Privacy policy

Who operates it and who decides

The platform is operated by ViaLabs (vialabs.tec.br). The privacy contact is contato@vialabs.tec.br.

The building, company, club, or other place that enrolls people decides who may enter and which data that requires. That place is the controller of those records. ViaLabs processes the data to provide the service to that place.

Member data

The place's manager creates the record. The member signs in with a link sent to their email. The member app has no password.

• Name, email, and phone if the place provides one.
• CPF (Brazilian tax id) when the place asks for it. The document is stored encrypted.
• Proximity-card identifier, stored encrypted. Lookup uses a code that is not the card number.
• Profile photo, if the place or the member provides one.
• A numeric face template, if the place uses face recognition. It is not a photo.
• This device's notification token, only if the person turns on door-open alerts.
• A passage record: who, when, which door, entry or exit, and the method (app, QR, card, or face).

Manager and technician data

People who administer the place sign in with email and password. The password is stored only as a hash. One email can administer more than one place; the password is checked before those place names are shown.

During installation, the building Wi-Fi password is sent to the reader so it can join the network. That password is not stored on the technician's cloud profile.

What the phone does

The member app camera is used only to read the door QR. The image is not uploaded or stored.

Bluetooth checks whether the phone is near the door sensor. In the technician app, it finds the reader during installation. We do not build a location history.

On Android, the system may ask for location permission so a Bluetooth scan is allowed. That permission is not used to track where the person goes.

Notifications are optional. If the person turns alerts on, we store the device token to say when the door stays open.

Face recognition

Face is optional. The same place can allow passage by app, QR, or card.

The reader at the door compares a numeric face template stored on that device's memory card. Identity keeps an encrypted copy of that set so the reader can be restored. The copy is not a photograph. It is not used for advertising, to train a general model, or for any purpose other than opening that place's door.

A face template is sensitive personal data. The place must tell the person before enrolling a face and must offer another way in for anyone who declines face recognition.

Why we use it

We use the data only to run access control for the place.

• Allow or refuse passage.
• Record attendance and what happened at the door.
• Email the sign-in link and a guest QR.
• Warn that a door stayed open when the person asked for that alert.
• Install and maintain readers.
• Bill the place's subscription, not the member inside the app.
• Protect the account and investigate misuse.

Legal basis

The account and the passage exist to perform the service the place hired. The door log serves the place's interest in security and attendance, limited to what passage requires.

For the face template, the basis is the person's consent or another ground under Brazil's general data protection law that the place can show, with the person's rights kept intact. ViaLabs does not process the face for a purpose other than passage at that place.

When a law requires a record to be kept, it stays for that legal period.

Who we share it with

We do not sell personal data, and we do not use it for third-party advertising.

• Managers and technicians of that place, to operate the doors and the directory.
• The door reader, with what it needs to decide passage: an identifier, the card code, and, if used, the face template on the device itself.
• Providers that host the application, the database, and email (sign-in links and guest invites).
• Apple, Google, or Expo, only to deliver a notification if the person turned alerts on.
• Stripe, for the place's subscription. ViaLabs does not store the full card number.
• A public authority, when the law requires it.

Where the data sits

The directory lives on ViaAccess Identity infrastructure. Hosting, the database, and email may be processed outside Brazil, only to run the service the place hired.

The reader installed at the door keeps the local policy. If the place uses face recognition, the template sits on that device's memory card, plus the encrypted copy in Identity.

How long we keep it

Directory data stays while the person is enrolled at the place. When the manager removes the person, the directory record, face template, card, photo, document, and notification token are removed.

Passage records already written may remain for as long as the place needs them for security and attendance. After deletion they do not open the door and are no longer tied to an active profile. Backup copies can take longer to disappear.

Your rights

You can ask for confirmation, access, correction, deletion, information about who received the data, and, where it applies, portability. You can also withdraw consent for face recognition. Withdrawal does not erase passages that already happened lawfully.

In the app, open Profile and tap Delete account. That removes the directory record at every place using this email: name, document, card, photo, face template, and notifications. A manager can also remove a member from the panel. If you cannot open the app, email contato@vialabs.tec.br. You can also complain to Brazil's national data protection authority (ANPD).

Children and teenagers

ViaAccess is not a service for a child to create their own account. If a place enrolls a minor, the person enrolling them must have authority to do so. Face recognition stays optional.

Changes

If this policy changes, the date at the top of this page changes with it. A new purpose for the face template requires telling the person again, done by the place that enrolled them.