Privacy Policy

1. Who We Are

TrustVerifyID ("we", "us", "our") is an identity verification platform. The operating legal entity, country of registration, company ID, and registered office address will be published here before commercial launch and on the contact page. The most current registration data takes precedence over earlier published versions.

For data protection enquiries, contact our data protection contact at privacy@trustverifyid.com. Other contact channels are listed at trustverifyid.com/contact.

2. Data We Collect

2a. Developer / Client Account Data

• Company name, contact email, billing address
• Payment information (processed via Stripe – we do not store card numbers)
• API usage logs (endpoint, timestamp, status code)
• IP addresses and user-agent strings used to access our dashboard

2b. End-User / Applicant Data (Processed on Behalf of Clients)

• Government-issued identity documents (passport, national ID, driving licence) – images and extracted text
• Biometric data: facial photographs and liveness video frames
• Date of birth, nationality, address
• Device fingerprint signals (browser, OS, network)
• AML/PEP screening results

3. How We Use Your Data

4. Data Retention

Applicant identity data is retained for the period specified by our client (data controller) subject to applicable law. Where no retention period is set, we apply our default:

• Incomplete verifications: applicant data is purged 30 days after creation if the verification is never completed
• Completed verifications: applicant identity data (including document images and biometric data) is anonymised 2 years after completion by default; clients acting as data controllers may instruct a different retention period where required by applicable law (e.g. AML record-keeping obligations)
• Billing records: retained for the period required by statutory accounting and tax law

5. Data Security

All stored files are encrypted at rest using AES-256-GCM with per-applicant encryption keys. Data in transit is protected by TLS 1.3. We enforce strict MIME-type and magic-byte validation on every uploaded file, with malware scanning applied where the scanning engine is enabled. Access to production systems is protected by TOTP two-factor authentication.

6. International Transfers

Data is processed on servers located in the EU. Where transfers outside the EEA are necessary (e.g., optional cloud OCR fallback), we rely on EU Standard Contractual Clauses (SCCs).

7. Your Rights

Under GDPR and applicable data protection law, you have the right to:

• Access – request a copy of data we hold about you
• Rectification – correct inaccurate data
• Erasure – request deletion (subject to legal retention obligations)
• Portability – receive data in a structured, machine-readable format
• Object – object to processing based on legitimate interests
• Restrict – limit how we use your data pending a dispute

To exercise your rights, contact us at privacy@trustverifyid.com. We respond within 30 days.

8. Cookies

The marketing website uses only essential session cookies. The developer portal sets a tvid_dev session cookie. We do not use advertising or tracking cookies.

9. Changes to This Policy

We may update this policy periodically. We will notify clients by email for material changes. Continued use of the service after the update constitutes acceptance.

10. Contact

Questions about this policy: privacy@trustverifyid.com