Privacy Policy

1. Introduction

Bear Cart Limited ("we," "our," or "us") operates the Verify by AML HQ mobile application ("App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App for identity verification services.

By using our App, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our App.

2. Information We Collect

2.1 Identity Verification Data

To provide identity verification services, we collect and process the following information through the Veriff SDK:

• Camera Access: Photos and videos of your identity documents (passport, driver's license, etc.) and facial images for verification purposes
• Microphone Access: Audio recordings during the verification process as required by our verification procedures
• NFC Data: Information read from NFC-enabled identity documents when available and used for enhanced verification
• Document Information: Text and data extracted from your identity documents
• Biometric Data: Facial recognition data used for identity verification

2.2 Facial Data and Biometric Information

2.3 Device Information

We collect limited device information including:

• Device Fingerprint: A unique identifier used solely to identify existing user sessions. This fingerprint is not saved permanently and is not used for tracking across sites or for marketing purposes
• Technical Information: Device model, operating system, app version, and other technical details necessary for app functionality

3. How We Use Your Information

We use the collected information for the following purposes:

• To verify your identity as requested
• To comply with legal and regulatory requirements
• To prevent fraud and enhance security
• To improve our verification services
• To provide customer support
• To maintain and improve app functionality

3.1 Specific Uses of Facial Data

Facial and biometric data is used specifically for:

• Identity verification by comparing your face to identity documents
• Fraud prevention and detection to identify suspicious activity
• Duplicate account prevention by checking against previous verifications
• Ongoing authentication services for account access when required
• Document-to-face matching to confirm identity authenticity
• Compliance with KYC/AML regulatory requirements

4. Information Sharing and Disclosure

4.1 Veriff Partnership

We use Veriff OÜ as our identity verification service provider. The data you provide during verification, including facial and biometric data, is transmitted to and processed by Veriff in accordance with their privacy policy. Veriff processes this data on our behalf to provide identity verification services.

Data Processing Locations: Veriff processes facial and biometric data on secure servers located in the European Union, with appropriate safeguards in place to ensure compliance with EU data protection laws including GDPR.

4.2 Other Disclosures

We may share your information in the following circumstances:

• With your explicit consent
• To comply with legal obligations, court orders, or government requests
• To protect our rights, privacy, safety, or property
• In connection with a merger, acquisition, or sale of assets

5. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Verification data is typically retained for regulatory compliance purposes.

5.1 Facial Data Retention

Device fingerprints are used only during active sessions and are not permanently stored.

6. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet or electronic storage is 100% secure.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access to your personal information
• Correction of inaccurate information
• Deletion of your information (subject to legal requirements)
• Restriction of processing
• Data portability
• Objection to processing

To exercise these rights, please contact us using the information provided below.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure that such transfers are conducted in accordance with applicable data protection laws and that appropriate safeguards are in place.

9. Children's Privacy

Our App is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you become aware that a child has provided us with personal information, please contact us immediately.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy in the App and updating the "Last Updated" date. Your continued use of the App after such changes constitutes acceptance of the updated Privacy Policy.

11. Contact Information

12. Regulatory Compliance

We are committed to complying with applicable data protection laws, including the General Data Protection Regulation (GDPR) for EU residents and other relevant privacy regulations in jurisdictions where we operate.