Privacy Policy

TextForense is a text-analysis application that uses artificial intelligence to identify linguistic, behavioral and stress-related patterns in text, transcripts and statements provided by the user.

For your own account data (sign-up, usage, billing), we act as controller. For the content you submit for analysis (text, audio, transcripts), we generally act as processor, handling that content solely to generate the report you requested — see Section 6 on third-party data included in that content.

We collect the following personal data, to the extent necessary to operate the service:

• Account data: name, email and password (stored using a cryptographic hash, never in plain text).
• Usage and account data: history of analyses performed, subscribed plan and subscription status.
• Financial data: transaction and invoice records, processed by our payment partner (Stripe) — we do not store full credit card numbers on our servers.
• Content submitted for analysis: text, transcripts and audio you voluntarily submit, which may contain personal data about you or about third parties mentioned in the content (see Section 6).
• Technical data: IP address, device type, browser and access logs, for security, support and fraud-prevention purposes.
• Preferences: selected language and other interface preferences, stored locally in your browser.

We do not intentionally collect special categories of data (racial or ethnic origin, religious belief, political opinion, health or sex-life data, genetic or biometric data). If content you submit for analysis contains this type of information, it is handled under the rules in Section 6.

• Providing the service (processing submitted text, generating the Truth Score and the report) — performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)) / consent or contractual necessity (POPIA); "consent" and "compatible purpose" (PIPEDA).
• Processing payments and managing subscriptions — performance of a contract and compliance with a legal obligation (issuing invoices).
• Keeping your analysis history in your account — performance of a contract and your legitimate interest in accessing past reports.
• Security, fraud and abuse prevention — legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)) and compliance with a legal obligation.
• Complying with legal and regulatory obligations (tax, accounting, requests from competent authorities) — compliance with a legal obligation.
• Improving the quality, accuracy and security of the service — legitimate interest, whenever possible using aggregated or anonymized data.
• Service-related communications (account notices, policy changes, billing) — performance of a contract and compliance with a legal obligation.

Where the applicable legal basis requires consent (for example, for marketing communications, should they exist), it will be requested specifically, clearly and can be withdrawn at any time.

TextForense uses a rules engine and artificial intelligence to generate scores (such as the "Truth Score"), stress indicators and suggestions about psychological defense mechanisms from the submitted text. This constitutes a form of automated processing with analytical effects under LGPD art. 20, GDPR art. 22, and equivalent provisions of POPIA and Angola's LPDP.

• The generated report is a support tool for human investigation or analysis — it is not an expert forensic opinion nor an automated decision with a definitive legal effect on any person.
• You (the account holder) may request, at any time, an explanation of the general criteria used by the analysis engine, by contacting us through the channels in Section 12.
• No decision generated by TextForense should be used, on its own, as the sole basis for decisions producing legal effects or significant impacts on a person (e.g., dismissal, denial of a benefit, a judicial decision), without human review.

We only use cookies and local storage that are strictly necessary for the site to function (for example, to remember the state of interface components and your chosen language) and the session tokens required to keep you signed in. We do not use advertising cookies or third-party cross-site tracking. Because these cookies are essential to the service, they do not require prior consent under the GDPR (art. 5(3) of the ePrivacy Directive) or under the LGPD.

When you paste a text, a transcript, or record audio for analysis, that content commonly mentions or is the speech of other people (for example, an interviewee, a suspect, a job candidate). Those people are also data subjects under the LGPD, GDPR, POPIA, PIPEDA and Angola's LPDP.

• By submitting content containing third-party data, you represent that you have a legal basis and, where required by the law applicable to your case, the consent or another appropriate legal basis to process that information and to share it with TextForense for analysis purposes.
• TextForense handles that content as a processor, solely to generate the report you requested, without using it for any purpose of its own.
• If you are the person mentioned in an analysis submitted by another user and wish to exercise your data subject rights over that content, please first contact the user who submitted the analysis; if that is not possible, contact us through the channels in Section 12 and we will do our best to assist within our role as processor.

We do not sell personal data. We share strictly necessary data with service providers that help us operate the platform, always under contractual confidentiality and security obligations (Data Processing Agreements), including:

• Database, authentication and hosting infrastructure (Supabase);
• Payment processing and billing (Stripe);
• Cloud providers hosting the application (e.g., Vercel).

These providers may process data on servers located outside your country of residence, including the United States and the European Union. In those cases, we adopt safeguards recognized under the applicable laws, such as:

• GDPR: Standard Contractual Clauses or a European Commission adequacy decision (art. 44–46);
• LGPD: specific contractual clauses, contractual guarantees or seals/certifications recognized by the ANPD (art. 33);
• POPIA: ensuring the recipient is subject to a law, binding agreement or binding corporate rules that provide substantially similar protection (section 72);
• LPDP (Angola): authorization from the Data Protection Agency where required, and verification that the destination country ensures an adequate level of protection (art. 33);
• PIPEDA: comparable contractual protection required from the third-party organization, while we remain accountable for the transferred data.

• Account data and analysis history: kept while your account remains active.
• Content submitted for analysis: kept while the report remains saved in your history; you may delete it at any time.
• Billing and tax records: retained for the period required by applicable tax and accounting law, even after account closure.
• Technical access/security logs: retained for as long as necessary for security purposes and as required by applicable record-keeping laws.

Once the applicable retention period ends, data is deleted or irreversibly anonymized.

We adopt technical and organizational measures consistent with the state of the art, including encryption in transit (TLS) and at rest, secure authentication, Row Level Security policies that ensure each user can only access their own data, and internal access controls restricted to those who need the data to provide the service.

In the event of a security incident that may pose a relevant risk to data subjects, we will notify the competent authorities and affected data subjects within the timeframes required by applicable law (for example, GDPR art. 33–34 and LGPD art. 48).

Regardless of which law applies to your case, you may, at any time and upon request, exercise the following rights:

• Confirm whether processing exists and access your personal data;
• Correct incomplete, inaccurate or outdated data;
• Request deletion of your data and your account, directly from the "My Account" area;
• Request portability of your data to another service provider;
• Obtain information about who we share your data with;
• Withdraw consent and object to processing based on it or on legitimate interest;
• Request a review of decisions made solely on the basis of automated processing;
• Lodge a complaint with the competent data protection authority (see Section 11).

You may lodge a complaint with the data protection authority of your country, including:

• Brazil: Agência Nacional de Proteção de Dados (ANPD).
• European Union/EEA: the supervisory authority of your country of residence (coordinated through the European Data Protection Board — EDPB).
• South Africa: the Information Regulator (South Africa).
• Canada: the Office of the Privacy Commissioner of Canada (OPC).
• Angola: the Agência de Proteção de Dados (APD).

The fastest way to access, correct or delete your account data and analysis history is directly through the "My Account" area within the app. For any other request related to this policy — including requests from data subjects mentioned in content submitted by other users (Section 6) — contact our data protection officer at privacy@textforense.ai. We respond within the timeframes required by the law applicable to your case (generally, up to 15 business days under the LGPD, extendable, and up to 30 calendar days under the GDPR).

Under LGPD art. 41 and GDPR art. 37, the Data Protection Officer (DPO) is the legal entity Brasileiro Sem Fronteiras LLC, responsible for handling data subject requests and communicating with the competent data protection authorities, reachable at privacy@textforense.ai.

TextForense is not intended for individuals under 18 and we do not knowingly collect data from children or minors. If we become aware that an account belongs to a minor without verifiable parental or guardian consent, we will take steps to close the account and delete the corresponding data.

When you delete your account, your personal data, analysis history and subscription are permanently removed from our active database, except for information we must retain due to a legal obligation (e.g., tax billing records), per the periods described in Section 8.

We may update this Privacy Policy periodically to reflect changes to the service or to applicable law. The last-updated date is always shown at the top of this page. Material changes will be communicated by email or by a prominent notice in the app before they take effect.