Privacy Policy

This Privacy Policy explains how SPRK10 B.V. (“LiveVerify,” “we”) processes personal data through the LiveVerify identity-verification service.

LiveVerify acts as an independent controller for personal data relating to Account Contacts (individuals who register or manage a LiveVerify account on behalf of a business) and customer signing contacts, including where LiveVerify verifies the identity of those contacts. This Privacy Policy applies to that data.

This is distinct from LiveVerify’s role as processor of End User personal data processed on behalf of a business customer under the Data Processing Agreement (DPA). If a business asked you to verify your identity using LiveVerify, that business is responsible for your personal data and its own privacy notice applies; see Section 3.1.

1. Who we are

LiveVerify is operated by SPRK10 B.V., incorporated in the Netherlands (KVK 98888625). Our lead supervisory authority is the Dutch Autoriteit Persoonsgegevens. Our privacy contact can be reached at privacy@liveverify.me.

2. What data we process, and for how long

2.1 Account Contacts

• If you register or manage a LiveVerify account on behalf of a business, we hold your name, work email address, and account role, together with login and security records (such as sign-in times) and your correspondence with us.
• We also hold the business details you provide (such as business name, address, tax ID, and entity type) and billing records. Card payments are handled by our payment provider, Stripe; we do not receive or store full card details.
• We keep this data for as long as the account is open and for 12 months after account closure, except invoices and payment records, which we keep for 7 years as required by Dutch tax law.

2.2 Identity verification of Account Contacts and signing contacts

• Before a business account can be used for live verifications, the Account Contact who registered it completes a LiveVerify identity check. We may also verify the identity of customer signing contacts as part of account onboarding, contract execution, or ongoing account management.
• During the check, the document image and selfie frames are held only in memory for the duration of a single verification request, then discarded. They are never written to disk, stored, or sent to a third party. Two temporary face templates (numeric representations derived from the document photo and the selfie) are generated and compared during the same request, then discarded. This is biometric data under Article 9 GDPR while it exists.
• The result of the check — verification status, the name read from the document, and the date of the check — is kept for no longer than 3 years from the date of the check, unless a longer period is required by law. No document image or selfie survives into this record.

3. Where this data comes from, and who it is shared with

3.1 If a business asked you to verify your identity (End Users)

If a business asked you to verify your identity with LiveVerify, that business decided to run the check and is the controller of your personal data. LiveVerify processes your data only on that business’s instructions, as its processor under a Data Processing Agreement. Please read that business’s own privacy notice, and contact the business to exercise your rights; LiveVerify will assist it in responding.

In summary, for those checks: your document image and selfie are held only in memory for the duration of the check and are never stored; the name read from your document is held for up to 30 minutes so that it can be passed to the business; and LiveVerify keeps a record of the outcome (status, date, and similar check details, without your name, date of birth, document number, or images) for no longer than 3 years. LiveVerify does not sell personal data and does not share it with any party for that party’s own marketing purposes.

3.2 Account Contact and signing contact data (LiveVerify as controller)

We collect this data from you when you register, use, or manage an account, and from the identity check described in Section 2.2. LiveVerify acts as the controller and processes this data for its own legitimate purposes, including account administration, account security, fraud prevention, billing, regulatory compliance, and contract execution.

We share it only with the infrastructure providers that host and run the Service (Section 7) and with our payment provider, Stripe, which processes payment data for card top-ups. These providers process data on our instructions under written agreements; Stripe also acts as an independent controller for its own legal and regulatory obligations. We do not sell personal data.

4. Legal basis for processing Account Contact data

• Performance of contract and legitimate interests, for Account Contact data and customer signing contact data, including identity verification of customer signing contacts by LiveVerify in connection with account onboarding, contract execution, or ongoing account management.
• Legal obligation, where retention or disclosure is required by law.
• Explicit consent, for the biometric processing involved in the identity check described in Section 2.2 (see Section 5).

5. Biometric data

5.1 The face template computed during a check is biometric data used for the purpose of uniquely identifying a natural person, which is a special category of data under Article 9 GDPR while it exists. It exists only in memory for the life of one request and is never stored — see Section 2.2.

5.2 We process this special-category data on the basis of your explicit consent, which we ask for before the check starts. You may withdraw your consent at any time; because the face template exists only for the duration of the check, withdrawal affects future checks only. Where a business customer verifies its own End Users, that business is responsible for the legal basis for that processing.

6. Minors

LiveVerify is a business service, and Account Contacts must be at least 18 years old. If a document submitted for a check indicates that the holder is under 18, the check is refused and the date of birth and decoded document text are redacted before anything is returned.

7. Where data is hosted, and service providers

The table below reflects the deployed configuration as of the date at the top of this policy.

8. International transfers

Vercel, Cloudflare, and Supabase are US-incorporated companies, and Stripe is part of a US-incorporated group. Because a US parent company can be subject to US legal process reaching data it controls, this is treated as a restricted transfer even where the data itself is hosted in the EU. LiveVerify has entered into Standard Contractual Clauses with each of these providers.

9. Automated decision-making

A LiveVerify check is a fully automated process that produces a pass/fail result. Where this constitutes a decision based solely on automated processing that produces legal effects or similarly significant effects on an Account Contact or signing contact within the meaning of Article 22(1) GDPR, you can ask for human review of the result by emailing privacy@liveverify.me. You can also express your point of view and contest the decision.

10. Your rights

Subject to the conditions and exceptions in applicable law, Account Contacts and signing contacts have the right to: access the personal data we hold; correct inaccurate data; request erasure; restrict processing; object to processing; withdraw consent at any time (where processing is based on consent); receive a copy of their data in a portable format; and, where Article 22 GDPR applies, obtain human intervention, express their point of view, and contest the decision. To exercise these rights, contact privacy@liveverify.me.

You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens or your local supervisory authority.

11. Changes to this policy

We will notify Account Contacts of material changes to this policy at least 30 days before they take effect, by notice on the Service or by email where we hold a contact address. The date of the last update is shown at the top of this policy.