Terms of Service
These Terms of Service (“Terms”) govern access to and use of the Autenti.ca platform (the “Service”) by the contracting educational institution (the “School”). By purchasing or using the Service, the School agrees to these Terms, thePrivacy Policy and theRefund Policy, which form part of them.
1. Who we are
The Service is provided by Third Factor Authentication Inc.(“Autenti.ca”, “we”), a corporation incorporated under the federal laws of Canada (Canada Business Corporations Act), corporation number 1808389-4, with its head office at 306 East 26th Street, Hamilton, Ontario, L8V 3E1, Canada. Contact:ola@autenti.ca.
For Schools in Brazil, local sales and billing are handled byTRST Tecnologia Ltda (“TRST”), CNPJ 64.966.968/0001-50, with its head office at Parque Capital Digital, Lote 4, Bloco B, Unidade A1, Zona Industrial, Brasília – DF, 70.635-815, Brazil — see section 5.
2. The Service
Autenti.ca is a palm-recognition platform for schools: student attendance, gamified engagement, administrative dashboards, and family notifications through the channel agreed with the School (the School's own WhatsApp channel, a channel set up by Autenti.ca, or an integration with the School's own app). The Service comprises the reader terminal software, the web dashboards, and the integrations described in the commercial proposal. Students' use of biometrics is alwaysoptional and consent-based — see sections 9 to 11.
3. Eligibility
The Service is offered exclusively to legal entities — schools and school networks identified by a CNPJ (or the equivalent registration outside Brazil). The Service is not offered to individual consumers. Whoever accepts these Terms on behalf of the School represents that they have authority to do so.
Students, parents and guardians are not parties to these Terms, and no third-party contractual rights or obligations arise from them. The school community's relationship with Autenti.ca is governed by the Privacy Policy and by the consent terms presented by the School — not by this agreement.
4. Account and security
The School is responsible for keeping its administrators' credentials confidential, for granting access only to authorized people, and for notifying us immediately of any unauthorized use of its account.
5. Orders, payment and taxes
Payments are processed by Stripe, our payment processor. The seller and billing party is the contracting entity identified in section 1: Third Factor Authentication Inc., which charges the payment method, issues the transaction confirmation, and handles billing support and refunds. Stripe acts as an independent data controller of payment data — see the Privacy Policy.
Schools in Brazil: sales are made byTRST (section 1), which charges in Brazilian reais and issues the corresponding Brazilian tax documents. Everywhere else, Third Factor Authentication Inc. charges directly.
- Recurring subscriptions are charged automatically to a card or a supported digital wallet (such as Apple Pay or Google Pay); one-time payments in Brazilian reais may be made via Pix (checkout collects the payer's CPF/CNPJ, as required to process Pix payments and issue Brazilian tax documents).
- On sales made by TRST in Brazil, applicable Brazilian taxes are collected and remitted by TRST as required by law. On international sales made by Third Factor Authentication Inc., prices are exclusive of taxes, and the School remains responsible for any taxes due on its import of services under applicable law (for example, withheld income tax (IRRF), CIDE, PIS/COFINS-Importação, ISS, and IOF on foreign-exchange or international card transactions).
- Non-payment may lead to suspension of access after reasonable prior notice.
6. Pricing
Prices are defined in a proposal based on school size, locations and contracted services. The proposal details monthly fees, equipment, implementation and any messaging costs. In Brazil, amounts are quoted in Brazilian reais and TRST bills in Brazilian reais; elsewhere, the amount is converted to your local currency at checkout.Contact us for a quote. Price changes are announced at least 30 days in advance and take effect from the next billing cycle.
7. License
We grant the School, for the duration of the agreement, a limited, non-exclusive, non-transferable license to use the Service for its internal attendance and school-engagement operations. The School may not resell, sublicense, copy, modify or reverse-engineer the Service, nor use it to build a competing product.
8. Acceptable use
- Use the Service only for the purposes in section 2 and in compliance with the law;
- do not use the Service for covert surveillance, commercial profiling of students, or any discriminatory purpose;
- do not make enrollment, continued attendance or participation in school life conditional on the use of biometrics;
- do not enroll a student without the valid consent described in section 10;
- do not attempt to access other institutions' data or circumvent security controls.
9. Data protection — roles
For the personal data processed in operating the platform (data of the School's students, guardians and staff), the School is thecontroller and Autenti.ca is theprocessor/operator under Brazil's Lei nº 13.709/2018 (LGPD), processing data on the School's instructions and under theData Processing Addendum at the end of these Terms. Autenti.ca acts as a controller only for: (a) contact and billing data of the School's administrators; (b) the autenti.ca website; and (c) the model-training images in section 11, where authorized. Details are in the Privacy Policy.
10. The School's obligations as controller
- Obtain, before each student's biometric enrollment, the specific and highlighted consent of at least one parent or legal guardian (LGPD, arts. 11(I) and 14 §1) — for example via the WhatsApp flow the platform provides — and keep a record of that consent;
- guarantee a non-biometric alternative for attendance (manual roll call by the teacher, a feature already included in the Service) for students without consent or who opt out, with no detriment to them;
- process consent withdrawals (including those received via WhatsApp) and delete the student's biometric enrollment in the platform;
- inform its school community about the processing (LGPD, arts. 9 and 14 §2), in language accessible to children and adolescents;
- appoint its own data protection officer (LGPD, art. 41) and answer data subject requests from its community;
- comply with state and municipal education rules applicable to biometrics in schools.
11. Images for model improvement (optional)
With additional, separate, revocable consent from parents or guardians, encrypted palm images may be retained to improve our recognition models. For that processing Autenti.ca acts as acontroller. Without that specific consent no images are retained — the Service works fully without it. The complete rules (3-year maximum retention, withdrawal, deletion) are in thePrivacy Policy.
12. Availability and support
We use commercially reasonable efforts to keep the Service available, but we do not offer a contractual service-level agreement (SLA). Scheduled maintenance is announced in advance where possible. Support is available by email (ola@autenti.ca).
13. Intellectual property
The Service, the recognition models, the trademarks and all associated software belong to Third Factor Authentication Inc. or its licensors. The School's and its community's data belong to the School and to the data subjects; nothing in these Terms transfers their ownership to us.
14. Disclaimer of warranties
The Service is provided “as is”. Biometric recognition is probabilistic: despite high accuracy we do not guarantee the total absence of recognition errors, and the Service includes the manual alternative precisely for those cases. The Service is an administrative and engagement tool — it does not replace the School's legal duties of supervision over its students.
15. Limitation of liability
To the maximum extent permitted by law, Autenti.ca's total liability for damages arising from these Terms is limited to the amount paid by the School in the 12 (twelve) months preceding the event, and neither party is liable for indirect damages or lost profits. This limitation does not apply to willful misconduct or gross negligence, nor where the law does not allow it to be limited.
16. Term, suspension and termination
The agreement runs for the term and billing cycle set out in the commercial proposal (monthly or annual) and renews automatically at the end of each cycle unless notice of non-renewal is given. Where the proposal includes equipment (on loan-for-use or otherwise), installation or other initial investment, it may set a minimum commitment period; in that case, cancellation before the end of that period follows the conditions set out there. Subject to any such period, cancellation takes effect at the end of the paid period — see theRefund Policy. We may suspend or terminate for a material breach of these Terms, with notice and a reasonable cure period where appropriate. On termination we return or delete personal data as set out in the Data Processing Addendum.
17. Changes to these Terms
We may update these Terms with at least 30 days' notice for material changes. Continued use after the new version takes effect constitutes acceptance; if the School disagrees, it may cancel before the change comes into force.
18. Governing law and forum
These Terms are governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein. For Schools located in Brazil, disputes concerning services provided in Brazil may alternatively be brought before the Brazilian courts of the School's domicile (Marco Civil da Internet, art. 8), and Brazilian public-order rules — including the LGPD — continue to apply. Individually negotiated enterprise agreements may provide otherwise and prevail over this section.
19. Language
These Terms are published in Portuguese and English. For Schools in Brazil the Portuguese version prevails; elsewhere, the English version prevails.
20. Contact
Third Factor Authentication Inc. · 306 East 26th Street, Hamilton, Ontario, L8V 3E1, Canada ·ola@autenti.ca.
Addendum — Data Processing Addendum (DPA)
This Addendum forms part of the Terms and governs the personal data processing carried out by Autenti.ca as processor/operatoron behalf of the School (controller).
A.1 Subject matter and instructions
We process the school community's personal data exclusively to provide the Service described in section 2, under these Terms and the School's lawful, documented instructions. Data and data-subject categories, purposes and retention periods are set out in thePrivacy Policy.
A.2 Security
We maintain technical and organizational measures consistent with LGPD art. 46, including biometric template protection (stored templates are protected and revocable), encryption at rest and in transit, role-based access control, and per-institution segregation.
A.3 Sub-processors
The School authorizes the sub-processors listed in thePrivacy Policy (Google Cloud hosting in São Paulo; WhatsApp/Meta for messaging). Changes to the list are announced with reasonable notice, and the School may object on legitimate grounds. Sub-processors are bound by protection obligations equivalent to this Addendum.
A.4 International transfers
Platform data is stored in Brazil (São Paulo region). Remote support access from Canada takes place under the ANPD standard contractual clauses (Resolução CD/ANPD nº 19/2024), which are incorporated into this Addendum; the full text of the clauses is available on request fromola@autenti.ca.
A.5 Security incidents
We notify the School of security incidents that may create relevant risk or harm to data subjects within 3 business days of becoming aware, with the information needed for the School's notifications to the ANPD and to data subjects (Resolução CD/ANPD nº 15/2024).
A.6 Assistance to the controller
We assist the School in handling data subject rights (LGPD, art. 18), in keeping processing records, and in preparing a data protection impact report (RIPD) where required, providing an RIPD template and a parental consent template at onboarding.
A.7 Return and deletion
On termination we return exportable data to the School and delete the personal data in our possession within 60 days, except for retention required by law (detailed in the Privacy Policy). Deletion of an individual student (consent withdrawal or departure) is processed as described in the Privacy Policy.
A.8 Verification
On reasonable request we make available information demonstrating compliance with this Addendum and answer the School's security questionnaires at most once per year, except after an incident.
A.9 Training data
The processing described in section 11 (images for model improvement) is not carried out on the School's behalf: for it, Autenti.ca is the controller, the processing depends on specific, revocable parental consent, and the Privacy Policy rules apply in full.