Privacy Policy

• ForensicCorp SpA
• RUT: 78.XXX.XXX-X
• Santiago, Chile
• dpo@forensic.cl
• Data Protection Officer (DPO): dpo@forensic.cl

We process the following data in the context of the service:

• Account data: name, email address, password hash (Argon2id).
• Report data: information voluntarily provided by the reporter, encrypted with AES-256-GCM.
• Service usage data: aggregate usage metrics (without individual user identification).
• Minimal technical data: system logs without IP or User-Agent on public portal routes (zero-knowledge).

• Provide the whistleblowing channel service in accordance with Chilean law.
• Manage internal investigations with digital chain of custody.
• Send communications related to service status and legal compliance.
• Improve the platform through aggregated and anonymized statistical analysis.

Processing is based on the legitimate interest of the controller and compliance with legal obligations applicable to the whistleblowing channel. For sensitive data, explicit consent of the data subject is obtained.

• Karin Law reports and investigation records: 5 years from closure.
• User account data: for the duration of the contract + 30 days for portability.
• Encrypted backups (Supabase): maximum 90 days with automatic rotation.
• Immutable audit logs: 5 years (HMAC-SHA256 append-only chain).

To provide the service, we use the following sub-processors located outside Chile:

• Vercel Inc. (USA) — Frontend infrastructure and deployment.
• Supabase Inc. (USA) / AWS sa-east-1 (Brazil) — PostgreSQL database.
• Resend Inc. (USA) — Transactional email service.
• Intuition Machines Inc. / hCaptcha (USA) — We use hCaptcha on the public reporting portal to prevent automated submissions. hCaptcha processes your IP address, browser type (user-agent) and behavioral signals to distinguish real users from bots. It does not share or store the content of your report. Legal basis: legitimate interest in channel security (equivalent to art. 13(f) Law 21.719). More info: hcaptcha.com/privacy.

All transfers are conducted under standard contractual clauses (SCCs) or other recognized mechanisms.

You have the right to:

• Acceso: Access: know what data we process about you.
• Rectificación: Rectification: correct inaccurate data.
• Cancelación / Supresión: Erasure: request deletion of your data.
• Oposición: Objection: object to certain processing.
• Portabilidad: Portability: receive your data in a structured format.

To exercise these rights, write to dpo@forensic.cl.

Note: data linked to active investigations under Chilean law may be subject to erasure restrictions during the legal retention period.

We implement AES-256-GCM encryption at rest, TLS 1.3 in transit, Argon2id for passwords, immutable audit log with HMAC-SHA256 chain, tenant data separation and role-based access control (RBAC).

If you believe that the processing of your data violates regulations, you can file a complaint with the Chilean National Data Protection Agency (ANDP).