Privacy Policy

Effective Date: 1st May 2025

At Universal Verify, we value the privacy and security of your personal information. This Privacy Policy ("Policy") outlines how we collect, use, and protect the personal data you share with us when using our services, including the Universal Verify website, platform, and any related applications or integrations (collectively, the "Service").

By using the Service, you agree to the collection and use of your personal data in accordance with this Privacy Policy.

1. Information We Collect

We collect and process the following types of information when you use our Service:

Account Level Data

Email Address

Purpose: Authentication and to send account-related updates

Retention: Deleted upon account deletion

Storage Location: Canada

Processing Location: Canada and countries where your ID data is stored

Authentication Credentials

Purpose: Authentication

Retention: Deleted upon account deletion

Storage Location: Canada

Processing Location: Canada

Connected Applications

Purpose: Manage connected applications and their permissions

Retention: Deleted upon account deletion

Storage Location: Canada

Processing Location: Canada and countries where your ID data is stored

IP Address and Activity Logs

Purpose: Retained for potential legal and compliance audits

Retention: Deleted 10 years after the date of collection

Storage Location: Canada and countries where your ID data is stored

Processing Location: Canada and countries where your ID data is stored

Pseudonymized Email Address

Purpose: Internal fraud detection and legal audit requirements

Retention: Deleted 10 years after account deletion

Storage Location: Canada

Processing Location: Canada and countries where your ID data is stored

Pseudonymized IP Address

Purpose: Internal fraud detection and legal audit requirements

Retention: Deleted 10 years after account deletion

Storage Location: Canada

Processing Location: Canada and countries where your ID data is stored

Internal User Identifier

Purpose: Manage and reference your account within our systems

Retention: Deleted 10 years after account deletion

Storage Location: Any country where AWS operates

Processing Location: Any country where AWS operates

ID Level Data

ID Photos

Purpose: Identity verification and fraud prevention

Retention: Deleted 10 years after account deletion

Storage Location: The country that issued your ID when possible, otherwise in a country permitted under applicable data laws

Processing Location: Same as storage

Selfie Photos

Purpose: Identity verification and fraud prevention

Retention: Deleted 10 years after account deletion

Storage Location: The country your ID photos are stored in

Processing Location: Same as storage

Pseudonymized ID Information

Purpose: Internal fraud detection

Retention: Deleted 10 years after account deletion

Storage Location: Canada

Processing Location: The country your ID photos are stored in and Canada

ID Type and Expiration Year

Purpose: Help differentiate between uploaded IDs

Retention: Deleted 10 years after account deletion

Storage Location: The country your ID photos are stored in and Canada

Processing Location: Same as storage

Age (in years)

Purpose: Sharing with applications explicitly authorized by you

Retention: Processed in memory when needed for no longer than 15 minutes

Storage Location: Not stored

Processing Location: The country your ID photos are stored in and Canada

Facial Biometrics

Purpose: Automated identity verification

Retention: Processed in memory when needed for no longer than 15 minutes

Storage Location: Not stored

Processing Location: The country your ID photos are stored in

All Other Information Extracted from Your ID

Purpose: Sharing with applications explicitly authorized by you

Retention: Deleted when your account is deleted

Storage Location: The country your ID photos are stored in

Processing Location: Same as storage

Internal ID Identifier

Purpose: Manage and reference your ID within our systems

Retention: Deleted 10 years after account deletion

Storage Location: Canada and the country your ID photos are stored in

Processing Location: Same as storage

Important Note: We do not use your information for training AI. All data is used solely for verification, security, and legal purposes.

2. How We Collect Information

You provide your personal information when you register for an account and upload your ID to the Service.
Your ID is uploaded directly to a secure, region-specific server that complies with local data residency laws.
We use automated systems to extract and verify information from your ID photos, ensuring accuracy while maintaining security and keeping your data in those region-specific servers.
We extract facial geometry and biometric identifiers from the photos you provide to automate part of the verification process. This information is stored ephemerally in memory for no longer than 15 minutes. You can opt out of this by requesting we do not perform any automated decisions on your behalf, or by not checking the relevant biometric consent checkbox at the time of ID upload.

3. How We Use Your Information

We use the information we collect for the following purposes:

To verify your identity using the uploaded ID and by comparing it against government-issued records and public databases, either directly or through authorized third-party verification services.
To store and manage your verification details securely.
To connect you with third-party platforms (Partners) through our OAuth flow, with your permission.
To provide you with a seamless and secure experience when interacting with the Service.
To prevent fraud and ensure the security of the Service.
To meet our legal and regulatory obligations.

4. Data Sharing and Third-Party Platforms

You have full control over which third-party platforms (Partners) can access your information. When connecting to a Partner, you'll be presented with a list of requested data scopes and can choose which information to share.
Each integration with a Partner receives a unique, non-linkable identifier to prevent tracking across different integrations.
You can revoke access or disconnect integrations at any time.
We may check your information against authorized third-party verification services and government agencies to verify your identity and prevent fraud.
Trained employees, primarily based in the US, may review your information to ensure accuracy, prevent fraud, and provide support. These employees are bound by strict confidentiality agreements and can only access your data through secure systems built on AWS, with safeguards in place including the AWS Data Processing Addendum (DPA) to help meet the requirements of the GDPR.

5. Data Storage and Residency

Please see the "Information We Collect" section at the top of this page for the storage and processing locations for the data we collect.
Your ID information will be stored in the country that issued your ID when possible, or in a country permitted under applicable data laws. We will inform you of the location where your ID information will be stored and request your consent prior to upload.
We use secure, encrypted connections to transfer data and minimize risk during transmission.
We maintain secure audit logs of access and activity within the Service to ensure system integrity, support security investigations, and comply with applicable laws. These logs may include IP addresses, actions taken, access times, and associated identifiers. Logs are retained for up to 10 years based on regulatory, legal, and operational requirements, and are stored in the same regions as the data they relate to, in accordance with applicable data residency laws.

6. Data Retention

We retain different types of data for varying periods:

Please see the "Information We Collect" section at the top of this page for the specific retention periods for each piece of data we collect.
Facial biometrics and age information are processed in memory when needed and are not stored permanently. This data is retained for no longer than 15 minutes during processing.

Regarding information retained after account deletion: Our retention policy is designed to support legal compliance and defend against potential claims, including those related to bank fraud, which may have statutes of limitations of up to 10 years in some jurisdictions. During this retention period, we also use this data to prevent users from verifying new accounts to evade bans or other restrictions applied by connected applications.

7. International Data Transfers

Universal Verify operates globally. By using the Service, you acknowledge and agree that your data may be transferred to, stored, and processed in countries outside of your country of residence. These countries may have data protection laws that differ from those in your jurisdiction. We ensure that data transfers comply with applicable data protection laws, including the General Data Protection Regulation (GDPR) in the EU and similar laws in other regions.

We are not responsible for the international data transfers for the data you explicitly share with third-party platforms (Partners) through our OAuth flow.

8. Your Rights and Choices

You have the following rights regarding your personal data:

Access: You can request a copy of the data we hold about you.
Correction: You can request that we correct any inaccurate data we hold about you.
Deletion: You can request the deletion of your data by deleting your account. Some data is subject to a retention period for legal and compliance purposes.
Restriction: You can request that we limit how we process your data in certain cases.
Objection: You may object to specific types of processing, such as marketing.
Portability: You can request that we provide your data to you in a structured, commonly used, and machine-readable format.
Automated Decision Making: You can request a human review of automated decisions if they significantly affect you.
Non-Discrimination: We will not deny you service or treat you unfairly for exercising your data rights.
Revoking Access: You can revoke access to any third-party platform at any time through the settings in your account.

To exercise these rights, please contact us at support@universalverify.com.

9. Data Security

We take the security of your data seriously and use industry-standard measures to protect it. This includes encryption during transmission and secure storage practices.

However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security. You are also responsible for securing your devices used to interact with the Service.

10. Cookies

We use cookies strictly to authenticate your session. These cookies are essential to the functioning of our service and cannot be opted out of.

We do not knowingly use any non-essential cookies or tracking technologies. However, some third-party libraries or embedded services used on our site may set their own cookies. While we make efforts to review and monitor the tools we use, we cannot guarantee that third-party code will not set cookies without our explicit knowledge.

If you notice any unexpected cookies or have concerns about how your data is handled, please contact us at support@universalverify.com.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any significant changes by posting the updated Policy on our website and updating the "Effective Date" at the top of the page.

12. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at:

Universal Verify

Email: support@universalverify.com

Website: https://universalverify.com