PRIVACY POLICY — KINPROOF

Last updated: June 17, 2026 · Version: 1.5

This Privacy Policy explains how KinProof collects, uses, stores, shares, and protects personal data.

Table of Contents

1. Who we are

KinProof is operated by TI Especialistas LTDA, registered under CNPJ nº 59.203.644/0001-20, with registered office at Rua Major Clarindo Fundão, Praia do Canto — Vitória / ES, Brazil.

Privacy contact / Data Protection Officer (DPO): [email protected]

2. Who this Policy applies to

This Policy applies to website visitors, registered users, leads, customers, partners, and any other individuals whose personal data is processed in the context of KinProof's operations.

3. Categories of data we may process

Depending on how you use KinProof, we may process:

identification data — such as first name, last name, email address, phone number, and account data;
authentication and security data — such as logs, IP address, session identifiers, browser, operating system, and access date and time;
browsing and usage data — such as pages visited, platform interactions, preferences, and usage metrics;
contact and support data — such as messages, commercial requests, and service communications;
uploaded documents and content — such as images, PDFs, texts, certificates, parish records, immigration documents, and related materials;
personal data contained in uploaded documents — including data of family members and third parties present in submitted materials;
billing and payment data, where applicable — including transaction identifiers, payment status, invoices, receipts, purchase history, chargebacks, taxes, and metadata necessary for payment processing; KinProof does not store full card data; if the user opts to save a payment method at checkout, that information is stored and managed by Paddle, not by KinProof;
processing logs and metadata — such as technical records of platform usage, file processing, audit trails, fraud prevention, security, and resource performance.

The phone number (item a above) is optional: it is only collected if you choose to provide it during sign-up or in your account profile. Consent for WhatsApp communications is an additional, equally optional step granted separately, and may be revoked at any time from your account profile. In this phase, KinProof does not send messages via WhatsApp.

Some historical documents may contain sensitive personal data or information of a potentially sensitive nature, such as data relating to religion, ethnic origin, health, parentage, or other categories protected by applicable law. When this occurs, KinProof will process such information only to the extent strictly necessary for legitimate purposes permitted by applicable law.

4. Sources of data

Personal data may be obtained:

directly from you, when you create an account, use the platform, or contact us;
from documents and materials you upload;
automatically, through logs, cookies, and similar technologies;
from service providers and partners necessary for the operation of the service, where applicable.

5. Purposes and legal bases

We process personal data for the purposes listed below, in accordance with applicable law:

5.1 Creating, managing, and protecting user accounts

Typical legal basis: performance of a contract; pre-contractual measures; legitimate interest in account security.

5.2 Providing the requested service

Includes receiving documents, processing, organizing, generating transcripts, structuring information, and making results available within the user's account.

Typical legal basis: performance of a contract.

5.3 Security, fraud prevention, and platform integrity

Includes technical monitoring, logs, abuse blocking, and investigation of misuse.

Typical legal basis: legitimate interest; compliance with legal obligations; exercise of legal rights.

5.4 Support, customer service, and operational communications

Typical legal basis: performance of a contract; legitimate interest.

5.5 Compliance with legal and regulatory obligations

Typical legal basis: legal or regulatory obligation.

5.6 Defense in proceedings, audits, and exercise of legal rights

Typical legal basis: exercise of legal rights.

5.7 Improving platform performance, stability, security, and usability

Typical legal basis: legitimate interest, subject to necessity, proportionality, and data subject rights.

5.8 Marketing and promotional communications

Typical legal basis: consent, where required, or legitimate interest where permitted by applicable law.

5.9 Cookies and non-essential technologies

Typical legal basis: consent, where required.

5.10 Phone number and WhatsApp consent

KinProof may collect the user's phone number, when voluntarily provided, for the following purposes:

operational contact related to the account or service, when necessary;
communications via WhatsApp, exclusively when the user grants separate and explicit consent for that purpose.

Typical legal basis: consent (for WhatsApp communications); performance of a contract or legitimate interest (for operational contact, where applicable).

WhatsApp consent is optional, may be revoked at any time from the account profile, and is not required to use the platform. Revocation does not affect the validity of processing already carried out. In this phase, KinProof does not send messages via WhatsApp. The phone number is not shared with third parties for marketing purposes and is not used to send automated messages without prior consent.

5.11 Processing of sensitive personal data

Some documents uploaded to KinProof may contain sensitive personal data or special categories of data, including information about religion, ethnic origin, health, parentage, or other information protected by applicable law.

KinProof will process such data only where a specific and appropriate legal ground exists, limited to the purposes strictly necessary for:

providing the service requested by the user;
compliance with a legal or regulatory obligation;
the exercise of legal rights in judicial, administrative, or arbitral proceedings;
protecting platform security and preventing fraud, where legally appropriate and within the limits of applicable law;
other situations expressly permitted by applicable law.

Where the LGPD applies, KinProof will not rely on legitimate interest as a legal basis for processing sensitive personal data, observing the specific statutory grounds provided for this category of data.

Where the GDPR applies, in addition to a legal basis under Article 6, KinProof will only process special categories of personal data where at least one condition under Article 9 applies, such as explicit consent of the data subject, necessity for the establishment, exercise, or defense of legal claims, or another situation expressly permitted by applicable law.

KinProof does not use sensitive personal data for marketing, behavioral advertising, commercial profiling, or training of general artificial intelligence models in this initial product phase.

5.12 Legitimate interest for non-sensitive personal data

With respect to personal data that is not sensitive, KinProof may rely on legitimate interest as a legal basis for purposes compatible with the safe and efficient operation of the platform, such as security, fraud prevention, stability, technical improvement, and communications strictly related to the service, always subject to necessity, proportionality, and the rights of the data subject.

KinProof will not rely on legitimate interest as a legal basis for processing sensitive personal data.

Where applicable, data subjects may object to processing based on legitimate interest, in accordance with applicable law.

6. Use of artificial intelligence

KinProof uses artificial intelligence and automation resources to assist in the processing and organization of uploaded documents.

In this initial phase:

we do not use documents uploaded by users to train third-party general models;
we do not use documents uploaded by users to train our own general models;
we do not use uploaded documents or data for cross-account matching, discovery of kinship between users, user profiling, or training of mechanisms that would allow family relationships between distinct accounts to be identified.

If this changes in the future, KinProof will update this Policy and adopt, where necessary, specific mechanisms for information and consent.

We do not use solely automated decisions with legal or equivalent effects based on uploaded documents. The results are support tools and should be subject to human review when relevant.

7. Third-party data contained in uploads

Since KinProof analyzes genealogical, historical, and family documents, the materials you upload may contain personal data of third parties.

In such cases:

you declare that you have the legitimacy, authorization, or adequate legal basis for such upload;
KinProof will process these materials in the context of service provision, security, support, fraud prevention, legal compliance, and exercise of legal rights;
KinProof may restrict, refuse, or remove materials uploaded in breach of the law, these documents, or third-party rights.

8. KinProof's role in processing

Depending on the context, KinProof may act:

as a controller for its own purposes such as security, fraud prevention, customer service, service improvement, legal compliance, and exercise of legal rights;
as a processor in relation to certain activities carried out on behalf of the user or client, where this classification is legally applicable.

This distinction may vary depending on the usage model, account type, contractual arrangement, and applicable law.

9. No cross-user matching in this initial phase

In this initial phase of KinProof:

we do not cross-reference users to discover relatives;
we do not share one user's documents with another user;
we do not maintain collaborative account-matching functionality;
we do not use uploaded documents or data for internal analyses that would allow family relationships between distinct accounts to be identified.

10. Data sharing

KinProof may share personal data, to the extent necessary, with:

hosting, storage, security, authentication, monitoring, communications, and support providers;
technology infrastructure operators and suppliers;
automated processing, text recognition, artificial intelligence, and related tool service providers, when used to execute the service;
payment and billing processors, where applicable — KinProof uses Paddle as its payment processor and Merchant of Record; KinProof does not collect, store, or process full credit or debit card data; Paddle webhooks are used to confirm payments, update the user's global credit wallet balance, process subscriptions, refunds, and other related events; if the user opts to save a payment method at checkout, that information is stored and managed by Paddle;
public, regulatory, or judicial authorities, where there is a legal obligation or valid request;
lawyers, auditors, consultants, and partners subject to confidentiality obligations.

KinProof does not currently sell or share personal data in a manner that constitutes a "sale" or "sharing" under applicable California law. If this changes in the future, we will update this Policy and provide the necessary mechanisms, including any opt-out forms or links required by law.

11. International transfers

Given the digital nature of the service, data may be processed on servers, by providers, or by partners located outside the user's country of residence, including in Brazil, the United States, the European Economic Area, the United Kingdom, and other jurisdictions.

Where required, KinProof will seek to implement appropriate safeguards for international transfers, such as contractual clauses, technical and organizational measures, risk assessments, and other mechanisms required by applicable law.

12. Retention and disposal

Personal data and documents will be stored only for as long as necessary for the purposes described in this Policy and as required by applicable law.

12.1 Indicative retention periods

Account data: while the account is active and for up to 180 days after closure, unless a legal obligation, dispute, or legitimate pending request applies;
Uploaded documents: while necessary for service provision and, after account closure, for up to 90 days, unless a legal obligation, fraud, security concern, litigation, or legitimate preservation request applies;
Security and access logs: for up to 6 months or for the applicable statutory period;
Support records: for up to 24 months after the end of the service interaction;
Billing and tax data: for the period required by applicable accounting, tax, and regulatory legislation;
Ledger records, transactions, invoices, consents, and audit trails: for as long as necessary for legal compliance, fraud prevention, financial audit, dispute resolution, and defense of legal rights;
Backups: in accordance with a technical retention cycle of up to 90 days, unless a legal obligation or incident recovery applies.

After the applicable period expires, data may be deleted, anonymized, blocked, or retained in a restricted manner where necessary for legal compliance, security, fraud prevention, or exercise of legal rights.

13. Security

KinProof implements reasonable technical, administrative, and organizational measures to protect personal data against unauthorized access, destruction, loss, alteration, disclosure, or improper processing.

Such measures may include access controls, logical segregation, encryption in transit, monitoring, internal policies, event logging, pseudonymization where applicable, and supplier review, commensurate with the nature of the processing.

No system is entirely immune to risk. Accordingly, while we adopt measures appropriate to the nature of the service, we cannot guarantee absolute security.

14. Security incidents

Where required by applicable law, KinProof will take steps to assess, respond to, and notify data subjects and competent authorities of security incidents and personal data breaches, within a timeframe consistent with applicable law and indicating, where possible, the measures taken to contain, mitigate, and protect those affected.

15. Data subject rights

To the extent provided by applicable law, you may request:

confirmation of whether processing is taking place;
access to personal data;
rectification of incomplete, inaccurate, or out-of-date data;
anonymization, blocking, or erasure, where applicable;
data portability, where applicable;
information about data sharing;
withdrawal of consent, where processing is based on consent;
objection to certain processing, where applicable;
review of automated decisions, where required by applicable law.

Requests may be sent to: [email protected]

16. Additional rights for EEA/EU, UK and Switzerland residents

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you may have additional rights under applicable law, including:

access to personal data;
rectification of inaccurate data;
erasure, where applicable;
restriction of processing;
objection to certain processing;
data portability, where applicable;
lodging a complaint with the competent supervisory authority.

Requests may be submitted through the same channel indicated in this Policy: [email protected]

KinProof will endeavor to respond to requests without undue delay and, as a rule, within 1 (one) month, which period may be extended in cases permitted by applicable law, with notice to the data subject.

Where personal data was not obtained directly from the data subject but is contained in documents uploaded by another user, KinProof will assess the appropriate way to provide legally required information, taking into account applicable law, operational feasibility, and third-party rights.

KinProof does not currently maintain an established representative in the European Union. If this changes, this Policy will be updated to reflect the representative's details, as required by applicable law.

17. Additional rights for California residents

If you are a California resident, you may have additional rights under applicable law, including the right to:

know what categories of personal data we collect;
know the sources of that information;
know the purposes of collection, use, and disclosure;
request access, correction, and deletion, where applicable;
not face discrimination for exercising your privacy rights.

Requests may be submitted via [email protected] and, when made available, through a dedicated form on the platform.

KinProof will seek to acknowledge requests within a reasonable period and respond substantively within 45 (forty-five) calendar days, extendable as permitted by applicable law.

17.1 Summary for California residents

Item	Description
Categories of data	Identifiers, account data, browsing data, logs, uploaded documents, support content, and billing data
Sources	Directly from the user, from uploaded documents, from platform usage, and from service providers necessary for the operation of the service
Purposes	Service provision, security, fraud prevention, support, legal compliance, exercise of legal rights, technical improvement, and operational communications
Categories of third parties	Hosting, security, authentication, technical processing, artificial intelligence, billing, support, and consultants subject to confidentiality obligations
Sale or sharing under California law	Currently, no
Sensitive personal information	KinProof may process sensitive data as defined by applicable law, such as religion or ethnic origin contained in historical documents, exclusively to provide the service, comply with legal obligations, exercise rights, and maintain security, without using such data for marketing, sale, sharing, or profiling in this initial phase

If in the future there is a change in scope involving sale, sharing, broader use of sensitive personal data, or additional opt-out mechanisms required by law, KinProof will update this Policy and the applicable interface, including forms, links, banners, or preference signals that become mandatory.

18. Cookies

The use of cookies and similar technologies is described in a separate document: Cookie Policy.

19. Children and minors

KinProof is not intended for the direct registration of children. The registration process may include age confirmation.

When family documents you upload contain data relating to minors, such processing will occur only to the extent necessary for service provision, security, fraud prevention, legal compliance, and exercise of legal rights.

If we identify an account created by a minor without an adequate legal basis, we may restrict or close the account and delete, block, or retain the data under restricted retention, as required by applicable law.

20. Changes to this Policy

This Policy may be updated to reflect legal, regulatory, operational, or technological changes. The current version will always be available with the respective update date.

21. Contact and complaints

Company: TI Especialistas LTDA

Privacy email / DPO: [email protected]

Address: Rua Major Clarindo Fundão, Praia do Canto — Vitória / ES, Brazil

If you are in Brazil, you may seek information from the competent data protection authority, where applicable. If you are in the EEA/EU, the United Kingdom, or Switzerland, you may contact the competent supervisory authority of your jurisdiction.