LGPD

Versioned texts. Every acceptance records the timestamp, the hash of the text and the version, and the receipt carries them. General consent never unlocks biometrics.

Before consenting, the person sees what they are authorizing: the context the client sent, in the clear only for them. The record keeps the hash and the list of keys the policy read.

When there is a mandate, acceptance of the scope is a layer of its own, distinct from the journey consent, and goes in the mandate receipt.

The texts in use are the 2026-08 version. Review with the data protection officer is a pending decision of the plan; when it comes, it changes the version, never the history.

Live presence and match run, return the result, and the image and the template are discarded. Biometrics retained equals false is a product invariant, not configuration.

The reference the client gives the person enters as an HMAC with a per-client secret; the reference image, when there is one, as a hash; the context, as a hash plus the list of keys read.

From the civil identity source only the verdict persists, encrypted; the raw response never leaves the adapter.

Data key per record, per-client isolation in the database, decryption trail with a hash chain.

By act or by the client's opaque reference: key destruction, synchronous, with the response saying how many records were affected and a record of who erased and when.

Erasure has its own scope, which no integration receives by default; in practice, the data subject asks the client, and the client erases through the dashboard.

Encrypted verdict and CPF: 90 days. Consent evidence and event trail: five years. Automatic sweep every six hours. The policy in force is read from the service's configuration, not declared in writing: if the period changes, the response changes with it.

They do not exist. The gateway does not store the CPF in the clear and cannot link a CPF to acts without decrypting record by record. The erasure target is the act or the reference the client itself assigned.

Document validations made outside an act store the encrypted CPF with no link to any act; erasure on request does not reach them, and they die by the retention period. Closing that path is a recorded debt.

Processing record, retention policy and impact report exist as skeletons with markers for the officer, to be closed before the first real client. Hummand is the processor; the client is the controller.

Channel for data subjects and the officer: dados@hummand.com.br.