Privacy Policy

We act in two roles, depending on the data:

• Controller, for our customers' and users' data (registration, access, API usage, billing and security): we decide how and why this data is processed.
• Processor, for the personal data of the people whose CPF is looked up by customers (name, date of birth, registration status): we process this data on behalf of and under the customer's instructions; the customer is the controller and is responsible for the legal basis, the purpose and transparency towards data subjects. See the Terms of Use.

• Account: name, email, password (stored only as a hash, never in plain text) and, with social login, the name, email and identifier provided by Google or GitHub.
• Security and fraud prevention: IP address, device identification (fingerprint) at sign-up, login records and session cookies.
• API usage: hash of the API key (never the plain key), date and time, status, latency, data source and the CPF looked up in masked form (for example, 123.***.***-00). We do not write the full CPF to open logs.
• Looked-up data: CPF, name, date of birth, registration status and, when available, sex and deceased indicator, cached for up to 30 days.
• Billing: payment data is handled directly by Stripe; we do not store your card number.
• Communications: messages you send us (for example, through the sales contact form) and transactional emails (email confirmation, usage alerts).

• Providing the Service, creating and managing the account and billing for use: performance of a contract (art. 7, V).
• Security and prevention of fraud and abuse (rate limits, blocking duplicate accounts, auditing): legitimate interest (art. 7, IX) and credit protection.
• Complying with legal and regulatory obligations, such as keeping access logs and tax obligations: art. 7, II.
• Exercising rights in judicial, administrative or arbitration proceedings: art. 7, VI.
• Optional communications and non-essential cookies, if any: consent (art. 7, I), which can be withdrawn at any time.

We do not sell personal data and do not use it for third-party advertising.

We share only what is necessary, with suppliers acting as processors under contract, and with authorities when required by law:

• Official source of registration data (to look up the CPF and date of birth).
• Infrastructure and database: Cloudflare (hosting and network), Neon (PostgreSQL database) and Upstash (cache and rate limits).
• Payments: Stripe.
• Transactional email: Resend.
• Social login: Google and GitHub, if you choose that method.
• Public authorities, under legal order or for the regular exercise of rights.

Some of the suppliers above may process data outside Brazil. In such cases the transfer takes place under art. 33 of the LGPD, with contractual clauses and measures meant to ensure a level of protection compatible with Brazilian law.

We use only strictly necessary cookies: the dashboard session cookie (HttpOnly, secure) and those for fraud and abuse protection. We do not use advertising cookies. You can block them in your browser, but the dashboard may stop working.

• Looked-up data (CPF and registration data): cached for up to 30 days, then removed.
• Account and usage: while the account is active and afterwards for as long as needed to meet legal and regulatory obligations, to defend ourselves in proceedings and to prevent fraud, according to the applicable legal periods.
• When the purpose ends or at your request, we delete or anonymize the data, except where retention is allowed by law (art. 16 of the LGPD).

We adopt technical and organizational measures to protect data, such as: encrypted communication (TLS) end to end; passwords and API keys stored only as hashes; CPF masking in records; rate limiting and blocking of abusive attempts; two-step verification and role-based access for the internal team; and least-privilege access to production credentials. No system is completely secure, but we work continuously to reduce risks.

In case of a security incident that may cause relevant risk or harm to data subjects, we will notify the ANPD and the affected data subjects under art. 48 of the LGPD.

You may at any time request:

• confirmation that we process your data and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed in non-compliance;
• data portability;
• deletion of data processed on the basis of consent;
• information about who we share data with;
• information about the possibility of not giving consent and its consequences, and withdrawal of consent;
• review of decisions made solely on the basis of automated processing (art. 20).

To exercise your rights, write to our Data Protection Officer: privacidade@brazid.com. We may ask for information to confirm your identity and will answer within the legal deadline. You may also complain to the Brazilian National Data Protection Authority (ANPD).

Our customers look up CPFs for purposes such as fraud prevention and registration validation and are the controllers of that data. If you want to know why your CPF was looked up, or to request correction or another right, contact the company that made the lookup first. If you need help identifying it, write to privacidade@brazid.com and we will guide you, within what the law allows.

The Service is intended for businesses and professionals over 18 and is not directed at children or teenagers. If we learn of a minor's sign-up, the account may be closed.

We may update this Policy. Material changes will be notified by email or in the dashboard. The last update date is at the top of this page.

Data Protection Officer: privacidade@brazid.com. Other matters: comercial@brazid.com.