Biometric Data Policy

This Biometric Data Policy (“Policy”) describes how AiPrise, Inc. (“AiPrise,” “we,” “us,” or “our”) collects, uses, stores, and destroys biometric data in connection with our identity verification services. This Policy supplements our Privacy Policy and applies to individuals located in the United States whose biometric data is processed through our services.

AiPrise provides identity verification, fraud detection, and compliance services to our business customers (“Customers”). When you verify your identity through a Customer’s application or website using AiPrise’s technology, we may collect biometric data as described below.

Definitions

For purposes of this Policy:

“Biometric Data” means biometric identifiers and biometric information as defined by applicable law, including scans of facial geometry extracted from photographs or video of your face (“Facial Scan Data”), and any mathematical representations, templates, or embeddings derived from such scans.

“Source Images” means the photographs, video, or other visual recordings of your face and identity documents that you submit through the services, from which Biometric Data may be extracted.

“Customer” means the business or organization that directed you to AiPrise’s identity verification services.

What Biometric Data We Collect

When you submit a selfie, photograph, or video for identity verification, AiPrise may extract Facial Scan Data — a mathematical representation of your facial geometry — from the image of your face. We may also extract Facial Scan Data from the photograph on your government-issued identity document (such as a driver’s license or passport).

We use Facial Scan Data to perform:

• Facial verification (one-to-one comparison): comparing the image of your face against the photograph on your identity document to confirm that you are the person depicted on the document.
• Liveness detection: analyzing your selfie or video to determine that you are physically present at the time of capture, rather than presenting a photograph, video, mask, or other spoofing method.

AiPrise processes Biometric Data at the direction of, and on behalf of, our Customers. Your Customer determines the purpose and scope of the identity verification.

How We Use Biometric Data

We use Biometric Data solely for the following purposes:

• verifying your identity by comparing your Facial Scan Data against the Facial Scan Data extracted from your identity document;
• detecting liveness and preventing spoofing during the verification process;
• detecting and preventing fraud, including identifying potentially fraudulent identity documents; and
• improving the accuracy and security of our identity verification services.

We do not use Biometric Data to:

• identify you against a database of individuals (one-to-many facial recognition), except to the extent necessary to detect duplicate or fraudulent submissions across verifications at your Customer’s direction;
• track your movements or behavior;
• make automated decisions that produce legal effects for you; or
• serve advertisements or for marketing purposes.

Biometric Data and the AiPrise Network

AiPrise operates a fraud detection and identity verification network across its customer base. Biometric Data is not shared through this network. De-identified fraud flags and verification status indicators may be shared across network participants, but Biometric Data (including Facial Scan Data, Source Images, and identity documents) is never included in network data.

Cross-customer verification status is determined using non-biometric identifiers (such as entity name, date of birth, and document number). AiPrise does not perform facial comparison across customers or use Facial Scan Data to match individuals across different Customer verifications.

For more information about our network data practices, please contact us or refer to the Network Intelligence Data section of the applicable Customer agreement.

Consent

We collect and process Biometric Data only with your express consent. Before any Biometric Data is captured, you will be presented with a consent notice that asks you to acknowledge this Policy and consent to the collection and processing of your Biometric Data.

If you do not consent, AiPrise will not extract Biometric Data from your images, and the identity verification will not proceed. You should contact your Customer to discuss alternative verification methods.

You may withdraw your consent at any time by contacting us at privacy@aiprise.com. Withdrawal of consent does not affect the lawfulness of processing that occurred before withdrawal. If you withdraw consent, AiPrise will destroy your Biometric Data in accordance with the Retention and Destruction section below, unless retention is required by law or legal process.

Retention and Destruction

Retention Schedule

We retain Biometric Data and Source Images for the shortest period necessary to fulfill the purpose for which they were collected. Retention periods vary based on the type of data and the service context: