Privacy Policy

1. Who decides about your data

It depends on the relationship:

• Employee and user data on the platform (profile, time records, vacations, payslips and notices): the employer that subscribed to Humaniza is the controller. TalkBridge is the processor: it handles this data on the employer's behalf and following its instructions.
• Data of site visitors and people who request a demo, and contact data of client companies for the business relationship: TalkBridge is the controller.

If you are an employee, your employer is the first channel for questions and requests about your data in Humaniza. TalkBridge also accepts your request and forwards it to them.

2. Data we process

• Website and demo requests: name, email, company, number of employees, department, modules of interest, message, page language and the IP address the request came from.
• Platform profile: name, CPF (Brazilian taxpayer ID), email, mobile number, job title, hire date, manager, access profile and termination date.
• Access: your passkey's public key (biometrics and PIN stay on your device: Humaniza never receives or stores your fingerprint, face or PIN), email sign-in codes (stored only as a hash and valid for minutes), your kiosk PIN if you use one (stored only as a hash: not even HR can see it), sessions and the audit trail of who did what and when.
• Time records: date and time of each clock-in, sequential number, integrity code (hash), collector type (app, computer, browser or kiosk), device time, browser identification and, if your device allows it, your location at the moment of the clock-in, with the reported accuracy and whether it falls inside the work-location radius set by the company. Location is collected only when you clock in, never continuously.
• Work routine: working hours, timesheet adjustments and justifications, timesheets and acknowledgements, vacation requests and periods, payslips (PDF files) and receipt confirmations, notices and read confirmations.
• Notifications: if you turn them on, the browser's push subscription address, used for clock-in reminders.

3. Why we use it and on what legal basis

• Recording and reviewing time, issuing receipts and generating the AFD and AEJ files: compliance with the employer's legal obligations (art. 74 of the Brazilian Labor Code) and performance of the employment contract (LGPD, art. 7, II and V).
• Location at clock-in: the employer's legitimate interest in checking the work location (art. 7, IX), collected only at that moment and without blocking the clock-in when denied.
• Payslips, vacations and notices: performance of the employment contract and compliance with legal obligations (art. 7, II and V).
• Authentication, security and auditing: legitimate interest, fraud prevention and retention of access logs required by Brazil's Internet Civil Framework (Law no. 12.965/2014, art. 15) (art. 7, II and IX).
• Responding to demo requests and business contacts: pre-contractual steps and legitimate interest (art. 7, V and IX).

We do not use employee data for advertising, we do not sell it, and we do not make automated decisions that affect your rights. If artificial intelligence features are added, this Policy will be updated first.

4. Who we share it with

• The employer: HR and managers it authorizes see the data according to their access profile.
• Amazon Web Services (AWS): hosting, database, file storage and email delivery, as TalkBridge's processor.
• Browser notification services (such as Google, Apple and Mozilla): only to deliver the notifications you turn on.
• Authorities, such as labor inspectors and the courts: when the law or an order requires it, including the AFD and AEJ files.

5. International transfer

Humaniza is hosted on AWS in the us-east-1 region, in the United States. The transfer follows art. 33 of the LGPD, relying on the provider's contractual guarantees and security measures. The website loads fonts from Google Fonts, which receives the browser's IP address to deliver the files.

6. How long we keep it

• Time records, timesheet reviews and legal files: for as long as needed to comply with employment law and allow a defense in legal proceedings, as a rule at least 5 years (Brazilian Federal Constitution, art. 7, XXIX), or longer while proceedings are pending. By law, clock-ins cannot be deleted before then.
• Payslips and other HR documents: for as long as the contract with the employer lasts and afterwards for the period the employer sets within its legal obligations.
• Application access logs: at least 6 months (Internet Civil Framework, art. 15).
• Demo requests: up to 2 years without further contact, or until you ask for deletion.

When the contract with the employer ends and the employer has exported its data, the rest is deleted or anonymized, except what the law requires us to keep.

7. Security

We use always-encrypted connections (HTTPS); files such as payslips encrypted at rest with keys managed on AWS; isolation of each company's data in the database itself; passwordless access with passkeys; role-based access profiles; an audit trail; and immutable time records with chained integrity codes.

No system is completely immune to incidents. If a relevant security incident occurs, we will notify the employer, Brazil's National Data Protection Authority (ANPD) and the affected data subjects, as required by the LGPD.

8. Your rights

You can request: confirmation that we process your data and access to it; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary data or data processed unlawfully; portability; information about who we share it with; and review of automated decisions (LGPD, art. 18). You can also file a complaint with the ANPD.

For platform data, send your request to your company's HR team or to us, and we will forward it to the employer. For website and demo data, contact us directly. We respond within 15 days.

Some requests have legal limits: clock-ins cannot be deleted while the law requires them to be kept, and corrections are made in the timesheet review, preserving the original record.

9. Cookies and on-device storage

The website does not use advertising or audience-analytics cookies.

The app uses only strictly necessary cookies to keep your session, which scripts cannot read. It also stores on your device a copy of your profile and any clock-ins made offline, until they are sent. Signing out deletes the stored profile.

10. Minors

Humaniza is for professional use. Data of employees under 18, such as apprentices, is processed in their best interest and under the employer's responsibility (LGPD, art. 14).

11. Data protection officer and contact

To exercise your rights or ask about privacy, contact TalkBridge's data protection officer at contato@talkbridge.com.br.

12. Changes

This Policy may be updated. The current version is kept on this page with the date of the last update, and relevant changes are announced through the platform.