of the school records (previous item).
• Application access logs — 6 months (the retention period of Marco Civil, art. 15); other operational logs follow the same period.
• Administrative audit log — 12 months.
• Consent records — kept for as long as needed to demonstrate compliance with consent obligations.
• Billing data — 7 years (Canadian tax obligations).
• Error diagnostics — 30 days.

10. Security

Measures aligned with LGPD art. 46: biometric template protection (protected, revocable templates), encryption at rest and in transit, segregated keys for training images, role-based access control, per-institution segregation, and audit logging of administrative operations.

11. Security incidents

Incidents that may create relevant risk or harm are reported to the School within 3 business days of our becoming aware, with the information needed for notifications to the ANPD and to data subjects (Resolução CD/ANPD nº 15/2024). Where we act as controller, we make those notifications ourselves.

12. Your rights

Every data subject (or their legal guardian) can exercise the rights in LGPD art. 18:

• confirmation that processing exists, and access to the data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data;
• portability, as regulated;
• deletion of data processed on the basis of consent;
• information about sharing and about the option not to consent;
• withdrawal of consent, at any time and free of charge.

For school community data, direct your request first to your School (the controller) — and count on us too: we also receive requests atola@autenti.ca and forward them. You may also petition the ANPD (gov.br/anpd). In Canada, PIPEDA's access and complaint rights apply, before theOffice of the Privacy Commissioner of Canada (priv.gc.ca).

13. Cookies on this website

We use only Google Analytics 4 analytics cookies (_ga, _ga_CF3TPCTM9V), which collect aggregated browsing data without identifying individuals.No advertising or cross-site tracking cookies are used.

We implement Google Consent Mode v2 defaulting todenied: on your first visit Google Analytics runs cookieless; analytics cookies are only set if you click Accept on the cookie notice. You can change your choice at any time:

14. Communications and marketing

Operational messages (arrival notifications, consent, billing) are part of the Service. We may send informational or marketing communications to School contacts; every message identifies the sender and includes an immediate unsubscribe option, honoured within 10 days (LGPD and Canada's anti-spam law — CASL).

15. Data Protection Officer and contact

Our data protection officer (LGPD, art. 41 encarregado) and Privacy Officer (PIPEDA) isCarlos José Gonçalves Vidal —ola@autenti.ca · Third Factor Authentication Inc., 306 East 26th Street, Hamilton, Ontario, L8V 3E1, Canada. He responds in Portuguese and English.

16. Changes to this Policy

Material changes are announced on this page at least 30 days in advance, and where the legal basis is consent we offer a fresh opportunity to decide. The date of the last update appears at the top.