Privacy Policy
Last updated August 4, 2026
This Privacy Policy explains how VeriSec Labs Ltd. ("VeriSec Labs," "we," "us," or "our") collects, uses, discloses, and protects information when you use our website, our KYC Portal, our APIs and SDKs, or when a business that uses our Services verifies you as an applicant (together, the "Services"). By using our website, or by providing information to us or to a business that uses our Services, you consent to the processing this Policy describes.
In most cases, the business that sends you a verification link or embeds our verification flow is the controller of your personal information, and VeriSec Labs processes it on that business's behalf and instructions. Where you interact directly with our website or hold a VeriSec Labs account, we act as the controller of that information.
VeriSec Labs may update this Policy from time to time; the "Last updated" date above will change when we do, and continued use of the Services after an update constitutes acceptance of the revised Policy.
1. What Personal Information We Collect
- Account & business information, name, work email, password, company name, and billing details, when you or your business signs up.
- Identity documents, images of passports, national ID cards, driver's licences, and residence permits, and the data extracted from them (name, date of birth, document number, nationality, expiry date, and the machine-readable zone).
- Biometric & liveness data, a live selfie image or short video, and the mathematical templates we generate from it to compare against your document photo and confirm you are a real, present person.
- Passport/eID chip data, data read from the chip inside an electronic passport or ID via NFC, including the cryptographic signature used to confirm it is genuine.
- Contact verification data, phone number, email address, and one-time codes used to confirm you control them.
- Proof of address, address documents, such as a utility bill, and the address extracted from them.
- Screening data, name, date of birth, and nationality used to check you against sanctions, politically-exposed-person, and adverse-media lists, where a business has enabled AML screening.
- Device & network information, IP address, approximate location, device type, operating system, browser, and connection-risk signals such as VPN or proxy use.
- API & usage data, requests made through our API, webhook deliveries, and related logs generated by our business customers' use of the Services.
- Payment-card data, where a business uses Scan-to-Pay, card details captured from an image on-device; we do not store full unencrypted card numbers.
2. What We Do With the Personal Information We Collect
- Perform the requested identity check, document authenticity, face match, liveness, chip verification, address, phone, and AML screening, and return a decision to the business that requested it.
- Detect and prevent fraud, document forgery, and account takeover.
- Help our business customers meet their own KYC/AML and other regulatory obligations.
- Operate, secure, and improve our platform, including evaluating the accuracy of our detection models using de-identified or aggregated data where possible.
- Provide the KYC Portal's analytics, dashboards, and reporting to our business customers.
- Bill for usage and manage accounts.
- Communicate with you about a verification, your account, or changes to the Services or this Policy.
3. Biometric & Identity Verification Data
We treat document images, selfie images and video, biometric templates, and chip data as sensitive information and apply extra access controls to them. Access to unmasked identity fields inside a business's KYC Portal is role-gated, and every reveal is logged to an audit trail (see "Security" below). We use biometric data only to perform the verification it was collected for and to secure and improve that process, never for unrelated profiling or advertising. Where local law requires separate or explicit consent to process biometric data, that consent is collected in the applicant flow before any biometric check runs.
4. When We Disclose Personal Information
- To the business that requested your verification, so it can make a decision about your application.
- To sub-processors who help us run the Services, cloud hosting and storage providers, SMS/OTP delivery providers, and, where AML screening is enabled, sanctions, PEP, and adverse-media data providers.
- To professional advisors, auditors, and regulators, where required to comply with law or a valid legal process.
- To a successor entity if VeriSec Labs is involved in a merger, acquisition, or asset sale.
- We do not sell personal information.
5. Data Retention & Storage
Each business customer configures how long applicant data is retained and in which storage region, EU, US, or Africa, through their own Data & Retention settings, subject to any minimum retention period required by applicable KYC/AML law. Account, billing, and API-usage data is retained for as long as an account is active, plus a reasonable period afterward for legal, accounting, and fraud-prevention purposes. When a retention period expires, applicant images and extracted fields are deleted or irreversibly anonymized.
7. Security
- Encryption of personal information in transit and at rest.
- Role-based access control across the KYC Portal (Owner, Admin, Developer, Reviewer, Billing, Viewer), so only people who need access to identity data have it.
- Masking of personal fields by default, with reveal actions logged to an audit trail.
- Optional two-factor authentication and configurable session and IP-allow-list policies for business accounts.
- No security measure is perfect; we continually review and update our practices.
8. International Data Transfers
Because VeriSec Labs, its infrastructure, and its business customers operate across regions including Europe, North America, and Africa, personal information may be transferred to and processed in a country other than the one in which it was collected. Where we transfer personal information out of the European Economic Area or a jurisdiction with similar requirements, we rely on recognized transfer mechanisms, such as Standard Contractual Clauses, or an applicable adequacy decision.
9. Your Rights & Choices
Depending on where you are located and your relationship to us, you may have the right to access, correct, delete, or export your personal information, restrict or object to certain processing, and withdraw consent where processing is based on consent. If you were verified through one of our business customers, contact that business first, since it controls your data; we support their requests to us as their processor. If you hold a direct VeriSec Labs account, you can exercise most of these choices yourself from Settings → Data & Retention, or by contacting us.
10. Accessing, Correcting & Deleting Your Data
Business account holders can export or delete stored applicant data at any time via Settings → Data & Retention. Applicants can request access to, correction of, or deletion of their information by contacting the business that requested their verification, or by contacting us directly if that business cannot be identified or has ceased operating. We may retain limited information as required by law, such as records needed to demonstrate AML compliance, even after a deletion request.
11. Children's Privacy
Our Services are not directed at, and we do not knowingly collect personal information from, children under the age of 16, except where a business customer uses our age-verification features specifically to confirm an applicant meets a required minimum age. If we learn we have collected personal information from a child in violation of this Policy, we will take steps to delete it.
12. Contact Us
Questions about this Privacy Policy or how we handle personal information can be sent to privacy@verisec.io, or by post to our Kigali, Rwanda office. This Policy is designed to align with the EU General Data Protection Regulation and with applicable local data-protection law in the jurisdictions where we operate, including Rwanda's Law N° 058/2021 relating to the protection of personal data and privacy.