Terms of Service
These Terms of Service (“Terms”) govern access to and use of the Autenti.ca platform (the “Service”) by the contracting educational institution (the “School”). By purchasing or using the Service, the School agrees to these Terms, the Privacy Policy and the Refund Policy, which form part of them.
1. Who we are
The Service is provided by Third Factor Authentication Inc. (“Autenti.ca”, “we”), a corporation incorporated under the federal laws of Canada (Canada Business Corporations Act), with its head office at 306 East 26th Street, Hamilton, Ontario, L8V 3E1, Canada. Contact: ola@autenti.ca · phone/WhatsApp +1 905‑745‑6688.
2. The Service
Autenti.ca is a palm-recognition platform for schools: student attendance, gamified engagement, administrative dashboards, and WhatsApp arrival notifications to families. The Service comprises the reader terminal software, the web dashboards, and the integrations described in the commercial proposal. Students' use of biometrics is always optional and consent-based — see sections 9 to 11.
3. Eligibility
The Service is offered exclusively to legal entities — schools and school networks identified by a CNPJ (or the equivalent registration outside Brazil). The Service is not offered to individual consumers. Whoever accepts these Terms on behalf of the School represents that they have authority to do so.
Students, parents and guardians are not parties to these Terms, and no third-party contractual rights or obligations arise from them. The school community's relationship with Autenti.ca is governed by the Privacy Policy and by the consent terms presented by the School — not by this agreement.
4. Account and security
The School is responsible for keeping its administrators' credentials confidential, for granting access only to authorized people, and for notifying us immediately of any unauthorized use of its account.
5. Orders, payment and taxes
Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle provides all customer service inquiries and handles returns.
Paddle charges the payment method, issues the transaction confirmation and invoice, and handles billing support and returns. Each purchase is also governed by Paddle's Checkout Buyer Terms and Paddle's Refund Policy. Paddle acts as an independent data controller of payment data — see the Privacy Policy.
- Recurring subscriptions are charged automatically to a card or a supported digital wallet (such as PayPal, Apple Pay or Google Pay); one-time payments in Brazilian reais may be made via Pix (Paddle's checkout collects the payer's CPF/CNPJ, as required to process Pix payments).
- Prices are exclusive of taxes. Paddle does not currently collect Brazilian taxes on cross-border sales; if Paddle begins collecting Brazilian taxes (for example, CBS/IBS under Brazil's consumption-tax reform), they will be added to the price at checkout. The School remains responsible for any taxes due on its import of services under applicable law (for example, withheld income tax (IRRF), CIDE, PIS/COFINS-Importação, ISS, and IOF on foreign-exchange or international card transactions).
- Non-payment may lead to suspension of access after reasonable prior notice.
6. Pricing
The list price is US$ 5 per active student, per month, converted to your local currency by Paddle at checkout. Multi-site school networks receive a discount — contact us for a quote. Price changes are announced at least 30 days in advance and take effect from the next billing cycle.
7. License
We grant the School, for the duration of the agreement, a limited, non-exclusive, non-transferable license to use the Service for its internal attendance and school-engagement operations. The School may not resell, sublicense, copy, modify or reverse-engineer the Service, nor use it to build a competing product.
8. Acceptable use
- Use the Service only for the purposes in section 2 and in compliance with the law;
- do not use the Service for covert surveillance, commercial profiling of students, or any discriminatory purpose;
- do not make enrollment, continued attendance or participation in school life conditional on the use of biometrics;
- do not enroll a student without the valid consent described in section 10;
- do not attempt to access other institutions' data or circumvent security controls.
9. Data protection — roles
For the personal data processed in operating the platform (data of the School's students, guardians and staff), the School is the controller and Autenti.ca is the processor/operator under Brazil's Lei nº 13.709/2018 (LGPD), processing data on the School's instructions and under the Data Processing Addendum at the end of these Terms. Autenti.ca acts as a controller only for: (a) contact and billing data of the School's administrators; (b) the autenti.ca website; and (c) the model-training images in section 11, where authorized. Details are in the Privacy Policy.
10. The School's obligations as controller
- Obtain, before each student's biometric enrollment, the specific and highlighted consent of at least one parent or legal guardian (LGPD, arts. 11(I) and 14 §1) — for example via the WhatsApp flow the platform provides — and keep a record of that consent;
- guarantee a non-biometric alternative for attendance (manual roll call by the teacher, a feature already included in the Service) for students without consent or who opt out, with no detriment to them;
- process consent withdrawals (including those received via WhatsApp) and delete the student's biometric enrollment in the platform;
- inform its school community about the processing (LGPD, arts. 9 and 14 §2), in language accessible to children and adolescents;
- appoint its own data protection officer (LGPD, art. 41) and answer data subject requests from its community;
- comply with state and municipal education rules applicable to biometrics in schools.
11. Images for model improvement (optional)
With additional, separate, revocable consent from parents or guardians, encrypted palm images may be retained to improve our recognition models. For that processing Autenti.ca acts as a controller. Without that specific consent no images are retained — the Service works fully without it. The complete rules (3-year maximum retention, withdrawal, deletion) are in the Privacy Policy.
12. Availability and support
We use commercially reasonable efforts to keep the Service available, but we do not offer a contractual service-level agreement (SLA). Scheduled maintenance is announced in advance where possible. Support is available by email (ola@autenti.ca) and WhatsApp (+1 905‑745‑6688).
13. Intellectual property
The Service, the recognition models, the trademarks and all associated software belong to Third Factor Authentication Inc. or its licensors. The School's and its community's data belong to the School and to the data subjects; nothing in these Terms transfers their ownership to us.
14. Disclaimer of warranties
The Service is provided “as is”. Biometric recognition is probabilistic: despite high accuracy we do not guarantee the total absence of recognition errors, and the Service includes the manual alternative precisely for those cases. The Service is an administrative and engagement tool — it does not replace the School's legal duties of supervision over its students.
15. Limitation of liability
To the maximum extent permitted by law, Autenti.ca's total liability for damages arising from these Terms is limited to the amount paid by the School in the 12 (twelve) months preceding the event, and neither party is liable for indirect damages or lost profits. This limitation does not apply to willful misconduct or gross negligence, nor where the law does not allow it to be limited.
16. Term, suspension and termination
The agreement runs for the purchased cycle (monthly or annual) and renews automatically until cancelled. The School may cancel at any time, effective at the end of the paid period — see the Refund Policy. We may suspend or terminate for a material breach of these Terms, with notice and a reasonable cure period where appropriate. On termination we return or delete personal data as set out in the Data Processing Addendum.
17. Changes to these Terms
We may update these Terms with at least 30 days' notice for material changes. Continued use after the new version takes effect constitutes acceptance; if the School disagrees, it may cancel before the change comes into force.
18. Governing law and forum
These Terms are governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein. For Schools located in Brazil, disputes concerning services provided in Brazil may alternatively be brought before the Brazilian courts of the School's domicile (Marco Civil da Internet, art. 8), and Brazilian public-order rules — including the LGPD — continue to apply. Individually negotiated enterprise agreements may provide otherwise and prevail over this section.
19. Language
These Terms are published in Portuguese and English. For Schools in Brazil the Portuguese version prevails; elsewhere, the English version prevails.
20. Contact
Third Factor Authentication Inc. · 306 East 26th Street, Hamilton, Ontario, L8V 3E1, Canada · ola@autenti.ca · +1 905‑745‑6688.
Addendum — Data Processing Addendum (DPA)
This Addendum forms part of the Terms and governs the personal data processing carried out by Autenti.ca as processor/operator on behalf of the School (controller).
A.1 Subject matter and instructions
We process the school community's personal data exclusively to provide the Service described in section 2, under these Terms and the School's lawful, documented instructions. Data and data-subject categories, purposes and retention periods are set out in the Privacy Policy.
A.2 Security
We maintain technical and organizational measures consistent with LGPD art. 46, including biometric template protection (stored templates are protected, revocable, and cannot be used to reconstruct the palm image), encryption at rest and in transit, role-based access control, and per-institution segregation.
A.3 Sub-processors
The School authorizes the sub-processors listed in the Privacy Policy (Google Cloud hosting in São Paulo; WhatsApp/Meta for messaging). Changes to the list are announced with reasonable notice, and the School may object on legitimate grounds. Sub-processors are bound by protection obligations equivalent to this Addendum.
A.4 International transfers
Platform data is stored in Brazil (São Paulo region). Remote support access from Canada takes place under the ANPD standard contractual clauses (Resolução CD/ANPD nº 19/2024), which are incorporated into this Addendum; the full text of the clauses is available on request from ola@autenti.ca.
A.5 Security incidents
We notify the School of security incidents that may create relevant risk or harm to data subjects within 3 business days of becoming aware, with the information needed for the School's notifications to the ANPD and to data subjects (Resolução CD/ANPD nº 15/2024).
A.6 Assistance to the controller
We assist the School in handling data subject rights (LGPD, art. 18), in keeping processing records, and in preparing a data protection impact report (RIPD) where required, providing an RIPD template and a parental consent template at onboarding.
A.7 Return and deletion
On termination we return exportable data to the School and delete the personal data in our possession within 60 days, except for retention required by law (detailed in the Privacy Policy). Deletion of an individual student (consent withdrawal or departure) is processed as described in the Privacy Policy.
A.8 Verification
On reasonable request we make available information demonstrating compliance with this Addendum and answer the School's security questionnaires at most once per year, except after an incident.
A.9 Training data
The processing described in section 11 (images for model improvement) is not carried out on the School's behalf: for it, Autenti.ca is the controller, the processing depends on specific, revocable parental consent, and the Privacy Policy rules apply in full.