Privacy Policy

VerifyID, operated by Vyloxi ("we", "us"), checks that a person is who they say they are, on behalf of the business that asked them to verify (the "organisation"). This policy explains what we process when you verify your identity, why, for how long, and what you can ask of us.

1. Who is responsible

The organisation that sent you the verification decides why your identity is checked and what happens with the result: it is the controller of your data. We process your data on its behalf and on its instructions. For questions about why you are asked to verify, contact that organisation; we will also forward any request you send us.

2. What we process

• Images of your identity document (front and, if you provide it, back) and the data read from it: name, document number, dates of birth and expiry, nationality, sex.
• Images of your face from the live capture, and a face signature: a set of numbers computed from your face. This signature is biometric data.
• Your device and connection: IP address, approximate country, browser and device type.
• The result: scores, the reasons for the decision, any decision made by a person, and a record of your consent.

3. Why

• To verify your identity for the organisation: that the document looks genuine and valid, that your face matches the document photo, and that the capture comes from a live person.
• To prevent fraud: detecting photos of screens or prints, the same face used under different identities within the same organisation, and names on international sanctions lists (OFAC and UN).
• To keep a record of the decision that the organisation can show to an auditor or regulator.

We do not sell your data, use it for advertising, or compare your face with other organisations' data. Before any capture we ask for your explicit consent; we store the wording you agreed to, when, and from which device.

4. How long we keep it

• Images are deleted right after the decision unless the organisation has chosen to keep them longer (at most one year). If a person needs to review your case, images are kept until that review, then deleted.
• The verification record, including the face signature, is kept for the period the organisation has chosen, between 30 days and 2 years (90 days unless changed).
• Encrypted backups of our database are kept for 14 days.

5. Who else sees it

• The organisation that asked you to verify, which receives the result.
• Our staff, only when needed to operate the service or handle a request, and every such access is logged.
• Service providers that run parts of our service for us: server hosting and email delivery. Face analysis, liveness and document reading run on our own servers: your images are not sent to another biometric provider.
• Authorities, where the law requires it.

6. Security

Data is encrypted in transit (TLS) and your images are encrypted at rest (AES-256). Access is restricted by role and recorded in audit logs. Backups are encrypted.

7. Your rights

Depending on where you live, you can ask for a copy of your data, its correction or its deletion, object to its processing, or withdraw your consent (this does not affect a verification already completed). Use our data request form: we confirm your email, pass the request to the organisation that verified you, and answer within 30 days. You can also complain to your data protection authority.

8. Cookies

We use only the cookies needed for the verification to work (your session and chosen language). No advertising or tracking cookies.

9. Changes

We update this policy when the service changes. The date at the top shows the last update; each consent record keeps the version of the wording you agreed to.

10. Contact

Privacy questions: verifyid@vyloxi.com. More detail for organisations: compliance overview.