Privacy notice

If you are verifying your identity with a business that uses OKYC, that business decides why your data is collected and is responsible for it (the data fiduciary). We process your data on its behalf and only on its instructions (as a data processor). Questions about why a business asked for your details, or what it does with the result, are best sent to that business; we will help them answer.

If you use our dashboard, documentation or this website, we are responsible for the data described below.

When you verify your identity or business, depending on the steps the business asks for:

• details you enter, such as your name, date of birth, address, mobile number, email, PAN, bank account or company numbers;
• documents and photos you provide, and the details we read from them;
• a selfie and short video frames for liveness and face matching;
• data you choose to share from Aadhaar (Secure QR or Offline XML) — we keep only the last four digits of the Aadhaar number, never the full number;
• technical data such as IP address, device and browser type, used for security and fraud prevention;
• your consent, with the time it was given.

For dashboard users we collect account details (name, work email, organisation) and a record of actions taken. On this website and our documentation we collect anonymous usage statistics without cookies.

• to carry out the verification the business asked for and give it the result;
• to detect fraud and keep the service secure;
• to meet legal obligations, including record-keeping required of the businesses we serve;
• for dashboard users and visitors: to run the service, support you and understand how it is used.

We do not sell personal data and do not use verification data for advertising.

The verification flow asks for your consent before any data is collected, and states the purpose. You can withdraw consent by contacting the business that asked you to verify, or us; withdrawal does not affect processing already done, and some records may have to be kept where the law requires it.

Verification data is stored and processed in India (DigitalOcean, Bengaluru region) and is encrypted with keys separate for each business. It is not transferred outside India, except as described under service providers below.

• DigitalOcean — hosting, in India.
• Cloudflare — secure network connection to our services.
• PostHog (EU) — anonymous usage statistics for this website, our documentation and the dashboard; never verification data.
• Government sources and verification partners, where a business’s workflow uses them, only for the check requested.

Verification data is deleted after the retention period set by the business, within the limits the law allows (for India, 180 days by default). Records a business must keep by law may be kept longer on its instructions. Dashboard account data is kept while the account is active.

We use encryption in transit and at rest, per-business encryption keys, access controls and audit logs. If a personal data breach occurs, we will notify the affected business and the authorities as the law requires.

Under India’s Digital Personal Data Protection Act you can ask for a summary of your data, its correction or erasure, and nominate someone to exercise your rights. For verification data, contact the business you verified with or write to us and we will pass your request on. You can also raise a grievance with us, and if unresolved, with the Data Protection Board of India.

Write to [email protected]. We aim to respond to grievances within the time the law requires.

We will update this notice when our practices change and show the date of the latest version above.