Terms and Conditions of Use

Version 4.2 | Published on September 28, 2026, effective October 13, 2026

1. Parties and purpose

These Terms and Conditions of Use (“Terms”) govern access to and use of the platform, API and other services provided by CPFHub.io (“CPFHub.io”, “we”) to the Customer (“Customer”, “you”). The purpose of this instrument is the provision of services for the lookup and verification of biographical data for fraud prevention, regulatory compliance and digital onboarding.

By creating an account, accessing the API or using any CPFHub.io service, the Customer declares that they have read, understood and fully accepted these Terms. If the Customer does not agree with any provision, they must not use the services.

2. Capacity and eligibility

CPFHub.io services are intended exclusively for individuals aged 18 (eighteen) or older with full legal capacity and for duly incorporated legal entities, represented by someone with authority to contract on behalf of the company (Brazilian Civil Code, arts. 3, 4 and 5).

By accepting these Terms, the Customer expressly declares that:

• they are 18 (eighteen) years old or older, or are emancipated under art. 5, sole paragraph, of the Civil Code,
• they are not subject to any guardianship, interdiction or court-ordered restriction that limits their capacity to contract,
• the information provided at signup is true, complete and up to date.

A false declaration of capacity renders the contract null and void by operation of law (art. 166, I, of the Civil Code), subjecting the Customer to immediate closure of the account, full compensation for any damages and refund of the amounts paid, without prejudice to other applicable legal measures. CPFHub.io reserves the right to request supporting documents at any time to verify identity and capacity.

3. Customer responsibilities

The Customer assumes, without restriction and jointly and severally, the following obligations:

• Legitimate purpose: use the data obtained exclusively for the purposes set out in these Terms and in applicable law, in particular identity verification, fraud prevention and regulatory compliance.
• Regulatory compliance: ensure that every lookup made has an adequate legal basis under the LGPD (Law 13.709/2018, Brazil's data protection law) and other rules applicable to the Customer's sector.
• Credential security: keep API keys and other access credentials strictly confidential, being fully responsible for any use made with their credentials, whether authorized or not.
• Up-to-date records: keep registration, contact and billing data up to date at all times, under penalty of preventive suspension.
• Compliance with the Felca Law: when use of the API involves age verification of end users, the Customer declares that it complies with Law 15.211/2025 (“Felca Law”/“ECA Digital”, Brazil's digital child protection law) and is solely responsible for meeting the resulting legal obligations.

4. Acceptable use policy

CPFHub.io exists to help companies confirm identities and prevent fraud. To protect the people whose data is queried, and the service itself, some uses are not allowed. If any of them occurs, CPFHub.io may suspend or terminate the account, under Clauses 9 and 10.

You may not use the services to:

• sell or pass on data as a product, for example lists, databases, registries or files built from API lookups,
• engage in data mining or enrichment of databases for marketing or prospecting, including using data obtained through the API (such as date of birth) for promotional campaigns, birthday campaigns, audience segmentation or customer prospecting,
• run reverse lookups, that is, finding someone's CPF (Brazil's individual taxpayer ID) from their name or other data,
• run lookups without a legitimate purpose and without a legal basis: every lookup must have a legitimate reason (such as identity verification, signup, fraud prevention or compliance with a legal obligation) and an adequate legal basis under the LGPD, as set out in Clause 3,
• conduct surveillance, unauthorized monitoring or tracking of people,
• engage in unlawful or fraudulent activities, or activities that violate third-party rights,
• try to access, without authorization, systems, data or infrastructure of CPFHub.io or of third parties,
• perform load tests, stress tests or scraping at volumes above the contracted limits or that harm other customers,
• make any use that violates the LGPD, the ECA (Law 8.069/1990, Brazil's Child and Adolescent Statute), the Felca Law (Law 15.211/2025) or other applicable sector rules.

Integrating the API into your own product is not reselling data. Using CPFHub.io inside your software, system or SaaS to serve your own customers is allowed, under the conditions of Clause 4-A.2. Offering lookups to third parties as a product (resale) is also welcome, through the Partnership Program in Clause 4-A.3.

4-A. Integration, partnerships and resale

4-A.1. Partners are welcome. CPFHub.io works with partners, for example business management software companies (ERPs) and other platforms, that bring CPF lookup to their own customers. This clause explains in plain terms what is already allowed to any Customer and how the Partnership Program works.

4-A.2. Integration into your own product (embedded use) is allowed. The Customer may integrate the API into their own software, system or SaaS and use it to serve their own customers, for example by offering, inside the system, a “look up data by CPF” function in the signup flow. This use is not resale of data and does not require additional authorization, provided that the Customer:

a) uses the lookup only for a legitimate purpose, under Clause 3 (such as signup, identity verification and fraud prevention), and never for the uses prohibited in Clause 4, b) passes on to their customers, by contract or their own terms of use, the same rules of these Terms on purpose, legal basis and prohibited uses, and defines with them the roles and responsibilities of each party under the LGPD, c) answers to CPFHub.io for all lookups made with their account, including those triggered by their customers, d) keeps API keys only in their own environment (server), without exposing them or handing them to their customers, e) stores results only for the time needed for the purpose that motivated the lookup and for the applicable legal periods, with adequate security, and f) does not make the lookup available as a standalone product to third parties, nor allows their customers to run mass lookups or lookups unrelated to the normal use of their system. Offering the lookup as a product is resale, addressed in item 4-A.3.

4-A.3. Partnership Program (resale). Anyone who wants to offer the lookup to third parties as a product, for example by reselling credits or access, is welcome in the CPFHub.io Partnership Program, which has special conditions for partners. There are two formats:

a) Resale (wholesale): the partner acquires credits on wholesale terms and resells them at the price the partner sets, usually as part of a more integrated offer, or

b) Separate account: each end customer keeps their own CPFHub.io account, accepts these Terms and uses their own credentials, and the partner only handles the technical integration.

Participation in the Program is formalized by a simple agreement or by written confirmation from CPFHub.io (an email is enough). The commercial terms of each partnership are set out in that agreement or confirmation, not in these Terms. To take part, contact the sales team at parcerias@cpfhub.io.

4-A.4. Rules that apply to integrators and partners. In either of the formats above, the Customer or partner:

a) follows, and makes their customers follow, the limits in Clause 4, in particular: no sale of lists or databases, no enrichment for marketing or prospecting and no reverse lookup, b) ensures that every lookup has a legitimate purpose and an adequate legal basis, c) passes these rules on to their customers by contract or their own terms, d) remains responsible for how their customers use the service contracted through them, and e) does not present their customers, themselves or the service as being CPFHub.io, nor use the CPFHub.io brand in a way that suggests a relationship different from the real one, unless the partnership agreement authorizes it.

4-A.5. Support and questions. If in doubt about whether a business model is “embedded use” or “resale”, the Customer may consult CPFHub.io before starting, using the contact above. CPFHub.io will reply in writing.

5. Service level (SLA) and maintenance

• Availability: CPFHub.io will use its best efforts to maintain the monthly availability indicated for the contracted plan on the pricing page (https://www.cpfhub.io/precos) or in a specific contract, excluding scheduled maintenance windows announced at least 24 hours in advance. This percentage varies by plan.
• Technical logs: the Customer consents to CPFHub.io keeping technical request records for up to 12 months, an essential condition for support, security audits and fixing integration failures.
• API changes: CPFHub.io may update or discontinue endpoints with 30 days' prior notice, except in cases of force majeure, legal requirement or imminent security risk.

5-A. Registration status lookup at Receita Federal (optional service)

5-A.1. What it is. CPFHub.io may offer, as an optional service and when available, a lookup that returns the same result shown in the public CPF registration status lookup on the website of Receita Federal (Brazil's federal tax authority), such as: the CPF registration status, an indication of death, when available at the source, and a control code or lookup proof. While the service is not available in the CPFHub.io dashboard and documentation, this clause does not apply.

5-A.2. Fields depend on the official source. The fields returned, the data required to run the lookup and the response format depend on the official source and may change outside CPFHub.io's control. For example, RFB Ordinance No. 667/2026, in force from October 3, 2026, removes the year of death from the official CPF lookup annex and starts requiring the CPF and the date of birth as lookup arguments. For this reason, this lookup may require the holder's date of birth as input data.

5-A.3. Date of birth provided by the Customer. When the lookup requires the date of birth, the Customer declares that they obtained this information lawfully, for a legitimate purpose and on an adequate legal basis, and that they use it only to run the lookup.

5-A.4. Changes imposed by the source. If the official source changes, adds or removes fields, changes the data required for the lookup or becomes unavailable, CPFHub.io may adjust the service to reflect those changes, notifying the Customer as soon as possible. Those changes do not constitute a breach of these Terms by CPFHub.io.

5-A.5. What the proof means. The control code or proof only reflects what the official source displayed at the time of the lookup. It is not a certificate, is not a document issued by Receita Federal through CPFHub.io and does not replace the official document. Anyone who needs an official document must obtain it directly from Receita Federal.

5-A.6. How to present the result. The Customer must not present the result of this lookup as if it had been issued by CPFHub.io on behalf of Receita Federal, nor state or suggest that CPFHub.io is an official, accredited or approved partner of Serpro or Datavalid. CPFHub.io is not authorized or approved by Serpro or Datavalid.

5-A.7. Price. This lookup uses credits according to the pricing page (https://www.cpfhub.io/precos).

5-A.8. Availability. This lookup follows the service level of the contracted plan, set out in Clause 5, with no additional availability commitment. Because it depends on an external source, unavailability or slowness of the official source falls under Clause 7, item (iii).

5-A.9. Other rules. All other rules of these Terms apply to this lookup, in particular Clauses 3 (Customer responsibilities), 4 and 4-A (acceptable use and partnerships), 7 (limitation of liability) and 8 (data protection).

6. Intellectual property

All rights in the API, algorithms, source code, trademarks, documentation and other intellectual assets belong exclusively to CPFHub.io or its licensors.

The contract grants the Customer a temporary, revocable and non-exclusive license of use, for the purposes set out in these Terms. This license allows the Customer to:

a) use the services in their own systems and products to serve their own end customers, under Clause 4-A.2, and

b) when taking part in the Partnership Program, offer the lookup to third parties under Clause 4-A.3 and the respective agreement or written confirmation.

The account, the access credentials and the contract belong to the Customer and may not be assigned, transferred or sublicensed to third parties outside the cases above without the prior written consent of CPFHub.io.

7. Limitation of liability

CPFHub.io uses official and private sources and applies rigorous technical controls to deliver lookups with high accuracy. The information returned reflects the state of the data available in the source databases at the time of the lookup. Any discrepancies result from updates to those databases that occur independently and outside CPFHub.io's control. The service is a decision-support tool and does not replace the Customer's internal KYC (know your customer) processes.

CPFHub.io will not be liable for: (i) business decisions made based on the data provided, (ii) indirect damages, loss of profits or consequential damages arising from the use of, or inability to use, the services, (iii) failures caused by fortuitous events, force majeure or unavailability of external data sources.

8. Data protection and LGPD responsibilities

For the purposes of the Brazilian General Data Protection Law (Law 13.709/2018):

• Own operational data: CPFHub.io acts as controller of the registration, billing and platform usage data provided by the Customer.
• Lookup data via API: CPFHub.io acts as processor (art. 42, §1, LGPD), processing personal data on the Customer's instructions. The Customer is the controller and primarily responsible for the lawfulness of each lookup, including obtaining consent or another legal basis from data subjects (LGPD, art. 7).
• Data of minors: the Customer is solely responsible for compliance with art. 14 of the LGPD and the Felca Law (Law 15.211/2025) in relation to data of children and adolescents. The Customer declares that it has the mechanisms required by law to prevent minors from accessing its platform or, where applicable, to process such data with the consent of their guardians.
• Security incidents: each party will notify the other, within a maximum of 72 hours, of any incident that may affect the data covered by this contract.

CPFHub.io reserves the right to request evidence of regulatory compliance from the Customer at any time. Refusal to provide such evidence may result in preventive suspension of the account.

9. Term and termination

The service is provided under a monthly subscription, automatically renewed at each billing cycle. The Customer may cancel the subscription at any time through the dashboard, without prior notice. Access remains active until the end of the period already paid, with no refund of that cycle's amount and no new subscription charges, except for any overage amounts generated by use during that period.

CPFHub.io may terminate the contract without cause upon 30 (thirty) days' prior notice, with a pro rata refund of amounts paid for the unused period. In the cases of termination for cause set out below, termination is immediate and without any obligation to refund:

• material breach of any provision of these Terms,
• false declaration of capacity or identity at signup,
• default on the current billing cycle,
• use of the API for purposes expressly prohibited in Clause 4,
• a security incident caused by an act or omission of the Customer,
• a court or regulatory order that prevents continuation of the service,
• insolvency, bankruptcy or judicial reorganization of the Customer,
• repeated infringement after formal notice,
• proven risk of legal, regulatory or reputational harm to CPFHub.io.

10. Preventive suspension

CPFHub.io may suspend the Customer's access immediately and without prior notice when there is evidence or well-founded suspicion of any of the situations below (Marco Civil da Internet, Brazil's Internet Civil Framework, art. 19, and STJ case law, 2024):

• fraud, abuse or use in breach of these Terms,
• imminent risk to the security of the platform or of third parties,
• suspected violation of the LGPD, the ECA or the Felca Law,
• an irregular, anomalous or technically suspicious usage pattern,
• a court or regulatory order,
• suspected use of the account by a minor or a person without legal capacity,
• incomplete, outdated or fraudulent registration information.

Preventive suspension does not constitute termination of the contract nor default by CPFHub.io. The Customer may submit clarifications within 5 (five) business days from notification. If the irregularity is confirmed, CPFHub.io may convert the suspension into permanent termination, with or without a refund depending on the case.

11. Right of refusal and discretion

CPFHub.io reserves the right to refuse, limit or discontinue the provision of services to any Customer, at any time, for a legitimate business reason, without the need for a detailed justification, under the Economic Freedom Law (Law 13.874/2019) and art. 421-A of the Civil Code.

In cases of refusal or termination without cause at CPFHub.io's initiative, a pro rata refund of amounts paid for the unused period will be made, if applicable.

12. Indemnification

The Customer will indemnify and hold harmless CPFHub.io, its partners, employees and service providers from any losses, damages, regulatory fines, attorneys' fees and court costs arising from: (i) breach of these Terms, (ii) misuse of data obtained through the API, (iii) non-compliance with the LGPD, the ECA, the Felca Law or other applicable rules, (iv) a false declaration at signup.

13. Changes to the terms

CPFHub.io may update these Terms at any time, publishing the new version on this page with the effective date. The Customer will be notified by email at least 15 days in advance of material changes. Continued use of the services after the new version takes effect means full acceptance of the changes.

14. General provisions

• Governing law: this instrument is governed exclusively by the laws of the Federative Republic of Brazil.
• Venue: the courts of the Judicial District of Florianópolis, SC, are elected to settle any disputes, with express waiver of any other, however privileged.
• Severability: the nullity or ineffectiveness of any provision will not affect the validity of the others.
• No waiver: CPFHub.io's tolerance of any breach of an obligation will not imply novation, waiver or alteration of the rights established here.