LAST UPDATED: 24 AUGUST 2021

Youverse simplifies all consumer interactions with secure and private identity and face verification on any device in industries as diverse as Retail, Banking & Payments, Travel & Hospitality, Healthcare, Self-Service & Delivery. Register once and access services anywhere, anytime by just using your face. The information we collect and use helps us with that mission—and that’s it. At Youverse, when we perform identity and face verification (our “Identity and Face Verification Services“), we’re committed to protecting the privacy of that person. This Privacy Policy is meant to help you understand how we use the information we collect to provide our Identity and Face Verification Services on behalf of our clients and build trust in our system. When we provide Identity and Face Verification Services to our clients, we are acting on their behalf as their service provider and processor. Our clients, and not us, are the controllers of the data you submit when interacting with our Identity and Face Verification Services. For additional information about how your specific data is being collected and used, please review the privacy policy of our client who is using our Identity and Face Verification Services with you.

For details about the information we collect on our websites and online platforms, including how we use cookies, please visit our Cookie Policy.
We may need to update this Privacy Policy from time to time, so we recommend you check back periodically. If we make any substantial changes, we may notify you via email or by posting a notice on our website.

Definitions

For the purposes of this Privacy Policy:

• Company (referred in this Agreement as either “we“, “us“, “our” or “Youverse”) refers to YOONIK – AUTHENTICATION AND PRIVACY SYSTEMS, S.A..
• Services refer to the websites, mobile applications, software development kits and other products and services that have linked to these Agreement offered by YOONIK – AUTHENTICATION AND PRIVACY SYSTEMS, S.A..
• You mean the individual accessing or using the Services, or the company, or other legal entity on behalf of which such individual is accessing or using the Services, as applicable.

The Information We Collect and the Youverse Identity and Face Verification Lifecycle

To provide our Identity and Face Verification Services, we need to collect certain information about our clients’ users or directly from our users. The exact information that is needed depends on the check that’s being carried out: (1) for online authentication, our services will need to receive an id/username as well as a picture or video of their face. We’ll then seek to verify whether the person in the photo or video is likely the same person that is registered with the provided id/username; (2) for verification of ID document/Passport, our services will need to receive a live photo of the user as well as the user photo in their ID document/Passport. We will then seek to verify whether the person in the live photo is likely the same person in the photo of the ID document/Passport.

In order to do the case (1) explained above, at registration time, we store the id/username, and we generate and store an encrypted version of the biometric template from the provided photo. This biometric template is created using proprietary deep learning models and cannot be reversed to the original image. After creating the biometric template, the user photo is deleted. After the registration process/ first time use, we generate a biometric template for each new query photo and compare it against the registration template to check if it is likely to be a match. We do not store any user photos. We may store additional user information like name and e-mail when the user explicitly submits this information.

The Youverse Identity and Face Verification Lifecycle below shows the different sources of the information that we collect.

1. The Client
   Clients are organizations that have asked Youverse to perform identity and face verification for a user. Once we have run our checks, we share the results with the client. The client then decides how they want to proceed with the user based on the results.
2. The User
   Users are individuals whose accounts we authenticate using facial biometrics on behalf of our clients or directly with us. We collect users’ information from clients or directly from the users themselves. This information might include the biometric facial identifiers extracted by Youverse (biometric templates) from photos or a video provided by the user and/or their username/id. This enables us to help the client authenticate the user by using their face.
3. Usage logs
   We also keep logs of how our clients and users interact with our Services. This might include timestamps of when the information was submitted to Youverse, and information about the device used to submit that information.

Sometimes, we receive information we don’t need to provide our Services. For example, instead of a picture of their face, a user might upload a completely unrelated image. When this happens, we seek to delete this data.

Using Information for our Identity and Face Verification Services

We use information to provide and maintain our Identity and Face Verification Services on behalf of clients on the basis that the user has consented to the processing or otherwise requested Identity and Face Verification Services, the client has a legitimate or lawful reason for requesting Identity and Face Verification Services, or the processing is necessary to carry out a task in the public interest or for reasons of substantial public interest.

We also use information to further develop our Identity and Face Verification Services on the basis that the processing is necessary in the legitimate interest of the client or Youverse, the processing is necessary to carry out a task in the public interest or for reasons of substantial public interest, the processing is necessary for scientific research purposes, or the user has provided their consent.

Sharing Information Outside Youverse

As well as sharing information with clients and users (as described above), Youverse also shares information with with other organizations, government bodies, and individuals outside Youverse where we have a legitimate legal reason for doing so (for example, in connection with any merger or acquisition or to comply with a court order) or where we have been instructed to share the information on behalf of our clients.

Whenever legally possible, we seek to protect the information we share by imposing contractual privacy and security safeguards on the recipient of the information. This is particularly important in cases where the recipient is located in a country that has different or lesser privacy laws than those of the country where the information was originally collected. In some cases, however, it’s not possible for us to do so — for example, when we have a legal obligation to disclose information to a government authority and that government authority isn’t willing to enter into such contractual safeguards.

Information Security

Youverse takes appropriate administrative, physical, technical and organizational measures designed to help protect information about users from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction. If you think you have identified a security vulnerability or bug in our Identity and Face Verification Services, please report it to the Youverse support team at support@youverse.id.

Data Storage

We perform our Identity and Face Verification Services on behalf of our clients for a variety of different reasons. Those reasons are identified by our clients, and we rely on them to tell us when they no longer need us to store the information we’ve collected on their behalf. Once instructed, either through our agreement with the client or through an ad hoc request, we delete the information we have collected about users when performing the requested Identity and Face Verification Services.

If you, as a user, would like to make a specific request to have your information deleted, please make that request directly to the client that carried out your related check. In case you have registered directly with Youverse, please make the request to us. For more information about how to do this, please see below under “Your Rights”.

Where we have a legitimate legal reason, we may also store information for longer than described above – for example, where we are under a binding legal order not to destroy information.

Your Rights

If you would like to access a copy of, delete, or otherwise exercise control over your personal information, please contact Youverse at support@youverse.id. Please be aware, for most requests Youverse may need to notify the relevant client (as described above in the Youverse Identity and Face Verification Lifecycle) so the client (and not Youverse) may fulfill the request. This is necessary where Youverse is acting on the client’s behalf.

Contact Youverse or a Privacy Supervisory Authority

If you would like more information about how Youverse collects and uses information, please contact Youverse at support@youverse.id.

If you’d like to raise a concern with a Privacy Supervisory Authority in a member state of the European Union, a list of contact points is available here.