LGPD

Versioned texts. Every acceptance records the timestamp, the hash of the text and the version, and the receipt carries them. General consent never unlocks biometrics.

Before consenting, the person sees what they are authorizing: the context the client sent, in the clear only for them. The record keeps the hash and the list of keys the policy read.

In the agent mandate and in the person mandate, acceptance of the scope is a layer of its own, distinct from the journey consent, and goes in the mandate receipt.

The texts are versioned per layer: general v1-2026-08, biometric v1-2026-06 and mandate scope v1-2026-09, in Portuguese and English. The legal review, when it comes, changes the version, never the history.

Live presence and match run, return the result, and the captured image and the template are discarded. The client reference image stays encrypted only while the act is open, up to 30 days, and is erased when it ends. Biometrics retained after the act equals false is a product invariant, not configuration.

The reference the client gives the person enters as an HMAC with a per-client secret; the reference image, when there is one, as a hash; the context, as a hash plus the list of keys read.

That is pseudonymisation (LGPD art. 13, §4), not anonymisation: the per-client secret prevents reversal by enumeration, and the data still counts as personal. It is the same distinction the verifier and the receipt page make.

From the civil identity source only the verdict persists, encrypted; the raw response never leaves the adapter.

Data key per record, per-client isolation in the database, decryption trail with a hash chain.

Part of the processing happens outside Brazil: hosting and backups in the European Union; live presence, face comparison, the key module and secrets on AWS, in the United States; the edge and the sites on the Cloudflare global network; and telemetry with Grafana Labs, a foreign company, with a stack in São Paulo. The transfer mechanism for each provider, under art. 33 of the LGPD, is described in the processing record, which the client receives on contracting.

Mitigations: no frame retained, opt-out of use for AI training applied, and encryption with a key under Hummand's control for what stays at rest. National residency by agreement is under Security: what stays at rest can already be national, and a national live-presence source is in view.

By act, by the client's opaque reference or by the verdict of a standalone validation: key destruction, synchronous, with the response saying how many records were affected and a record of who erased and when, except for an act under preservation, which the client declares and releases.

Erasure has its own scope, which no integration receives by default; in practice, the data subject asks the client, and the client erases through the dashboard.

Encrypted verdict and CPF: 90 days. Consent evidence and event trail: five years. Automatic sweep every six hours. The client can keep the encrypted part of a type for longer, up to 20 years, only with a declared legal basis. The policy in force is read from the service's configuration, not declared in writing: if the period changes, the response changes with it.

They do not exist. The gateway does not store the CPF in the clear and cannot link a CPF to acts without decrypting record by record. The erasure target is the act or the reference the client itself assigned.

Document validations made outside an act store the encrypted CPF with no link to any act. Since gateway 0.13.0 erasure on request reaches them too, and since 0.15.0 by the verdict the client received; before, they only died by the retention period.

Retention periods are implemented and enforced in production, with erasure by key destruction. The processing record and the impact report were completed by the data protection officer on 2026-09-21 and follow every change in data flow; the international transfer and the sub-processors follow the instruments described in the processing record. Hummand is the processor; the client is the controller.

Data protection officer: Vinícius Lisboa, named in the Privacy notice. Channel for data subjects and the officer: [email protected].