Privacy Policy

Last updated: June 28, 2026

Xfindem is a civic platform that helps locate missing persons. This policy describes how we handle your personal data under Brazil's General Data Protection Law (LGPD — Law 13.709/2018) and the European Union's General Data Protection Regulation (GDPR).

1. Data controller

Xfindem is the controller of personal data collected through the platform. To exercise your rights, contact privacy@xfindem.com.

2. Data we collect

  • Account: name, email, hashed password.
  • Poster verification: ID document, organization, relationship to the missing person.
  • Published cases: data about the missing person (name, age, photos, location, context).
  • Sightings: location, description, optional photo, optional reporter email.
  • Geo alerts: email, coordinates, and notification radius.
  • Technical data: IP address, user agent, essential cookies.

3. Purposes and legal basis

  • Public mission / legitimate interest: publicizing missing-person cases.
  • Consent: sending geographic alerts by email.
  • Legal obligation: complying with law-enforcement requests.

4. Data sharing

Published cases are public by nature — that is the purpose of the platform. ID documents are seen only by our moderation team. We may share data with law enforcement upon formal request.

5. Subprocessors

  • Lovable Cloud / Supabase: database and storage.
  • Resend: transactional email delivery.
  • OpenStreetMap: map tiles.

6. Retention

ID documents are deleted 90 days after approval. Closed cases are anonymized after 12 months, unless the family requests they remain visible.

7. Your rights

You have the right to access, rectify, delete, object to processing, port your data, and withdraw consent. Send requests to privacy@xfindem.com. You may also file a complaint with the ANPD (Brazil) or your national data protection authority (EU).

8. Security

We use TLS in transit and encryption at rest, role-based access control, and database Row-Level Security. ID documents are stored in private storage accessible only to authorized administrators.

9. Minors

Xfindem frequently publishes cases of missing minors with family/guardian authorization. Account creation is restricted to people 18 and older.

10. Changes

We will notify registered users of material changes by email.