Biometric Consent Disclosure

Who This Applies To

This Disclosure applies to anyone who completes identity verification through Truvee (the "Service"). It explains how biometric information is collected, used, and protected, and provides specific notices required by:

• Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/1 et seq.
• Texas Capture or Use of Biometric Identifier Act (CUBI), Tex. Bus. & Com. Code §503.001
• Washington Biometric Privacy Law, RCW 19.375
• New York City Biometric Identifier Information Law
• California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)

By proceeding with identity verification, you acknowledge that you have read this Disclosure, understand it, and consent to the collection and use of your biometric information as described below.

1. What Is Biometric Information

Biometric information includes:

• Facial geometry (measurements derived from your photograph)
• Liveness detection data (movements during the live face check)
• Photographs of government-issued identification documents
• Photographs taken during live verification (selfies)

2. Who Collects Your Biometric Information

Your biometric information is collected and processed by Stripe Identity, a service of Stripe, Inc. ("Stripe"). Truvee does NOT directly collect, store, or process raw biometric template data, facial geometry, or liveness scores.

Stripe's biometric processing is governed by:

• Stripe Privacy Policy: stripe.com/privacy
• Stripe Identity Privacy Notice: stripe.com/legal/identity-privacy

By proceeding, you also consent to Stripe's collection and processing of your biometric data under their terms.

3. What Truvee Receives from Stripe

After Stripe completes verification, Truvee receives:

• Your verified legal name
• Your country and document type
• Verification status (verified, requires_input, canceled)
• Verification timestamp
• Photographs of your government ID (front and back) and your live selfie, held by our regulated verification provider

These images are embedded into the sealed verification PDF and stored in our secure cloud storage (AWS S3).

Truvee does NOT receive:

• Raw biometric templates
• Facial geometry measurements
• Liveness detection scores
• Any data Stripe uses internally to perform the match

4. Purpose of Collection

Biometric information is collected solely to:

• Verify your identity at the request of a sender
• Confirm you are the same person depicted on your government-issued ID
• Generate a tamper-evident sealed proof of identity shared with the sender and recipient
• Comply with applicable legal and audit obligations

We will NOT use your biometric information for:

• Marketing
• Advertising
• Profiling or behavioral analysis
• Training artificial intelligence or machine learning models
• Sale or transfer to third parties (except sub-processors listed in our Privacy Policy)

5. Retention Schedule

In compliance with BIPA, CUBI, and similar laws, Truvee maintains the following retention schedule:

• Biometric template data (held by Stripe): Retained per Stripe Identity's policy, typically not retained after verification completes
• Government ID and selfie photographs (held by Truvee in sealed PDFs): Retained for seven (7) years from the date of verification, or until the purpose for which the information was collected has been satisfied, whichever occurs first

After the retention period expires, Truvee will permanently delete or destroy biometric photographs from our systems and backups.

You may request earlier deletion at any time by contacting sales@truvee.net or visiting truvee.net/data-deletion.

6. Storage and Security

Biometric photographs (where retained) are protected by:

• AES-256 encryption at rest in AWS S3
• TLS 1.2+ encryption in transit
• Restricted access controls
• Audit logging
• Access limited to authorized personnel and the verification parties (sender and recipient)

7. Sharing

Biometric photographs embedded in sealed PDFs are shared with:

• The sender of the verification (the person who requested it)
• The recipient (you)

We do NOT sell, lease, trade, or otherwise profit from your biometric information.

We may disclose biometric information only:

• To sub-processors necessary to operate the Service (listed in our Privacy Policy)
• To comply with a valid subpoena, court order, or legal obligation
• To protect against fraud, abuse, or imminent harm
• With your explicit written consent

8. Your Rights Under BIPA (Illinois Residents)

If you are an Illinois resident, you have the right to:

• Receive written notice of biometric data collection (this Disclosure)
• Provide written consent before collection (your acceptance of this Disclosure)
• Know the specific purpose and length of collection and storage
• Request deletion of biometric data
• Sue for statutory damages if your rights are violated ($1,000 negligent / $5,000 intentional, plus attorneys' fees)

To exercise BIPA rights, contact sales@truvee.net.

9. Your Rights Under CUBI (Texas Residents)

If you are a Texas resident, you have the right to:

• Receive notice before collection
• Consent to collection
• Have your biometric identifier destroyed within a reasonable time, but no later than the first anniversary of the date the purpose for collecting the identifier expires (subject to Section 5 retention schedule above)

To exercise CUBI rights, contact sales@truvee.net.

10. Your Rights Under Washington Law

If you are a Washington resident, you have the right to:

• Receive notice of biometric enrollment
• Consent to enrollment
• Receive disclosure of the purpose of enrollment
• Have biometric identifiers retained no longer than necessary for the disclosed purpose

To exercise Washington biometric rights, contact sales@truvee.net.

11. Your Rights Under CCPA/CPRA (California Residents)

Biometric information is "Sensitive Personal Information" under CPRA. California residents have the right to:

• Know what biometric information is collected
• Delete biometric information
• Limit use of sensitive personal information to that which is necessary to perform the Service
• Opt out of sale or sharing (Truvee does not sell or share biometric data)

To exercise CCPA/CPRA rights, contact sales@truvee.net.

12. Consent

By clicking "I consent to the biometric verification" and proceeding through the verification flow, you acknowledge:

• You have read and understood this Disclosure
• You are at least 18 years old
• You voluntarily consent to the collection, use, storage, and (where applicable) disclosure of your biometric information as described
• You consent to Stripe's processing of your biometric information under Stripe's privacy terms
• Your consent is informed, specific, and freely given

You may withdraw consent at any time by contacting sales@truvee.net. Withdrawal of consent will not affect verifications already completed but will trigger deletion of stored biometric photographs subject to legal retention requirements.

13. What Happens If You Do Not Consent

You are not required to use the Service. If you do not consent to biometric verification, you may decline and will not be charged. The verification request will be returned to the sender as incomplete.

14. Changes to This Disclosure

Material changes will be posted with a revised "Last updated" date. We will not retroactively change the terms of biometric collection without obtaining renewed consent.

15. Contact

For biometric privacy questions, complaints, or to exercise your rights:

Truvee LLC
Attn: Biometric Privacy Officer
210 Executive Drive, Suite 300
Cranberry Township, PA 16066
sales@truvee.net

For Illinois residents, you may also contact the Illinois Attorney General. For Texas residents, the Texas Attorney General. For Washington residents, the Washington Attorney General. For California residents, the California Privacy Protection Agency.