Privacy policy for online photo processing

1. Data controller

The controller for the photo workflow is OnTimeDocs Photo Studio, operated from Brazil. Current operating address: Brazil-based processing operation. Update with the legal address before production launch.. Privacy contact: privacy@ontimedocs.ca.

2. Scope of data collected

We collect only the data needed to process the photo workflow and operate the service securely, including:

• The photo image that you upload or capture.
• The selected document profile and processing mode.
• Technical metadata such as browser, device type, IP hash, timestamps and security scan results.
• Support or complaint information that you send to us after placing an order.

3. Sensitive data and facial images

Facial images may be treated as sensitive personal data under Brazilian law depending on context and use. For that reason, we apply heightened safeguards, restrict retention, avoid unrelated reuse and do not use the uploaded image for identity matching, advertising audiences or third-party profiling.

4. Purposes and legal bases under LGPD

We process personal data for the following purposes and legal bases:

• To perform the requested service, analyse the image, generate exports when allowed, and issue the receipt.
• To comply with legal and tax obligations related to service records and receipts.
• To prevent abuse, fraud, malware uploads and service misuse based on legitimate interest and security obligations.
• To answer support requests, complaints and review requests related to automated decisions.
• Where required, based on your consent, especially for optional communications beyond the core service.

5. Automated analysis and your rights

The platform uses automated diagnostics to classify framing, lighting, sharpness, background consistency and whether cleanup is allowed for the selected profile. This result is operational guidance only. You may request human review or clarification by contacting hello@ontimedocs.ca.

6. Sharing of data

We do not sell uploaded photos. Data may be shared only when necessary with:

• Infrastructure and hosting providers acting under confidentiality and security obligations.
• Professional advisers, support providers or legal representatives when needed to operate the service or defend claims.
• Public authorities when disclosure is legally required.

7. International transfers

Because this service is operated from Brazil and may serve users abroad, personal data may be accessed or transferred across borders. Whenever that happens, we adopt safeguards compatible with the LGPD and applicable ANPD guidance, using contractual, technical and organisational controls appropriate to the receiving context.

8. Retention

Uploaded photo assets are kept for up to 30 days unless a shorter period is technically possible or a longer period is required for a dispute. Receipts and essential service logs may be retained for up to 5 years or longer if law requires it.

9. LGPD rights

You may exercise the rights available under the LGPD, including:

• Confirmation of the existence of processing.
• Access to your data.
• Correction of incomplete, inaccurate or outdated data.
• Anonymisation, blocking or deletion when applicable.
• Data portability where legally and technically feasible.
• Information about data sharing.
• Withdrawal of consent when consent is the legal basis.
• Review of decisions based solely on automated processing.

10. Minors

This workflow is intended for adults, or for use by a parent or legal guardian on behalf of a minor.

11. Contact

Support: hello@ontimedocs.ca
Privacy and LGPD requests: privacy@ontimedocs.ca