Privacy Notice

Who controls your data

VerifyNova, operator of UnifyID is the controller for the UnifyID consumer account and public website unless another notice identifies a different controller. Participating applications remain responsible for their own use of information they receive from you.

Contact privacy@verifynova.com with privacy questions or to exercise a data protection right.

Data we process

• Account data, including verified email addresses, phone numbers, authentication factors, account status, and security events.
• Identity data obtained during verification, including legal name, date of birth, nationality, document type, issuing country, document metadata, and verification results.
• Biometric and liveness data used to establish or confirm that a live person matches the verified account.
• Consent, application connection, public-profile, credential, privacy-request, support, and notification records.
• Technical data such as IP address, device and browser information, timestamps, request identifiers, and security telemetry.

Why we process it

• Create, protect, and operate your identity account and provide requested services.
• Verify identity, prevent impersonation, detect fraud, and maintain platform security.
• Obtain and record your permission before an application receives approved information.
• Meet legal obligations, establish or defend legal claims, respond to lawful requests, and keep required audit records.
• Improve reliability and accessibility using aggregated or appropriately de-identified information.

Legal bases

Depending on the activity and your location, we rely on performance of our contract with you, compliance with legal obligations, legitimate interests in operating a secure identity service, and consent. Where biometric data is used to uniquely identify you, we obtain explicit consent or rely on another lawful condition permitted by applicable law.

Sharing and international transfers

We share only what is necessary with contracted verification, cloud, communications, fraud-prevention, support, and infrastructure providers. We share approved claims with a participating application only after your authorization or another lawful instruction.

Where data is transferred internationally, we use an approved transfer mechanism and supplementary safeguards where required, such as adequacy decisions or standard contractual clauses.

Retention

We retain data only as long as necessary for its purpose, legal obligations, dispute resolution, fraud prevention, and security. Temporary biometric captures and uploaded evidence are removed or de-identified as soon as the applicable verification and security window permits. See the Data Retention Notice.

Your rights

• Access personal data associated with your account and receive a copy.
• Correct inaccurate or incomplete personal data.
• Request deletion of eligible data, subject to legal, security, fraud-prevention, and record-keeping duties.
• Restrict or object to processing where applicable law provides that right.
• Receive eligible data in a structured, commonly used, machine-readable format.
• Withdraw consent at any time where consent is the legal basis, without affecting earlier lawful processing.
• Complain to the competent data protection authority in your country.

Automated decisions

Automated tools may assess liveness, document authenticity, face similarity, fraud indicators, or account risk. Where a decision has a significant legal or similar effect and law requires it, you may request human review, express your view, and challenge the outcome.

Children and updates

UnifyID is not intended for children below the minimum digital-consent age applicable in their country unless an approved guardian flow is provided. We publish material updates and provide additional notice when required.