Privacy Policy

Two roles we play

For our website, sales conversations and customer accounts, we decide how personal information is used and we are responsible for it.

For evidence submitted through Truvasse (documents, files, identity images and the reviews of them), we act on behalf of the organisation that requested the evidence. That organisation decides why the evidence is collected and what happens to it, and its own privacy notice applies. If you submitted evidence to an organisation and have a question about it, please contact that organisation first. We will help them respond.

Information we collect

From website visitors:

• Pages visited, how you arrived, approximate location derived from your IP address, and device and browser type, collected through Google Analytics on our public pages only. Analytics is never loaded inside the signed-in platform or on evidence upload links.
• Anything you send us, such as a demo request, an email or your contact details.

From customer organisations and their users: name, work email, organisation, role, answers to onboarding questions, sign-in and security information, and a record of actions taken in the platform.

From people submitting evidence at an organisation's request: the documents and files you upload, information embedded in those files (for example their creation and modification dates), the time of capture or upload, basic device and browser information, your location only where the organisation has enabled it and you have permitted it, and, where the organisation uses identity verification, images of your identity document and of your face. The organisation's reviewers may add notes, questions and decisions to your case.

Biometric information

When an organisation uses Truvasse identity verification, a live image of your face may be compared with the photo on your identity document to help the organisation confirm your identity. The organisation that requests the check is responsible for giving you any notice and obtaining any written consent the law requires before the check runs.

We use facial images and any measurements derived from them only to perform the verification the organisation requested. We never sell, lease, trade or otherwise profit from biometric information, never use it for advertising, and never use it to train models for anyone else.

Biometric information is kept only as long as the organisation needs it for the purpose it was collected and its record-keeping obligations. It is permanently destroyed when that purpose has been met, on the organisation's instruction, or at the latest three years after your last interaction with the organisation, whichever comes first, unless a court order or law requires us to keep it longer.

How we use information

• To provide, secure and support the Truvasse platform for customer organisations.
• To run forensic analysis on submitted evidence and present the results to the organisation's authorised reviewers.
• To keep an accurate, tamper-evident record of what was received, what was found and what was decided.
• To respond to enquiries, arrange demos and communicate with customers.
• To understand how our public website is used so we can improve it.
• To meet legal obligations and protect the rights and safety of our customers, users and the public.

Truvasse does not make decisions about people. It surfaces findings, and a person at the customer organisation makes every decision. We do not sell personal information and we do not share it for cross-context behavioural advertising.

How we share information

• With the customer organisation that requested the evidence, and with the users that organisation authorises.
• With service providers that host and operate Truvasse on our behalf, under contracts that limit their use of the information. They are listed on our Subprocessors page.
• When the law requires it, or to protect the rights, property or safety of Truvasse, our customers or others.
• As part of a merger, acquisition, financing or sale of assets, in which case the information stays subject to commitments at least as protective as these.
• With your consent or at your direction.

Cookies

Our use of cookies is explained in our Cookie Policy.

How long we keep information

• Website analytics: for the retention period set in Google Analytics, and no longer than 14 months.
• Customer account information: for as long as the account is active, then for a limited period to meet legal, tax and audit obligations.
• Evidence and review records: as instructed by the customer organisation and set out in its agreement with us. Biometric information follows the stricter schedule above.

How we protect information

Security measures are described on our Security and Compliance page. No system is perfectly secure, and we will notify affected customers without undue delay if we become aware of a breach affecting their data, as the law and our agreements require.

Where information is processed

Our shared cloud service uses providers based in the United States. Organisations with a dedicated deployment may choose where their data is hosted. Where personal information moves between countries, we rely on appropriate safeguards such as contractual protections.

Your rights

Depending on where you live, including under the EU and UK GDPR, the Nigeria Data Protection Act 2023 and US state privacy laws such as the California Consumer Privacy Act, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain uses, and to withdraw consent. To make a request, email hello@truvasse.com. We will not discriminate against you for exercising your rights.

If your request concerns evidence you submitted to an organisation, we will pass it to that organisation, which decides how to respond. You may also complain to your local data protection authority.

Children

Truvasse is a business service and is not directed to children. We do not knowingly collect personal information from children for our own purposes.

Changes and contact

We will post any changes to this policy on this page and update the effective date. If a change is significant we will tell customers directly.

Questions about this policy or our privacy practices: hello@truvasse.com.