LGPD

Neemias was designed with data protection built into the architecture. Below is the alignment with LGPD principles.

Personal Data Classification

Field	Data type	LGPD Classification	Purpose	Retention
displayName	Full name	Personal data	Student identification	While student is active
photoRef	Photo	Sensitive personal data (biometric)	Visual identification	While student is active
guardianName / guardianNameAlt	Guardian name	Personal data	Emergency contact	While student is active
birthDate	Date of birth	Personal data	Age calculation for class placement	While student is active
phones[].number	Phone	Personal data	Emergency contact	While student is active
address.* (7 fields)	Home address	Personal data	Registration and emergency	While student is active
allergies	Allergies	Sensitive personal data (health)	Child safety	While student is active
specialNeeds	Special needs	Sensitive personal data (health)	Pastoral accommodation	While student is active
imageConsent	LGPD consent	Sensitive personal data	Image use authorization	Permanent (audit)

Non-PII fields: studentId, classId, status, nucleus*, familyMembershipStatus, timestamps.

Image and Voice Use Authorization

Since June 2026, the app offers native support for the Minor Image, Voice, and Data Use Authorization Term, in compliance with:

• LGPD (Law 13.709/2018): legal basis of guardian consent (Art. 7, I combined with Art. 14, §1)
• Digital ECA (Law 15.211/2025): protection commitments on digital platforms

Registration flow

1. Admin/Data Entry opens the add student form
2. "Image Use Authorization (LGPD)" section displays:
   • Authorization checkbox
   • Guardian CPF and RG fields
   • Name and CPF of two witnesses
   • Upload of signed term (PDF or photo)
3. Upon saving, an imageConsent record is created in the imageConsents table in IndexedDB with ACTIVE status
4. The consent ID is linked to the student record (student.imageConsentId)

Revocation

The guardian may revoke authorization at any time via written request to the LGPD contact indicated in the institution's policy. Revocation does not affect processing already regularly performed (Art. 8, §5, LGPD).

Renewal

The term is valid while the minor participates in activities. A new consent may be registered at any time (creates a new record in the table, previous version archived).

Protection Measures

Data Minimization

Only essential fields are stored. The system does not collect unnecessary or excessive data. Soft-delete preserves audit history without exposing active data.

Encryption at Rest

Sensitive data in IndexedDB is encrypted with AES-GCM. The encryption key is derived from the user's password hash via PBKDF2. Fields such as changePayload and justification are stored only as ciphertext.

Access Control

• RBAC with 4 base roles + custom roles
• Only ADMIN accesses all student data
• CHAMADOR sees only name and status for attendance marking
• Audit: every mutation recorded via events table

Responsibilities (Controller vs Processor)

Role	Who is it	LGPD Responsibilities
Controller	Church / School (institution using the software)	Define purposes, obtain consent, respond to data subject requests, notify ANPD in case of incident
Processor	Neemias software maintainers	Ensure technical security of the software, process data according to controller's instructions, maintain operations record

The user institution (church/school) is the controller of the data under Art. 5, VI of LGPD. The software is the tool — responsibility for LGPD compliance lies with the institution operating the system.

Incident Response Flow

Step	Description	Deadline
1. Detection	Identification of leak, unauthorized access, or data loss	Immediate
2. Containment	Isolation of affected system, revocation of compromised tokens/passwords	24h
3. Investigation	Log analysis (local: IndexedDB, server: Cloudflare D1) to determine scope	48h
4. ANPD Notification	Communication to the National Data Protection Authority	72h (Art. 48, LGPD)
5. Data subject notification	Communication to guardians of affected students	72h
6. Remediation	Vulnerability correction, control improvement	7 days

Contact for reporting incidents: per SECURITY_CONTACT_EMAIL configured in the instance.

Data Subject Request Workflow (Art. 18 LGPD)

Right	How to exercise	App functionality
Access	Guardian requests from institution	Export student data (CSV/JSON) + consent record
Correction	Guardian requests correction of incorrect data	Field editing in admin interface
Deletion	Guardian requests removal (right to be forgotten)	Soft-delete student + consent revocation
Portability	Guardian requests data export	CSV/JSON export of all student data
Objection	Guardian contests processing of specific data	Image consent revocation
Consent revocation	Guardian cancels previous authorization	Revocation of imageConsent record

The institution must respond to the request within 15 days (Art. 19, LGPD).

LGPD → GDPR Equivalence

LGPD	GDPR	Differences
Art. 5 — Personal data	Art. 4(1) — Personal data	Equivalent
Art. 7 — Legal bases	Art. 6 — Lawfulness of processing	Equivalent (LGPD has one more basis: credit protection)
Art. 11 — Sensitive data	Art. 9 — Special categories	Equivalent
Art. 18 — Data subject rights	Art. 15-22 — Data subject rights	Very similar; LGPD includes explicit right of opposition
Art. 41 — DPO	Art. 37 — Data Protection Officer	Equivalent
Art. 48 — Incident notification	Art. 33 — Breach notification	Deadlines: 72h (LGPD and GDPR)
—	Art. 27 — Representative	GDPR requires EU representative if controller is outside

Due Diligence Checklist for Deployment

• [ ] Privacy policy published and accessible to parents/guardians
• [ ] Image use authorization term filled out and signed
• [ ] LGPD contact designated and disclosed
• [ ] Incident response procedure documented
• [ ] Consent record stored (imageConsents table)
• [ ] Access audit: who sees student data?
• [ ] Revocation tested: can parents request deletion?

Infrastructure

• Traffic: HTTPS required (Cloudflare)
• Storage: IndexedDB (client-side) + D1 (Cloudflare, US-based servers)
• Backups: D1 automatic daily backups
• Logs: No third-party tracking. No tracking cookies.
• Third-party providers: No student data is shared with third parties for commercial purposes

---

Source: packages/schemas/src/entities.ts (PII comments), .specs/project/STATE.md, app/src/db/types.ts (ImageConsent), docs/operations/storage-retention.md