Biometric Data Policy

This Biometric Data Policy (“Policy”) describes how AiPrise, Inc. (“AiPrise,”“we,”“us,”or“our”) collects, uses, stores, and destroys biometric data in connection with our identity verification services. This Policy supplements ourPrivacy Policy and applies to individuals located in the United States whose biometric data is processed through our services.

AiPrise provides identity verification, fraud detection, and compliance services to our business customers (“Customers”). When you verify your identity through a Customer’s application or website using AiPrise’s technology, we may collect biometric data as described below.

Definitions

For purposes of this Policy:

“Biometric Data” means biometric identifiers and biometric information as defined by applicable law (including the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq., the Texas Capture or Use of Biometric Identifier Act, Tex. Bus. & Com. Code Chapter 503, and the Washington Biometric Identifier statute, RCW 19.375), including scans of facial geometry extracted from photographs or video of your face (“Facial Scan Data”), and any mathematical representations, templates, or embeddings derived from such scans.

“Source Images” means the photographs, video, or other visual recordings of your face and identity documents that you submit through the services, from which Biometric Data may be extracted.

“Customer” means the business or organization that directed you to AiPrise’s identity verification services.

What Biometric Data We Collect

When you submit a selfie, photograph, or video for identity verification, AiPrise may extract Facial Scan Data — a mathematical representation of your facial geometry — from the image of your face. We may also extract Facial Scan Data from the photograph on your government-issued identity document (such as a driver’s license or passport).

We use Facial Scan Data to perform:

• Facial verification (one-to-one comparison): comparing the image of your face against the photograph on your identity document to confirm that you are the person depicted on the document.
• Liveness detection: analyzing your selfie or video to determine that you are physically present at the time of capture, rather than presenting a photograph, video, mask, or other spoofing method.

AiPrise processes Biometric Data at the direction of, and on behalf of, our Customers. Your Customer determines the purpose and scope of the identity verification.

How We Use Biometric Data

We use Biometric Data solely for the following purposes:

• verifying your identity by comparing your Facial Scan Data against the Facial Scan Data extracted from your identity document;
• detecting liveness and preventing spoofing during the verification process;
• detecting and preventing fraud, including identifying potentially fraudulent identity documents; and
• improving the accuracy and security of our identity verification services.

We do not use Biometric Data to:

• identify you against a database of individuals (one-to-many facial recognition), except to the extent necessary to detect duplicate or fraudulent submissions across verifications at your Customer’s direction;
• track your movements or behavior;
• make automated decisions that produce legal effects for you; or
• serve advertisements or for marketing purposes.

Biometric Data and the AiPrise Network

AiPrise operates a fraud detection and identity verification network across its customer base. Biometric Data is not shared through this network. De-identified fraud flags and verification status indicators may be shared across network participants, but Biometric Data (including Facial Scan Data, Source Images, and identity documents) is never included in network data.

Cross-customer verification status is determined using non-biometric identifiers (such as entity name, date of birth, and document number). AiPrise does not perform facial comparison across customers or use Facial Scan Data to match individuals across different Customer verifications.

For more information about our network data practices, please contact us or refer to the Network Intelligence Data section of the applicable Customer agreement.

Consent

We collect and process Biometric Data only with your express consent. How consent is obtained depends on how you access the identity verification service:

• SDK and Embedded Verification. When you verify your identity through a Customer’s application using AiPrise’s SDK or embedded verification tools, AiPrise will present you with a consent notice before any Biometric Data is captured. The consent notice will inform you that Biometric Data is being collected, the specific purpose of collection (identity verification, liveness detection, and fraud prevention), the retention period for your Biometric Data, and that your Biometric Data may be transmitted to AiPrise’s identity verification data vendors for processing. You will be asked to acknowledge this Policy and provide your written consent (which may be electronic) before any Biometric Data is collected.
• API Integrations. When you verify your identity through a Customer’s application and the Customer collects your information directly (without using AiPrise’s SDK or embedded tools), consent is obtained by the Customer before your data is transmitted to AiPrise. The Customer is responsible for presenting you with all required disclosures—including the purpose of collection, the retention period, and the fact that your Biometric Data will be transmitted to AiPrise and its verification data vendors—and for obtaining your written consent (which may be electronic) before sending your Biometric Data to AiPrise.

If you did not consent to the collection of your Biometric Data, or if you have questions about the consent you provided, please contact the Customer who initiated the verification.

You may withdraw your consent at any time by contacting us at privacy@aiprise.com. Withdrawal of consent does not affect the lawfulness of processing that occurred before withdrawal. If you withdraw consent, AiPrise will destroy your Biometric Data in accordance with the Retention and Destruction section below, unless retention is required by law or legal process.

Retention and Destruction

Retention Schedule

We retain Biometric Data and Source Images for the shortest period necessary to fulfill the purpose for which they were collected. Retention periods vary based on the type of data and the service context:

In all cases, Biometric Data will permanently destroyed no later than the earlier of: (a) completion of the identity verification transaction and delivery of verification results to the Customer (unless the Customer has instructed AiPrise to retain the data for a specified period for ongoing compliance monitoring or regulatory purposes, in which case retention shall not exceed the period specified in clause (b)); or (b) three (3) years after your last interaction with AiPrise’s services.

Notwithstanding the foregoing general retention period, the following jurisdiction-specific limits apply: for residents of Texas, Biometric Data will be permanently destroyed within one (1) year of the date on which the purpose for collection has been satisfied, as required by the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code Chapter 503). For residents of all other jurisdictions where a shorter retention period is required by applicable law, AiPrise will comply with the shorter period.

Where AiPrise acts as a service provider to a Customer, the Customer may instruct AiPrise to retain data for a shorter period. Customers may also request early deletion of your data through AiPrise’s API or dashboard.

Destruction Methods

When Biometric Data reaches the end of its retention period or is no longer needed, AiPrise permanently destroys it using commercially reasonable methods, including:

• cryptographic erasure (rendering encrypted data unrecoverable by destroying the encryption keys);
• secure deletion of electronic records in accordance with NIST 800-88 guidelines; and
• purging of all backup and disaster recovery copies within 90 days of the primary deletion.

Destruction Upon Request

You may request early destruction of your Biometric Data by contacting us at privacy@aiprise.com. We will acknowledge your request within 30 days and complete destruction within 15 days of acknowledgment, unless retention is required by applicable law, legal process, or an active fraud investigation.

Disclosure of Biometric Data

We do not sell, lease, or trade Biometric Data.

We may disclose Biometric Data only in the following circumstances:

We require all service providers who process Biometric Data on our behalf to maintain appropriate security measures and to process Biometric Data only as instructed by AiPrise.

Our identity verification data vendors process your Biometric Data when performing facial verification and liveness detection on AiPrise’s behalf. These vendors do not retain Biometric Data after processing is complete and are contractually required to maintain security and privacy standards consistent with this Policy and are contractually prohibited from using Biometric Data for any purpose other than performing the verification services requested by AiPrise. For questions about our data vendors, please contact us at privacy@aiprise.com.

Data Security

We protect Biometric Data using security measures that are at least as protective as those used for other sensitive personal information, including:

• encryption in transit using TLS 1.2 or higher;
• encryption at rest using AES-256 or equivalent;
• strict access controls limiting Biometric Data access to authorized personnel with a legitimate business need;
• regular security audits and vulnerability assessments; and
• SOC 2 Type II certification.

Destruction Upon Request

You may request early destruction of your Biometric Data by contacting us at privacy@aiprise.com. We will acknowledge your request within 30 days and complete destruction within 15 days of acknowledgment, unless retention is required by applicable law, legal process, or an active fraud investigation.

Your Rights

Depending on where you are located, you may have additional rights regarding your Biometric Data under applicable law:

Illinois Residents. If you are a resident of Illinois, you have rights under the Illinois Biometric Information Privacy Act, including the right to receive written notice and provide informed written consent before your Biometric Data is collected, the right to know the purpose and retention period for your Biometric Data, and the right to have your Biometric Data permanently destroyed in accordance with the retention schedule described above. To exercise these rights, please contact us at privacy@aiprise.com.

Because AiPrise processes Biometric Data at the direction of our Customers, we may direct you to contact your Customer for certain requests, particularly where the Customer controls the retention period or verification workflow.

Consumer Health Data

AiPrise’s collection and use of Biometric Data for identity verification and fraud prevention does not constitute the collection of “consumer health data” as defined by the Washington My Health My Data Act, Nevada SB 370, or similar state health privacy laws. Biometric Data processed by AiPrise is used solely to prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, or malicious or deceptive activities, and is not used to identify or infer any information about your past, present, or future physical or mental health status.

Children

AiPrise’s identity verification services are not directed to individuals under the age of eighteen (18). We do not knowingly collect Biometric Data from children. If you believe Biometric Data has been collected from an individual under eighteen, please contact us immediately at privacy@aiprise.com.

Changes to This Policy

We may update this Policy from time to time by posting a revised version on our website. If we make material changes to how we collect, use, or disclose Biometric Data, we will provide notice through our website or through our Customers before the changes take effect. Your continued submission of Biometric Data after the effective date of any revised Policy constitutes your acceptance of the changes.

Contact Us

If you have questions about this Policy or wish to exercise any of your rights, please contact us:

AiPrise, Inc. - 2880 Zanker Rd., Ste. 203,
San Jose, CA 95134
Attn: Privacy Team - privacy@aiprise.com