Compliance and LGPD

The LGPD splits responsibilities between controller and processor:

• You, the customer, are the controller of the data of the people you look up: you set the purpose and legal basis and inform the data subjects.
• BrazID is the processor of that data: it looks up and returns the information under your instructions, without using it for any other purpose.
• BrazID is the controller of your account data and platform usage (registration, access, billing and security).

Every lookup must have a legitimate, specific purpose that is disclosed to the data subject. Accepted examples:

• fraud prevention and registration validation;
• age or identity verification in sign-up and hiring processes;
• data checks for risk analysis and credit decisions, with an appropriate legal basis.

Using the API for stalking, discrimination, or for selling or building databases for resale is prohibited. Accounts that break these rules may be suspended or terminated.

• We handle only what a lookup needs: CPF, name, birth date, registration status and, when available, gender and a deceased flag.
• Looked-up data stays in cache for up to 30 days to speed up repeat lookups, then it is removed.
• We do not sell personal data or use it for third-party advertising.
• When the purpose ends, or on request, we delete or anonymize data unless the law requires us to keep it.

• Encrypted communication (TLS) between client, API, database and cache.
• API keys and passwords stored only as hashes; the full key is shown once, at creation.
• CPF masked (for example, 123.***.***-00) in logs and audit records; no full personal data goes to open logs.
• Per-key request limits and protection against abusive login and sign-up attempts.
• Email verification at sign-up, disposable email blocking and duplicate account detection.
• Internal admin panel with two-step verification, role-based access control and an audit log of actions.
• Least privilege: production credentials are available only to the API runtime.

We use vendors under contract, acting as sub-processors, only for what the service needs:

• Cloudflare: hosting and network.
• Neon: PostgreSQL database.
• Upstash: cache and rate limits.
• Stripe: payments (we do not store your card number).
• Resend: transactional email.
• Official registry data source: CPF lookup.

Some vendors may process data outside Brazil, under LGPD article 33, with contractual clauses and protective measures.

People whose CPF was looked up can request access, correction, deletion and the other rights in LGPD article 18. Since the customer who made the lookup is the controller, the fastest path is to contact that company first.

If you need help identifying it, or the request is about your BrazID account data, write to [email protected]. We answer within the legal deadline and, if needed, ask for information to confirm your identity.

If an incident may cause relevant risk or harm to data subjects, we will notify the ANPD and those affected under LGPD article 48. We ask customers to tell us without delay about any incident involving data obtained through the API or exposed API keys, which can be revoked instantly from the dashboard.

• Have a legal basis and inform data subjects about the lookup in your privacy policy.
• Look up only what is necessary and keep the data for the minimum time.
• Protect your API keys and revoke any that are exposed.
• Handle data subject requests and, if needed, rely on our help.

Data Protection Officer: [email protected]. Other matters: [email protected]. You may also complain to the Brazilian National Data Protection Authority (ANPD).