CycurID Privacy Policy
How CycurID collects, uses, stores, and discloses personal information — both for our own website and accounts, and when we process identity data on behalf of our business clients.
Last updated November 5, 2026
Overview
This Privacy Policy explains how CycurID Technologies Ltd. and CycurID Technologies USA Ltd. (“CycurID”, “we”, “us”, “our”) handle personal information. It applies to our website, our merchant portal and dashboard, our APIs and SDKs, and the identity verification, screening, and credential services we provide (together, the “Services”).
CycurID provides identity infrastructure to businesses. Most of the personal information we handle does not belong to our own customers — it belongs to the individuals those businesses ask us to verify. Because our obligations differ depending on which of those two situations applies, this policy is organised around that distinction and says which parts apply to whom.
If you were asked to verify your identity by a company using CycurID, that company decides what is collected and why. Start with that company for questions about your verification, and see “Your rights” below for what you can ask us directly.
The Two Roles We Act In
As a controller
We decide the purposes and means of processing for: visitors to our website; individuals who contact us, request a demo, or subscribe to communications; and the staff of our business clients who hold accounts in our portal. For this information, CycurID is the controller (and, under Canadian law, the organisation accountable for it).
As a processor
When a business client runs an identity verification, a sanctions or politically exposed person screening, or an on-chain address check through our Services, that client determines why the check is run and what it collects. CycurID acts as a processor (a service provider) on that client’s instructions, under a written agreement. The client remains the controller of that personal information and is responsible for having a lawful basis to collect it and for giving notice to the individual.
Where this policy describes processor activities, our client’s own privacy notice governs the relationship with the individual. This policy describes what we do with the information in our role, and the rights you can exercise with us directly.
Definitions
- “Personal information” is information about an identifiable individual. It includes biometric information and identity document data.
- “Biometric information” means a facial image, a selfie or liveness capture, and any mathematical representation derived from them — including the facial templates we generate and store to match one face against another.
- “Applicant” means an individual who completes an identity verification through a CycurID client’s flow.
- “Client” means a business that has contracted with CycurID to use the Services.
- “De-identified data” is data from which direct identifiers have been removed or masked so that it no longer identifies an individual.
Personal Information We Collect
From website visitors and account holders (controller)
- Contact details you give us: name, business email address, telephone number, company, and the content of your enquiry.
- Account details for portal users: username, authentication credentials, API credentials, and account activity.
- Technical information collected automatically: IP address, browser and device characteristics, pages viewed, and referring pages.
From applicants verified through a client’s flow (processor)
- Identity document images, which may include a passport, driver’s licence, national identity card, or residency permit, captured front and back where the issuing country requires it.
- Data extracted from those documents, which may include full name, date of birth, document number, issuing country, expiry date, and the machine readable zone.
- Selfie and liveness captures, and the facial templates derived from them (see “Biometric information” below).
- Applicant details submitted alongside the document, which may include address, postcode, country, nationality, telephone number, email address, and a government identifier such as a social security number where the client’s flow requires it.
- Verification outcomes and supporting results, including document checks, liveness and face match results, age and jurisdiction rule outcomes, and sanctions or politically exposed person screening matches with their source datasets.
- Session and technical metadata, including IP address, the identifier the client uses for you, timestamps, and the configuration applied to the verification.
Where a client uses our on-chain intelligence Services, we also process blockchain addresses and transaction data submitted for risk scoring. Blockchain data is public and is not, on its own, information we obtain from you.
Biometric Information
We store biometric information. When you complete a verification that includes a liveness or selfie step, we create a facial template from your image and retain it so the same person can be recognised across later verifications.
The facial template is a mathematical representation of facial features. We use it to confirm that a live person is present, to compare a selfie against the photograph on a submitted identity document, and to detect whether the same individual has already enrolled — which is how duplicate and synthetic identity fraud is caught. Matching is performed against the templates we hold.
We do not sell biometric information, and we do not use it for advertising, profiling unrelated to identity verification, or training third party systems.
Where the law of your jurisdiction requires your express consent before biometric information is collected or a mathematical representation of it is created, that consent is obtained before capture, and you may decline. Declining may mean the business that asked you to verify cannot complete your verification by this method. Quebec residents: the creation of a biometric database is subject to notification requirements under provincial law, and we handle biometric information accordingly.
Biometric information is retained as described under “Data retention”. If you want your biometric information deleted, see “Your rights”.
How We Use Personal Information
- To perform identity verification, liveness and face matching, and document authenticity checks requested by a client.
- To screen applicants against sanctions, watchlist, and politically exposed person data, and to re-screen where a client has configured ongoing monitoring.
- To detect and prevent fraud, including duplicate enrolment, synthetic identities, and presentation attacks such as photographs, masks, and deepfakes.
- To produce the audit records our clients rely on to meet their own anti-money laundering and know-your-customer obligations.
- To operate, secure, support, and improve the Services, including diagnosing faults and preventing abuse.
- To administer accounts, billing, and the business relationship with our clients.
- To respond to enquiries, and — only where you have consented — to send commercial communications, which you can stop at any time.
- To comply with legal obligations and to establish, exercise, or defend legal claims.
We do not use applicant personal information for our own marketing, and we do not make it available to other clients.
Legal Bases for Processing
In Canada, we rely on consent, obtained by us or by the client on whose behalf we act, and on the exceptions to consent that Canadian privacy law provides — including processing for the detection and prevention of fraud.
Where the General Data Protection Regulation applies, the lawful bases are: performance of a contract; compliance with a legal obligation to which our client is subject; our and our clients’ legitimate interests in preventing fraud and securing the Services; and, for biometric information, your explicit consent or another condition permitted for special category data.
Where consent is the basis, you may withdraw it at any time. Withdrawal does not affect processing already carried out, and may prevent the Services from being provided to you.
How We Disclose Your Information
WE DO NOT SELL YOUR PERSONAL INFORMATION OR DISCLOSE IT TO THIRD PARTY MARKETERS.
- To the client who requested the verification. Verification outcomes, and the applicant data the client’s flow was configured to collect, are returned to that client.
- To service providers and sub-processors who host our infrastructure, supply watchlist and sanctions data, or support the Services. They act on our instructions under contract and may not use the information for their own purposes.
- Within CycurID, to employees who need access to operate, support, or audit the Services, and to our affiliates where permitted by this policy.
- To regulators, law enforcement, and other authorities where required or permitted by law, including to respond to lawful requests and legal process.
- To protect rights, property, or safety, to prevent financial loss, or in connection with the investigation of suspected or actual illegal activity.
- In a business transaction such as a merger, acquisition, or sale of assets, limited to what the transaction requires and subject to appropriate protections.
Email and text communications. We will not send you marketing or commercial electronic messages unless you have given explicit consent. Every such message carries an unsubscribe link.
Where Your Information Is Stored
CycurID uses Canadian-region infrastructure to support its identity verification Services.
Information may be accessed from, or transferred to, other countries where we, our affiliates, or our service providers operate. Where information is transferred out of the jurisdiction in which it was collected, we put appropriate safeguards in place, and the information may be subject to lawful access requests by the courts and authorities of the receiving country.
Data Retention
We keep personal information only as long as necessary for the purposes described in this Privacy Policy, and to comply with applicable legal, regulatory, and contractual obligations — including the record keeping periods that anti-money laundering law imposes on our clients and on us.
Retention periods vary by jurisdiction and by the agreement with the client on whose behalf the information was processed. Certain records may be retained for five years or longer where law or a client’s own obligations require it.
This applies to biometric information, identity documents, extracted document fields, and verification and screening results alike. Where information is no longer required, it is deleted or de-identified.
Security of Your Information
We take measures we consider commercially reasonable to protect personal information against loss, theft, and unauthorised access, use, or disclosure. These include access controls limiting staff access to those who need it, encryption of data in transit, segregation of test environments from live data, and logging of access to verification records.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. To the fullest extent permitted by law, we do not accept liability for unauthorised disclosure of information transmitted over the internet.
By using the Services you agree that we may contact you electronically about security, privacy, and administrative matters. If we become aware of a breach of security safeguards that creates a real risk of significant harm, we will notify affected individuals and the relevant authorities as required by law.
Your Rights
Subject to applicable law, you may ask us to: confirm whether we process your personal information; give you access to it or a copy; correct information that is inaccurate or incomplete; delete it; restrict or object to how it is used; provide it in a portable electronic form; and withdraw a consent you previously gave.
If your information was processed because a business asked us to verify you, that business is the controller. Send your request to that business first. If you send it to us, we will either direct you to them or act on their instructions, and we will tell you which. Deleting information we are required to retain by law, or that a client must retain to meet its own obligations, may not be possible — we will explain if that is the case.
To make a request, contact us using the details below. We will verify your identity before acting on a request, and will respond within the time applicable law allows. For the purposes of the California Consumer Privacy Act, we do not sell personal information, and you will not receive discriminatory treatment for exercising your rights.
Children’s Information
The Services are not directed to children. We do not knowingly collect personal information from a child except where a client’s verification flow is expressly configured to establish age and the applicable law permits it. If you believe a child has provided us with information outside that context, contact us and we will take steps to delete it, subject to applicable law.
Audit, Regulatory, and Legal Enforcement
Law enforcement, government agencies, and authorised third parties may ask us to demonstrate our verification and validation procedures, and our compliance with know-your-customer, anti-money laundering, and other regulatory requirements. We respond to lawful requests, and may be required to produce verification records in doing so.
Contact Us
For questions about this Privacy Policy, to exercise a right, or to raise a concern, email support@cycurid.com or write to CycurID Technologies Ltd., Vancouver, British Columbia, Canada.
Changes to This Privacy Policy
We will revise this Privacy Policy as our Services and the law change. Revisions are posted here with an updated date. If a change is material, we will give appropriate notice, and where we hold your email address we may notify you directly.