Privacy Policy
Verity lets you prove one fact about yourself without handing over the rest. This policy explains what we hold, why, and what you can do about it.
What we collect
We hold only what you give us and what the service generates for you:
- Account: your username and a salted password hash. We never store your password.
- Identity details you enter: for example name, date of birth, address, ID number, phone and a photo reference. Each fact is encrypted separately before it is stored.
- Proofs you create: which fact types were shared, with which organisation, under which law, and when the code was issued, used or expired.
- Check records: when a verifier opens a proof, we record who looked, when, and the outcome.
- Technical data: standard server logs (IP address, time, request path) used to keep the service secure.
How we use it
We use your data to run the service you asked for: signing proofs, showing a verifier only the facts you approved, applying the legal rules for the countries involved, showing you your history, and defending the service against abuse.
We do not sell personal data, use it for advertising, or build profiles from it.
Why we may use it (lawful basis)
Each use of your data rests on one legal basis, shown on screen before you share:
- Legal obligation: most proofs (bank, insurance, demat, wallet, loan, SIM, hotel, age checks) are shared because a law requires the organisation to know those facts, for example India’s PMLA 2002 and RBI KYC rules, or the EU AML rules.
- Consent: some proofs, such as an employment check in India, rely on your consent. Withdrawing it stops future sharing, but cannot recall data an organisation must keep by law.
- Running your account: your login, settings and history are needed to provide the service.
What a verifier sees
When you create a proof, you choose the organisation and the facts. The verifier receives a signed, one-time credential that contains only those facts. Everything else is replaced with a salted SHA-256 hash that cannot be reversed. A code works once and expires after ten minutes.
Verifiers must sign in, and a code can only be opened by the organisation it was issued to. Each check is written to an audit log that you can see in your history.
Each proof also states who checked your identity, how, when, and when a fresh review is due. It is not a V-CIP and does not replace the receiving organisation’s own due diligence: under Indian and EU law that organisation stays responsible for its KYC.
How it is protected
Identity facts are encrypted with AES-256-GCM using per-record data keys that are wrapped by a key held in AWS Key Management Service. Proofs are signed with ML-DSA-87 (NIST FIPS 204) by a key that never leaves AWS KMS. Connections use TLS. See the Security page for detail.
Verifications are recorded on the Ethereum Sepolia test network once a day, as a single batch fingerprint (a Merkle root) covering everyone verified that day. Nothing per person goes on chain, as EU regulators recommend (EDPB Guidelines 02/2025 on blockchain). Your own fingerprint in that batch is built from a secret kept only in our database; when your record is finally deleted the secret goes with it, and the on-chain batch can no longer be linked to you. You can download your proof of inclusion from the Account page. Records made before this change used one hash per verification; they hold no readable data but cannot be removed from the chain.
If you enter an Aadhaar number, we keep only its masked form (XXXX XXXX 1234), as the Aadhaar Act requires. We never store Aadhaar biometrics or XML.
Retention and deletion
We keep your identity details while your account is open. Proof codes expire after ten minutes.
- When you close your account (Account → Close my account), your login, settings and chats are deleted at once.
- A verified KYC record is evidence a regulated reviewer created, and the law requires it to be kept for 5 years after the relationship ends (PMLA s.12 in India; EU AML rules). We keep it locked, unlinked from your username and never shared, then delete it automatically. The closing screen tells you the exact date.
- Records of who checked your proofs are kept without your details, as an audit trail.
- Anything never reviewed is deleted immediately.
Service providers and transfers
We run on Amazon Web Services in the Asia Pacific (Mumbai) region, which hosts the application, the database and the encryption keys. Your country is worked out from your connection, on our server, only to apply the right law.
If an organisation is in another country, you are told before sharing and asked to agree to that transfer for that one proof. A transfer your home law forbids, such as an Aadhaar number leaving India, is blocked and nothing is shared.
Your rights
Depending on where you live (including under India’s Digital Personal Data Protection Act, 2023 and the EU/UK GDPR), you may have the right to access, correct, erase and export your data, to withdraw consent, to object to processing and to complain to a regulator.
You can download a copy of your data and close your account yourself from the Account page. For anything else, contact the privacy contact to be published before launch. We will answer within the time the law allows.
Children
Verity is not intended for people under 18, and we do not knowingly collect their data.
Grievances and contact
Grievance officer: to be designated before launch.
Operator: to be published before launch.
Privacy requests: the privacy contact to be published before launch.
Changes to this policy
If we make a material change we will update the date above and tell signed-in users before it takes effect.