Last updated: June 2026

Privacy Policy

This policy explains how RoxVerify collects, uses, stores, and protects personal data — and the rights you have over your information.

Scope

This Privacy Policy applies to RoxVerify's website, platform API, and identity verification services. It covers personal data processed on behalf of our business customers ("Controllers") and personal data we collect about visitors to our website.

1. Who we are

RoxVerify provides identity verification, AML screening, and fraud prevention services to businesses operating in regulated industries. In providing these services, RoxVerify acts as a Data Processor on behalf of its business customers, who are the Data Controllers responsible for the lawful basis of processing end-user personal data.

2. What data we process

Identity documents (images and extracted structured data)

Biometric data: selfie images, facial geometry templates

Liveness check metadata (passive signals, session timing)

Device and network signals (IP address, device fingerprint, browser characteristics)

Verification outcome data (pass/fail, fraud signals, AML match results)

Website usage data (analytics, cookies — with consent)

3. Legal basis for processing

RoxVerify processes personal data under instruction from its business customers, who determine and document the applicable legal basis under GDPR Article 6 and Article 9 (for biometric data). Common bases include: performance of a contract, legal obligation (AML/KYC regulations), and explicit consent.

4. Data retention

Verification session data is retained for the period specified in the customer's Data Processing Agreement (DPA), subject to a maximum of 7 years to satisfy regulatory retention obligations under AML law. Biometric templates are deleted immediately upon session completion unless explicitly retained under a signed data retention addendum. Customers may configure shorter retention periods via the API.

5. International data transfers

RoxVerify operates infrastructure in the EU, United States, and Asia-Pacific. Data transfers outside the EEA are made under Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by technical and organisational measures. Regional data residency is available for enterprise customers on request.

6. Your rights

Depending on your jurisdiction, you may have rights including:

Right of access to your personal data

Right to rectification of inaccurate data

Right to erasure ("right to be forgotten")

Right to restrict processing

Right to data portability

Right to object to processing

To exercise your rights, contact the business that asked you to verify your identity — they are the Data Controller. You may also contact us at privacy@roxverify.io and we will route your request appropriately.

7. Contact

For privacy enquiries: privacy@roxverify.io. For our Data Processing Agreement template or to appoint RoxVerify as a sub-processor, contact your account manager or reach our team.