Privacy Policy

Version 5.0 | Published on October 9, 2026, effective October 24, 2026

1. Who we are and who this policy applies to

CPFHub.io is an identity validation and fraud prevention platform operated by LIGLU DESENVOLVIMENTO DE SISTEMAS LTDA., registered with CNPJ under No. 10.903.481/0001-07, headquartered in the state of Santa Catarina, Brazil (“CPFHub.io”, “we”).

This policy explains, in compliance with the Brazilian General Data Protection Law (LGPD, Law 13.709/2018), how we process the personal data of two groups of people:

• Customers and platform users: companies and professionals who create an account and use the dashboard and the API,
• Holders of CPFs looked up: people whose data is verified by our Customers to confirm identity and prevent fraud.

Our purpose is simple: to help companies confirm that a person is who they claim to be, protecting each data subject against misuse of their CPF by third parties.

2. Roles in data processing

Responsibilities follow arts. 5, 37, 39 and 42 of the LGPD:

• CPFHub.io as controller:
  • of the registration, billing and platform usage data provided by Customers,
  • of its validation database, described in section 4, used exclusively for identity validation and fraud prevention.
• CPFHub.io as processor: when running each lookup sent by a Customer, we process the data provided (such as the CPF and, where applicable, the date of birth) following the Customer's instructions. In this role, the Customer is the controller and is responsible for the legal basis of the lookup toward its users.

3. Data of Customers and platform users

• Data: name, company, email, phone number, billing data, IP address, access and platform usage records (such as the account's lookup history).
• Purposes: creating and managing the account, providing the service, billing credits, support, security and abuse prevention, communications about the service and compliance with legal and tax obligations.
• Legal bases: performance of a contract (art. 7, V), compliance with a legal or regulatory obligation (art. 7, II) and legitimate interest in platform security and fraud prevention (art. 7, IX).
• Marketing communications: we only send promotional messages through channels in which the Customer has authorized contact, and it is possible to unsubscribe at any time.

4. Validation database

4.1. What it contains

CPF, full name, date of birth and gender, and, where applicable, CPF registration status and an indication of death. We do not process sensitive, financial, address or location data in the validation database.

4.2. Source of the data

The data comes from the following categories of source:

1. Licensed private providers: specialized companies that license registration data to us by contract, with a guarantee of lawful collection and authorization for use in identity validation and fraud prevention. For reasons of trade secrecy, we do not publicly disclose the names of the providers. We inform the category of the source to any data subject who requests it.
2. Official public sources: public lookups made available by official bodies, such as the CPF registration status at Receita Federal, used to revalidate the data and keep it accurate.
3. Verified lookup results: when a Customer's lookup is confirmed at an official source, the result may update the database, keeping it correct for all Customers. Data sent by Customers that has not been confirmed is not incorporated.

The gender field, when not provided by the source, is estimated statistically from the first name and does not represent a statement by the data subject.

4.3. Purpose and legal basis

The validation database is used for validating identity and registration data, for purposes such as:

• signup validation and onboarding,
• preventing fraud and the use of another person's CPF,
• authentication and data confirmation during customer service,
• risk analysis in transactions with the data subject,
• updating records our Customers already keep,
• meeting legal and regulatory obligations,
• the regular exercise of rights.

The legal basis is the legitimate interest of CPFHub.io and its Customers in the security of these relationships, which also protects the data subject against misuse of their CPF (art. 7, IX, and art. 10 of the LGPD).

4.4. Our commitments

• we do not sell lists, databases or registries of personal data,
• the validation database is not used for marketing or prospecting,
• we do not return sensitive, financial, address or location data,
• our Customers and authorized partners follow the same purposes, as set out in the Terms of Use.

5. Real-Time Lookup at Receita Federal

When the Customer uses the Real-Time Lookup, we send to the Receita Federal public lookup the CPF and the date of birth provided by the Customer, who declares that they obtained them lawfully. We return the result displayed by the official source: name, registration status, indication of death (when available), date and time of issue, control code and a lookup proof.

The proof reflects what the official source displayed at that moment and can be checked through Receita Federal's own validation link. The available fields depend on the official source and may change at its discretion.

Deceased persons: the indication of death is handled with the same care given to the other data, because its very purpose is to prevent the CPF of someone who has died from being used in fraud.

6. Sharing and international transfer

We share personal data only when necessary:

• with the Customer who made the lookup, who receives the validation result,
• with authorized partners, who offer the lookup to their own customers, including under their own brand, following the same rules,
• with service providers that support our operation, such as hosting and infrastructure, payment processing, email delivery, customer service and browsing analytics, always under contract and with confidentiality and security obligations,
• with authorities, when required by law or court order.

The API and the validation database are hosted in Brazil. Some service providers linked to the Customer's account (such as payments, email and browsing analytics) may process data in other countries. In these cases, we adopt the safeguards provided for in art. 33 of the LGPD, such as contractual data protection clauses.

7. Cookies and similar technologies

Our website uses cookies and similar technologies in three categories:

• Necessary: keeping the session, security and your preferences (including your choice about cookies), and recording, with our own cookies, the source of the visit (for example, the campaign or referral link) to correctly attribute the signup. They do not depend on consent.
• Measurement: understanding how pages are used and improving the experience.
• Marketing: measuring the effectiveness of our ads, including with tools from advertising partners.

Measurement and marketing cookies are only activated after you accept them in the cookie notice. You can decline without affecting your use of the website, and you can also manage cookies in your browser settings.

8. Retention and disposal

We keep data only for as long as necessary for the purposes of this policy (art. 6, III, and art. 16 of the LGPD):

• Account data and lookup history: while the account is active. When the account is deleted, the history is deleted, except for data we need to keep due to a legal obligation.
• Billing and tax data: for the periods required by tax legislation.
• Technical and access records: for up to 12 months, for security, diagnostics, abuse prevention and compliance with the Marco Civil da Internet (Law 12.965/2014, Brazil's Internet Civil Framework).
• Real-Time Lookup proofs: for as long as necessary for the Customer to check them and to prove the lookup, for up to 5 years.
• Validation database: while necessary for the purpose of fraud prevention, with continuous review and updating.

At the end of these periods, the data is deleted or anonymized.

9. Information security

We adopt technical and organizational measures proportional to the risks of the processing (art. 46 of the LGPD), including:

• encryption in transit (TLS 1.2 or higher) and data stored on infrastructure with encryption at rest,
• API access only with an individual key per Customer and least-privilege access control for the team,
• usage limits per account, signup checks and mechanisms to identify and block abuse,
• audit records of administrative operations.

10. Security incidents

In the event of a security incident that may cause relevant risk or harm to data subjects, CPFHub.io will notify the National Data Protection Authority (ANPD), the affected data subjects and the Customers involved, within the deadlines and in the manner set by ANPD regulations (LGPD, art. 48). The Customer undertakes to notify CPFHub.io within 72 hours if it identifies an incident in its systems involving data obtained through the platform.

11. Data subject rights

Under arts. 18 and 19 of the LGPD, you may request:

• confirmation that we process your data,
• access to the data,
• correction of incomplete, inaccurate or outdated data,
• information about the source of the data (by source category) and about the entities with which we share data,
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the LGPD,
• portability, under the applicable regulations,
• objection to processing based on legitimate interest, which will be assessed under art. 18, §2, of the LGPD,
• review of decisions made solely on the basis of automated processing, where applicable. CPFHub.io does not make decisions about data subjects: the decision to approve or reject a signup is always the Customer's.

If your CPF was looked up on CPFHub.io, you can exercise these rights directly with us. To protect you, we may ask for information confirming your identity before responding, preventing third parties from obtaining your data through this channel.

Requests are answered within 15 days.

12. Data Protection Officer (DPO)

Data Protection Officer: Bernardo Rocha Contact: dpo@cpfhub.io

The Data Protection Officer is the communication channel between CPFHub.io, data subjects and the ANPD (LGPD, art. 41).

13. Data of children and adolescents

The platform is not intended for people under 18 as Customers. When lookups involve data of children or adolescents, the Customer, as controller, is responsible for complying with art. 14 of the LGPD and Law 15.211/2025 (ECA Digital), including obtaining the guardian's consent, when required, and age verification obligations. CPFHub.io may request evidence of this compliance.

14. Changes to this policy

This policy may be updated to reflect service improvements or regulatory changes. The current version is always published on this page, with its effective date. Each new version is published at least 15 days before it takes effect, and relevant changes are also announced to active Customers by email or in the dashboard. We recommend checking this page periodically.