Legal
Biometric Data Policy
This policy explains how Securely Verify collects, uses, stores, retains and destroys biometric identifiers and biometric information (“biometric data”) when people complete identity verification through our Service on behalf of our business customers.
What biometric data we process
- The face image on an identity document
- Selfie photos and short video frames captured during the liveness check
- Face geometry measurements (“face templates”) calculated from those images to compare the selfie with the document photo and to detect duplicate or fraudulent attempts
Why we use it
Biometric data is used only to verify that the person completing a verification is the person shown on the identity document, that a real person is present, and to detect fraud. It is not used for any other purpose.
Consent
Before any biometric data is collected, each person is told what will be collected, why and for how long, and must give written consent electronically. The person can stop at any time before submitting.
No sale or profit
Securely Verify does not sell, lease, trade or otherwise profit from biometric data.
Disclosure
Biometric data is disclosed only to the business that requested the verification, to subprocessors that host and operate the Service under written obligations, or where required by law or valid legal process.
Storage and protection
Biometric data is encrypted in transit and at rest, access is limited to authorized personnel and logged, and it is protected with the same or a higher standard of care than other confidential and sensitive information.
Retention and destruction schedule
Biometric data is permanently destroyed when the initial purpose of collecting it has been satisfied, or within three years of the person’s last interaction with the Service, whichever comes first. By default:
| Data | Destroyed |
|---|---|
| Liveness video frames | 30 days after the verification is decided |
| Selfies, document face images and face templates | 90 days after the verification is decided |
| Verifications that are never decided | No later than 30 days after the periods above |
Business customers can choose shorter periods. Deletion is automatic and recorded in an audit log, without keeping the deleted data.
Applicable laws
This policy is designed to meet the requirements of biometric privacy laws that may apply, such as the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act and Washington’s biometric identifier law.
Requests and questions
To ask about or request deletion of your biometric data, contact the business that sent you the verification link, or email support@securelyverify.io.
