We want the proof. Not your data.

1. Introduction

Checkify Technologies Ltd (“Checkify”, “we”, “us”, or “our”) provides a privacy-first verification platform used for age, identity, human verification, and eligibility checks. Our services help people prove what is true about them while reducing unnecessary sharing of sensitive personal information.

This Privacy Policy explains how we collect, use, store, share, and protect personal information when you use Checkify websites, mobile apps, APIs, plugins, business dashboards, SDK integrations, and verification services (together, the “Services”).

This policy applies globally. Additional rights and obligations that apply in specific countries are set out in the Country-Specific Addenda below. If an addendum conflicts with this global policy for users in that country, the addendum applies to the extent required by applicable law.

By using the Services, you acknowledge that you have read this Privacy Policy. Where required by law, we will ask for your consent for specific processing activities.

Controller contact: Checkify Technologies Ltd
Email: privacy@checkify.me
Website: checkify.me

2. How Checkify Verification Works

Checkify is designed to minimise the amount of identity information that leaves your device.

When you use an identity document, facial verification, liveness check or another supported source to establish something about yourself, the underlying verification process is performed locally on your device.

For example, depending on the verification method you choose, your device may:

• scan and analyse an identity document;
• read information from a passport or other supported document;
• read an NFC chip where supported;
• extract information using OCR or MRZ processing;
• perform document authenticity or consistency checks;
• perform facial comparison; and
• perform liveness checks.

These operations take place on your device.

The underlying identity document images, facial images and biometric templates used to perform these checks are not sent to or stored on Checkify’s servers as part of the standard verification process.

After a verification is completed, your device sends Checkify a verification record confirming the outcome of the verification and the level of assurance achieved.

For example, Checkify may record that a particular device has successfully verified a passport to a specified assurance level. Checkify does not need to receive or retain a copy of that passport in order to record that verification.

This allows Checkify to create and provide proofs without routinely transferring the underlying identity evidence to Checkify or to the business requesting the proof.

Our Role and the Role of Organisations Using Checkify

Checkify Technologies Ltd acts as a controller for personal information that we determine how and why to process, including information used to operate Checkify accounts, maintain verification records, provide proofs, secure the Services and administer our business.

Where an organisation asks you to provide a Checkify proof, that organisation may separately act as a controller in relation to its request, its decision to require the proof and its use of the result.

In some circumstances, Checkify may process information on behalf of another organisation. Where this occurs, the respective responsibilities of Checkify and that organisation will depend on the particular service and applicable law.

The organisation requesting a proof is responsible for explaining its own purposes and legal basis for requiring and using that proof.

3. Information categories

Checkify distinguishes between information processed on your device, information received and stored by Checkify, and information shared with a business requesting a proof.

Because Checkify supports many verification types and account features, not every category applies to every user or every transaction.

Information Processed on Your Device

Some information may be processed temporarily on your device for the purpose of completing a verification.

Depending on the verification method, this may include:

• identity document images;
• information contained in an identity document;
• passport or identity-document NFC data;
• MRZ information;
• photographs or camera images;
• facial information used for face matching;
• information used for liveness checks; and
• other information required to establish the authenticity or validity of a verification source.

This processing is designed to occur locally on your device.

Unless a specific feature clearly tells you otherwise before you use it, the underlying identity evidence used for these checks is not transmitted to or stored on Checkify’s servers.

Information Checkify Receives

When an on-device verification is completed, Checkify receives information about the verification result rather than the underlying identity evidence.

Depending on the verification performed, this may include:

• the type of verification completed;
• whether the verification succeeded or failed;
• the assurance or verification level achieved;
• verification status;
• timestamps;
• technical identifiers needed to associate the verification with your Checkify account or device;
• security and fraud-prevention information; and
• information necessary to create, manage and use Checkify proofs.

These verification records may constitute personal information where they relate to an identifiable individual.

Checkify stores verification records where necessary to provide the Services, including reusable proofs, account functionality, security, fraud prevention and audit functionality.

Account, billing and website information

In addition to verification records, Checkify may also receive and store information needed to operate accounts and the Services. Categories may include:

• Account details for business customers, such as business name, administrator name, email address, account identifiers, authentication records, team membership, and account status.
• Contact details, such as email addresses, support messages, and communication preferences for users and business contacts.
• Verification request metadata, such as request IDs, proof types requested, timestamps, outcomes, reference IDs, site or integration identifiers, and audit events linked to a verification flow.
• Device and security information, such as device type, operating system version, app version, locale, IP address at the time of request, trusted-device identifiers, fraud-prevention signals, crash logs, and security logs.
• Payment and billing information, such as billing contact details and Stripe customer records for business subscriptions. Payment card details are entered on Stripe’s hosted checkout pages and processed by Stripe—not stored in the Checkify app.
• Limited verification evidence and results, such as verification status, confidence scores, proof outcomes, algorithm or method identifiers, and—where required for a specific service—document-derived fields or images that the user chooses to submit or that the configured flow requires.
• Support messages and communications, including information you choose to send when contacting us for help, security reports, or account issues.

Information Checkify Does Not Normally Receive

As part of the standard on-device identity verification process, Checkify does not normally receive or store on its servers:

• copies or images of identity documents;
• raw passport NFC data;
• facial photographs captured for face matching;
• biometric templates generated for face matching or liveness; or
• the complete contents of an identity document simply because that document was used to establish a proof.

Where a future or optional Checkify feature requires different processing, we will provide appropriate information before that feature is used.

We do not use verification, identity, device, or diagnostic data from Checkify verification flows for third-party advertising tracking or data-broker sales. Optional website marketing technologies on public marketing pages are described under Website cookies and similar technologies and are used only if you allow Marketing in Cookie settings.

Proofs Shared With Businesses

Checkify is designed to allow organisations to receive the answer they need without routinely receiving the underlying identity evidence used to establish it.

For example, where a business needs to establish whether you satisfy an age requirement, Checkify may provide a proof confirming that the requirement has been satisfied rather than providing the business with your passport, identity-document image or full date of birth.

The information contained in a proof depends on the proof requested and authorised.

A proof may include:

• a yes/no result;
• confirmation that a particular requirement has been satisfied;
• the type or level of verification supporting the proof;
• proof validity information;
• a timestamp or expiry information; and
• technical information required to validate the proof.

The requesting organisation does not automatically receive the identity document, facial image or other underlying evidence used to establish the proof.

This approach is central to Checkify’s principle of providing answers, not documents.

Facial Verification and Biometrics

Certain verification methods may use facial comparison or liveness technology.

Where these features are used, facial images and information derived from them are processed locally on your device for the purpose of performing the requested verification.

The facial images and biometric templates used to perform these checks are not transmitted to or stored on Checkify’s servers as part of the standard verification process.

Checkify receives the result of the verification, such as whether a facial comparison or liveness check was successfully completed and the resulting verification or assurance level.

Because laws relating to biometric information vary between jurisdictions, additional notices or consent mechanisms may be provided where required.

How We Use Your Information

We use personal information received by Checkify to:

• create and manage your Checkify account;
• record verification outcomes;
• create and manage reusable proofs;
• provide proofs that you authorise or request;
• operate and maintain the Services;
• authenticate users and devices;
• protect accounts and prevent fraud or misuse;
• maintain appropriate security and audit records;
• provide customer support;
• process subscriptions, payments and business accounts;
• comply with applicable legal obligations; and
• improve the reliability and security of the Services.

Checkify does not need to receive the underlying identity document or facial image merely to maintain a record that a verification has been successfully completed.

Sharing and service providers

We do not sell personal information. We may share limited information with service providers that help us operate the Services, such as cloud hosting, payment processing, push notification delivery, email, monitoring, and support tools, under appropriate confidentiality and security obligations.

Key providers we use include:

• Render — Render — API and website hosting
• Stripe — Stripe — payment processing for business billing
• Google Firebase Cloud Messaging — Google Firebase Cloud Messaging — push notification delivery
• Apple Push Notification service — Apple Push Notification service — push notification delivery on iOS
• Google Tag Manager — loads and manages website tags according to your cookie preferences (including advertising tags when Marketing is allowed).
• Meta Platforms — advertising measurement and campaign optimisation on public marketing pages when Marketing consent is granted.

We can provide additional subprocessor details on request by contacting privacy@checkify.me.

Website cookies and similar technologies (public website)

On our public marketing websites (including checkify.me and related campaign pages), we may use cookies and similar technologies:

• Necessary — required for security, language preferences, and remembering your cookie choices.
• Analytics — optional. Helps us understand how the public website is used. Used only if you allow Analytics.
• Marketing — optional. Helps us measure advertising campaigns and understand which campaigns led to enquiries. Used only if you allow Marketing.

Where Marketing is enabled, technologies may include Google Tag Manager (container ID GTM-WFXM73W9), which loads tags according to your consent choices, and Meta Pixel (Pixel ID 1460040456030256), used for advertising measurement and campaign optimisation when Marketing consent is granted.

We design campaign conversion events so that form fields such as name, email, phone, date of birth, address, or identity documents are not sent to Meta as part of the Checkify first-party lead event. Meta’s own browser library may still process standard technical signals (such as IP address and device/browser information) under Meta’s terms when the Pixel runs.

You can change or withdraw Analytics and Marketing preferences at any time via Cookie settings on the website.

Automated Verification

Checkify uses automated technology to perform certain verification functions, including document analysis, document validation, facial comparison, liveness checks and other verification processes.

Where supported, these operations are designed to take place locally on your device.

The result of an automated verification may be used to determine whether a particular Checkify proof can be created or issued.

Checkify does not use automated verification results to make unrelated decisions about matters such as credit, employment or insurance eligibility.

Where applicable law provides rights in relation to solely automated decision-making that produces legal or similarly significant effects, we will provide the information and safeguards required by that law.

Legal Bases for Processing

Where UK data-protection law applies, the legal basis we rely upon depends on the purpose for which information is processed.

We may process information where it is necessary:

• to perform a contract with you or take steps at your request before entering into a contract;
• for our legitimate interests in operating, securing and improving Checkify, preventing fraud and protecting users and organisations, where those interests are not overridden by your rights and interests;
• to comply with a legal obligation; or
• where you have provided consent when consent is required.

Where processing involves special-category personal data, including biometric data where it is used for the purpose of uniquely identifying an individual, we will also identify and rely upon an appropriate additional legal condition where required by applicable law.

Where consent is relied upon, you may withdraw that consent in accordance with applicable law. Withdrawal does not affect processing that was lawful before consent was withdrawn.

Data Retention

Checkify’s data-minimisation architecture is designed so that underlying identity evidence used for standard identity verification does not need to be retained on Checkify’s servers.

Identity-document images, facial images and biometric templates used for standard on-device verification are therefore not retained by Checkify’s servers because they are not normally transmitted to Checkify.

Verification records, account information, proofs, security records, billing information and other information received by Checkify are retained only for as long as reasonably necessary for the purposes for which they were collected, including providing the Services, maintaining security and auditability, complying with legal obligations and resolving disputes.

Different categories of information may have different retention periods.

Where information is no longer required, we will delete or anonymise it in accordance with our retention practices and applicable law.

International Data Transfers

Checkify may use service providers located in different countries to operate parts of the Services.

Where personal information received by Checkify is transferred internationally, we use transfer mechanisms and safeguards required by applicable data-protection law where necessary.

Depending on the countries involved, these may include adequacy regulations or decisions, approved contractual safeguards or other legally recognised transfer mechanisms.

You may contact us using the details below if you would like further information about safeguards applicable to international transfers of your personal information.

The underlying identity evidence processed locally on your device as part of standard on-device verification is not transferred internationally by Checkify merely because you perform that verification.

6. Security Measures

We use technical and organisational measures designed to protect personal information, including:

• Encryption in transit for app, API, dashboard, and website traffic using TLS.
• Access controls and least privilege so staff and systems can access only what they need to operate the Services.
• Audit logging and monitoring for security events, verification activity, and operational troubleshooting, designed to minimise unnecessary personal data in logs.
• Secure development practices, dependency review, and security-focused review of critical flows.
• Incident response procedures to investigate, contain, and remediate suspected security incidents.
• Supplier review for key infrastructure and service providers that process data on our behalf.

Our security programme is aligned with ISO 27001 information security management practices, and we are working towards ISO 27001 certification where appropriate for our operating model.

No method of transmission or storage is completely secure. We work to protect information and reduce unnecessary exposure, but we cannot guarantee absolute security.

7. User Rights

Depending on your location and the applicable addendum below, you may have some or all of the following rights:

• Access the personal information we hold about you;
• Correct inaccurate personal information;
• Delete personal information, subject to legal exceptions;
• Object to certain processing;
• Restrict certain processing;
• Request portability of information you provided to us in a structured, commonly used format, where applicable;
• Withdraw consent where processing is based on consent;
• Lodge a complaint with a privacy regulator.

Your rights vary by country and are explained further in the addenda below. Because Checkify is designed to minimise direct identity storage, some records may be linked to UUIDs, device identifiers, sessions, proof requests, or operational logs rather than obvious personal details. We may need additional information to locate relevant records and verify your request.

To exercise your rights, contact: privacy@checkify.me

Account deletion

You may request deletion of your account and associated personal data by contacting privacy@checkify.me.

Where information is stored only on your device, deleting the app or clearing app data may remove that local information. We may retain limited records where required or justified for security, fraud prevention, legal compliance, dispute handling, support, or audit purposes.

Children and Age Assurance

Some Checkify services are specifically designed to help organisations establish whether a person satisfies an age requirement.

As a result, a person who is below a particular age threshold may encounter Checkify as part of an age-assurance process.

Where age assurance is performed, Checkify is designed to disclose only the information required for the relevant proof. For example, an organisation may receive confirmation that an age requirement has or has not been satisfied without receiving the person’s full date of birth or identity document.

The availability of Checkify accounts and particular features to children may be restricted depending on age, jurisdiction and applicable law.

We design age-assurance processing with data minimisation and the privacy of children and young people in mind.

If you believe a child has used the Services in a way that raises a privacy concern, contact us at privacy@checkify.me.

Country-Specific Addenda

The following addenda supplement the global policy for users and businesses in the listed regions. They do not replace the global policy unless applicable law requires otherwise.

8. United Kingdom

For users in the United Kingdom, Checkify Technologies Ltd is the data controller for personal information processed through the Services, unless we tell you otherwise for a specific product or contract.

UK processing is subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

• Legal bases are described in the Legal Bases for Processing section above. Where UK GDPR applies, we identify the applicable basis for each processing purpose and, where special-category data is involved, an additional condition where required.
• UK data subject rights include access, rectification, erasure, restriction, objection, and data portability, subject to applicable exceptions.
• Complaints may be made to the Information Commissioner’s Office (ICO) at ico.org.uk if you are unhappy with how we handle your information.

9. European Union

For users in the European Economic Area, Checkify processes personal information in accordance with the EU General Data Protection Regulation (EU GDPR).

Depending on the activity, we rely on lawful bases such as performance of a contract, legitimate interests, consent, and legal obligation.

• EU data subjects may have rights of access, rectification, erasure, restriction, objection, and portability, subject to applicable exceptions.
• Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
• You may lodge a complaint with your local supervisory authority in the EU member state where you live or work, or where the alleged infringement occurred.

10. Australia

For users in Australia, Checkify handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), where they apply to our activities.

• You may request access to the personal information we hold about you and request correction of inaccurate information, subject to applicable exceptions.
• If you have a complaint about how we handle personal information, contact us first so we can try to resolve it.
• If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

11. Thailand

For users in Thailand, Checkify processes personal data in accordance with the Personal Data Protection Act B.E. 2562 (PDPA), where it applies to our activities.

• We may rely on lawful bases such as consent, contract, legal obligation, legitimate interests, or other bases recognised under the PDPA, depending on the processing activity.
• Subject to applicable exceptions, you may have rights to access, rectify, erase, restrict, object to, or withdraw consent for certain processing, and to request data portability where applicable.
• If you believe your rights under the PDPA have been infringed, you may contact us first and, where applicable, lodge a complaint with the Personal Data Protection Committee or other competent Thai authority.

12. Canada

For users in Canada, Checkify handles personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), where it applies, and with applicable provincial privacy laws where relevant to our activities.

• You may request access to personal information we hold about you and request correction of inaccurate information, subject to applicable exceptions.
• If you have a privacy complaint, contact us first so we can review and respond.
• You may also complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to a relevant provincial privacy commissioner where applicable.

13. United States

For users in the United States, privacy rights depend on federal law and the state where you live. Checkify does not represent that every GDPR-style right applies nationwide unless we specifically support that right for your request and location.

Where applicable state privacy laws apply—such as the California Consumer Privacy Act as amended by the CPRA—residents may have rights to know, access, delete, correct, or opt out of certain processing, subject to legal exceptions and the scope of the law.

• We do not sell personal information as defined by applicable US state privacy laws, and we do not use personal information for cross-context behavioural advertising.
• California residents may have additional rights regarding sensitive personal information and authorised agent requests, where applicable.
• If you wish to exercise US privacy rights, contact us with enough information for us to verify your request and determine which state rules apply.

Changes to this policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date above when changes are made.

If changes are material, we will provide additional notice where appropriate.

Contact us

Questions about this Privacy Policy or our privacy practices can be sent to:

Entity: Checkify Technologies Ltd
Email: privacy@checkify.me
Website: checkify.me

Contact: privacy@checkify.me