Biometric privacy policy

Verifymy acts as a supplier to clients that own or operate certain websites, platforms, or services you may interact with. Users create a Verifymy account that lets them verify their identity with this and other participating Verifymy clients. As part of the initial identity verification and Verifymy account creation process, Verifymy:

• collects an image of you (a selfie) and an image of your identity document;
• processes the images, including by creating biometric scans of facial geometry from each one (“face maps”);
• uses the face maps to compare the selfie image with the image in the identity document for identity verification;
• also uses the selfie image and its face map to judge if the selfie image is of a live person or not;
• permanently destroys the identity document’s face map right after those checks;
• stores the selfie image and the identity document image (together, the “Reference Images”), and the selfie image’s face map (the “Reference Face Map”) in your Verifymy account to (i) use the Reference Face Map to support future biometric authentication, as described in the section below, and (ii) use the Reference Images to audit them and any other submitted data that may be flagged as fraudulent or queried by a client (as part of that process, Verifymy may use the images to detect fraud by comparing them to other images submitted for this or other clients) and to improve our services;
• stores the Reference Face Map and Reference Images in encrypted format when not in use;
• permanently destroys the Reference Face Map after one year, unless (i) you later use your Verifymy account to verify your identity with this or another Verifymy client, as described in the section below, (ii) longer retention is required by law, or (iii) longer retention is lawful and necessary for resolution of a legal matter, such as an investigation of fraudulent use of the Verifymy service (in which case, unless legally prohibited, we would still permanently destroy the Reference Face Map by the earlier of (A) when we determine it is no longer needed for that purpose, or (B) three years after our last interaction with you);
• does not use the Reference Images for any other purposes.

When you later use your Verifymy account to verify your identity for any Verifymy client:

• You typically can do this either by logging into your Verifymy account or by submitting another selfie image (the “New Selfie Image”).
• Either way, the one-year timeline for permanent destruction of the Reference Face Map will start over. In other words, from the time that later identify verification is performed, Verifymy will store the Reference Face Map for one year, unless (i) you later use your Verifymy account to verify your identity with this or another Verifymy client, as described in this section, (ii) longer retention is required by law, or (iii) longer retention is lawful and necessary for resolution of a legal matter, such as an investigation of fraudulent use of the Verifymy service (in which case, unless legally prohibited, we would still permanently destroy the Reference Face Map by the earlier of (A) when it is no longer needed for that purpose, and (B) three years after our last interaction with you).
• If you submit a New Selfie Image as part of this later identity verification, Verifymy will process it, including by creating a face map from it, analyzing the New Selfie Image and its face map to judge if the New Selfie Image is of a live person or not, comparing the new face map with the Reference Face Map for identity verification, and then (i) immediately permanently destroying the new face map and (ii) storing and using the New Selfie Image with the Reference Images in your Verifymy account.