AUTHID INC. TERMS & CONDITIONS OF USE FOR USERS and PRIVACY POLICY

Privacy Policy

Effective June 5, 2024

IMPORTANT: BY DOWNLOADING OR USING VERIFIED™, PROOF™ OR FIDO2 PASSKEY AUTHENTICATION IDENTITY AUTHENTICATION AND VERIFICATION SOFTWARE, APPLICATION, OR ANY ASSOCIATED AUTHID INC. SERVICES (AS FURTHER DEFINED BELOW, COLLECTIVELY, THE “AUTHID SOFTWARE”), AND BY CLICKING “AGREE AND CONTINUE” YOU AGREE TO BE BOUND BY THE FOLLOWING TERMS & CONDITIONS OF USE AND AUTHID INC.’S PRIVACY POLICY. IF YOU DO NOT AGREE TO THESE TERMS AND CONDITIONS OR THE PRIVACY POLICY, DO NOT DOWNLOAD OR USE ANY AUTHID SOFTWARE.

IMPORTANT: EACH PARTY AGREES TO USE ELECTRONIC RECORDS AND SIGNATURES AND THAT THIS AGREEMENT INCLUDING THE PRIVACY POLICY WILL BE ACCEPTED, EXECUTED, DELIVERED OR AGREED TO THROUGH THE USE OF AN ELECTRONIC SIGNATURE, FOR EXAMPLE BY CLICKING “AGREE AND CONTINUE”, OR OTHER ELECTRONIC MEANS OR THROUGH EMAIL, OR OTHER ELECTRONIC TRANSMISSION OF A SIGNED COPY, EACH OF WHICH SHALL BE DEEMED THE EQUIVALENT OF AN ORIGINAL SIGNATURE AND SHALL BE BINDING AND HAVE THE SAME FORCE AND EFFECT AS AN ORIGINAL OR MANUAL SIGNATURE. THIS AGREEMENT MAY BE STORED BY ELECTRONIC MEANS AND EITHER AN ORIGINAL OR AN ELECTRONICALLY STORED COPY OF THIS AGREEMENT CAN BE USED FOR ALL PURPOSES, INCLUDING IN ANY PROCEEDING TO ENFORCE THE RIGHTS AND OBLIGATIONS OF THE PARTIES.

IMPORTANT: PLEASE REVIEW THE ARBITRATION AGREEMENT SET FORTH BELOW CAREFULLY, AS IT WILL REQUIRE YOU TO RESOLVE DISPUTES WITH AUTHID ON AN INDIVIDUAL BASIS THROUGH FINAL AND BINDING ARBITRATION. BY ENTERING THIS AGREEMENT, YOU EXPRESSLY ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTAND ALL OF THE TERMS OF THIS AGREEMENT AND HAVE TAKEN TIME TO CONSIDER THE CONSEQUENCES OF THIS IMPORTANT DECISION.

1. Defined Terms
The capitalized words and expressions below shall have the meanings set against each of them for the purposes of these Terms and Conditions:
(a) “AAA” means the American Arbitration Association.
(b) “AAA Rules” means the AAA’s Consumer Arbitration Rules.
(c) “API” means the authID application programming interface which enables access to the authID Software and Services.
(d) “Arbitrator” means the person appointed to act as arbitrator under the terms of Arbitration Agreement in these Terms and Conditions.
(e) “authID” means authID Inc. a Delaware, USA corporation.
(f) “authID Software” means any of authID’s software, including but not limited to any authID software for Users to access or use the authID Services on mobile devices, including but not limited to iOS, Android and other platforms, API’s, SDK’s, java script modules, Web Services Interface, server applications and device applications, documentation, interfaces, content, fonts and any data that was downloaded with of by means of any authID software, or is otherwise provided by authID or used with, or for the purposes of using any authID software or Services, which enable Customers and individual Users to access or use the Services whether such Software is downloaded to a mobile device, or which are accessible or usable by other means such as an Internet browser, or desktop or server application, as well as each application, system, or database which is provided by authID, whether provided in read only memory, on any other media or in any other form.
(g) “authID Software Updates” means the authID Software as may be updated or replaced by feature enhancements, software updates or system restore software provided by authID.
(h) “Customer” means the company, entity or other organization using authID Services in connection with its business, or other organizational activity and which requested you to use these Services to verify or authenticate your identity.
(i) “License” means the license to use the authID Software granted to you by these Terms and Conditions.
(j) “Proof Information” shall have the meaning defined in Section 7(B)(b) below.
(k) “SDK” means the authID software development kit comprising the group of tools that enable the programming of the authID App family of mobile applications.
(l) “Services” means authID’s services and any Third-Party Services and web sites, which may be provided or accessible by using the authID Software, including but not limited to Verified™ Workforce, Verified™ Consumer, Proof™, FIDO2 Passkey Authentication and other FIDO2 compliant passwordless authentication services.
(m) “these Terms and Conditions” means these terms and conditions of use of the authID Software, as they may be amended from time to time by authID in accordance with the procedures described in these Terms and Conditions.
(n) “Third-Party Materials” means content, data, information, applications, or materials from third parties, or links to certain third-party web sites provided by any Customer or other third-party which is accessible by means of or is provided in connection with the Services.
(o) “Third-Party Services” means services provided by third parties which are accessible by means of the Services, including such Third-Party Services which are included in the Services provided to its Customers by authID.
(p) “User” means You, or such other person who uses your device to access any authID Software to utilize any of the authID Services and in these Terms and Conditions such term may be qualified by reference to the particular Service e.g. “Verified User” shall mean a User of the Verified Service
(q) “Verified Information” shall have the meaning defined in Section 7(A)(b) below.
(r) “Web Services Interface” shall mean authID’s interfaces provided for the purposes of accessing authID Software by means of an Internet browser.
(s) “You” (whether or not capitalized) means the person who owns or uses the device to which the authID Software is downloaded and shall include your assignees and successors in title.

2. General.
a) authID hereby grants to You a revocable, royalty-free, limited, non-exclusive License to use the authID Software solely for the purpose of accessing and using the Services and only in accordance with these Terms and Conditions. The authID Software is not sold to You and You acknowledge that authID and its licensors retain ownership of the authID Software and all authID Trademarks used in the authID Software, or in these Terms and Conditions, and reserve all rights not expressly granted to You.
(b) authID, at its discretion, may make available future authID Software Updates for your device. The authID Software Updates, if any, may not necessarily include all existing software features or new features that authID releases for newer or other models of devices. The terms of this License will govern any authID Software Updates provided by authID that replace or supplement the authID Software, unless such authID Software Update is accompanied by a separate license in which case the terms of that license will govern.
(c) A Wi-Fi or cellular data Internet or Bluetooth connection is required in order to use the authID Software and Services.

3. Permitted License Uses and Restrictions.
(a) This License does not allow you to distribute copies or make the authID Software available over a network, where it could be used by multiple devices at the same time. This License does not grant you any rights to use authID proprietary interfaces and other intellectual property in the design, development, manufacture, licensing or distribution of third-party devices and accessories, or third-party software applications, for use with devices.
(b) Subject to the terms and conditions of this License, authID hereby grants you a revocable, royalty-free, limited, non-exclusive, license to download authID Software Updates that may be made available by authID for your device or devices to update or restore the software on any such device that you own or control. This License does not allow you to update or restore any device that you do not control or own, and you may not distribute copies or make the authID Software Updates available over a network where they could be used by multiple devices or multiple computers at the same time. If you download an authID Software Update to your computer, you may make one copy of the authID Software Updates stored on your computer in machine-readable form for backup purposes only, provided that the backup copy must include all copyright or other proprietary notices contained on the original.
(c) You may not, and you agree not to or enable others to copy (except as expressly permitted by this License), modify, decompile, reverse engineer, disassemble, attempt to derive the source code of, decrypt, modify, or create derivative works of the authID Software or any services provided by the authID Software or any part thereof (except as and only to the extent any foregoing restriction is prohibited by applicable law or by licensing terms governing use of open-source components that may be included with the authID Software).
(d) You agree that the Services contain proprietary content, information and material that is owned by authID, the site owner and/or their licensors, which are protected by applicable intellectual property and other laws, including but not limited to copyright. You agree that you will not use such proprietary content, information, or materials other than for permitted use of the Services or in any manner that is inconsistent with the terms of this License or that infringes any intellectual property rights of a third-party or authID. No portion of the Services may be reproduced in any form or by any means. You shall not exploit the Services in any unauthorized way whatsoever, including but not limited to, using the Services to transmit any computer viruses, worms, trojan horses or other malware, or by trespass or burdening network capacity. You further agree not to use the Services in any manner to harass, abuse, stalk, threaten, defame or otherwise infringe or violate the rights of any other party, and that authID is not in any way responsible for any such use by you, nor for any harassing, threatening, defamatory, offensive, infringing or illegal messages or transmissions that you may receive as a result of using any of the Services.
(e) The authID Software may be used to reproduce materials so long as such use is limited to reproduction of non-copyrighted materials, materials in which you own the copyright, or materials you are authorized or legally permitted to reproduce. Title and intellectual property rights in and to any content displayed by, stored on, or accessed through your device belong to the respective content owner. Such content may be protected by copyright or other intellectual property laws and treaties and may be subject to terms of use of the third-party providing such content. Except as otherwise provided herein, this License does not grant you any rights to use such content nor does it guarantee that such content will continue to be available to you. To the extent that you upload any content through the use of the Services, you represent that you own all rights in, or have authorization or are otherwise legally permitted to upload, such content and that such content does not violate any terms of service applicable to the Services.
(f) You agree to use the authID Software and the Services in compliance with all applicable laws, including local laws of the country or region in which you reside or in which you download or use the authID Software and Services.
(g) If you choose to allow automatic app updates, your device will periodically check with the appropriate operating system application store, or other source for downloading the authID Software for updates to the apps on your device and, if one is available, the update will automatically download and install onto your device. You can turn off the automatic app updates altogether at any time by going to your device’s settings menu.
(h) Using authID Services in some circumstances can distract you and may cause a dangerous situation (for example, avoid using the Services while driving a car). By using the authID Services you agree that you are responsible for observing rules that prohibit or restrict the use of mobile phones.

4. No Transfer.
You may not rent, lease, lend, sell, redistribute, or sublicense the authID Software. You may, however, make a one-time permanent transfer of all of your license rights to the authID Software to another party in connection with the transfer of ownership of your device, provided that:
(a) the transfer must include your device and all of the authID Software, including all its component parts, original media, printed materials and this License;
(b) you do not retain any copies of the authID Software, full or partial, including copies stored on a computer or other storage device; and
(c) the party receiving the authID Software reads and agrees to accept the terms and conditions of this License.

5. Consent to Collection, Transfer and Use of Personal Data.
(a) When you use the authID Software, your e-mail address, or phone number, your photograph (if you are using a facial recognition feature of the authID Software) and certain unique identifiers for your device are sent to authID in order to allow authID and others to provide Services. You will first need to register with authID in order to use authID Software and to provide certain personal information, such as your e-mail address, and a photograph (if you are using a facial recognition feature of the authID Software). In certain cases, we may receive from the Customer which is requesting or requiring your use of the relevant Services your photograph and other personal information which you have provided to such third-party. In such case you hereby give us permission to store and use such photograph and the facial recognition biometric template that we create from such image and personal information for the purposes of providing you Services when you use the authID Software.
(b) By using the authID Software, you are consenting to the transfer to and use by authID of all required data to enable authID to operate the authID Software and provide the Services. When you approve (or decline) a transaction, which is presented to you by the authID Software, or otherwise make use of the authID Software, you are consenting to sending to authID biometric and other information for such purpose (depending on your authID account set-up) and to authID sending a message to the third-party Customer that has requested or required your use of the relevant Services, which will include information about you that is necessary to authenticate your choice.
(c) You also acknowledge that all data is held by authID in the United States of America and that if you live outside of the United States of America by using the authID Software you are consenting to the transfer and storage of your data in the United States of America. At all times your information will be handled in accordance with authID’s Privacy Policy, which follows these Terms and Conditions.

6. Services and Third-Party Materials.
(a) The authID Software may be used by our Customers to provide multi-factor authentication for access to or the use of the relevant Customer’s service. Such Customer services are not provided through the authID Software, authID does not have access to any of the data, which are processed through or stored in such Customer services and therefore authID is not responsible for any unauthorized access to, or loss of such data. authID is not responsible for the operation, non-operation, interruption, or inability to access such Customer Services. The terms and conditions of access to and the use of Customer services are set by such third-party Customers. If you have other credentials for accessing such Customer services (such as a log-in name, password, or PIN) you need to take appropriate precautions to protect them and authID is not responsible for any losses arising from their misuse.
(b) The authID Software enables access to authID’s and Third-Party Services. Use of these Services requires Internet access.
(c) Certain Services may provide access to, display, include or make available Customer or other third-party’s services and Third-party Materials. By using the Services, you acknowledge and agree that authID is not responsible for examining or evaluating the content, accuracy, completeness, timeliness, validity, copyright compliance, legality, decency, quality, or any other aspect of such Third-party Materials. authID, its officers, affiliates and subsidiaries do not warrant or endorse and do not assume and will not have any liability or responsibility to you or any other person for any Customer’s or other third-party’s services, Third-party Materials, or for any other materials, products, or services of third-parties. Third-party Materials and links to other web sites are provided solely as a convenience to you.
(d) Features of the authID Software, Services and Third-Party Materials that may be accessed, linked to, or displayed by means of the authID Software are not available in all languages or in all countries or regions, some features may vary by region, and some may be restricted or unavailable from your service provider. authID makes no representation that such Services and Third-Party Materials are appropriate or available for use in any particular location. To the extent you choose to use or access such Services and Third-Party Materials, you do so at your own initiative and are responsible for compliance with any applicable laws, including but not limited to applicable local laws and privacy and data collection laws. authID and its licensors reserve the right to change, suspend, remove, or disable access to any Services at any time without notice. In no event will authID be liable for the removal of or disabling of access to any such Services. authID may also impose limits on the use of or access to certain Services, in any case and without notice or liability.

7. authID Services

7A. Verified™ by authID.
(a) Overview. Verified™ Workforce and Verified™ Consumer by authID provide a multi-factor authentication system to be used in conjunction with a Customer’s other security measures to authenticate its workforce, consumers or end-users before they access a Customer’s systems, or certain functionality of such systems. The system may also be used to authenticate callers in a call center or similar environment.
(b) Verified Information. In addition to the information referenced in Section 5(a) when you use the Verified™ by authID Service, in order to gain access to a system or obtain service from a third-party Customer, authID may receive and store additional personal information about you, in order to provide you with such service. Such information may include (but is not limited to) your first and last name, details of a particular transaction, address or other information change request, or other service that you wish to undertake or use, or that you may provide to the third-party Customer (collectively referred to as “Verified Information”).
(c) Consent to Use Verified Information. In signing up for the Verified™ Service, you consent to the transfer to and storage by authID of all such Verified Information and the use by authID of all Verified Information, for the purpose of providing and maintaining the Verified™ Service, including without limitation for data comparison and review to reduce data redundancy and fraud. You acknowledge that Verified Information may be provided to authID by You, or by a third-party Customer for whom the Verified Service is being provided.

7B. Proof
(a) Overview. Proof is a Service, which is used to enable Users to remotely provide identification documents to Customers, or otherwise to remotely authenticate a User’s identification information, for the purposes of proving the User’s identity, whether at the time the User opens an account with the Customer, or any other time when a Customer needs to establish a User’s identity. Such documents may for example be a passport, national identity card, or driver’s license. By means of the Proof Service, authID extracts the relevant data from the identification document presented by the User, compares the picture to a live reference photograph taken by the User and then authID forwards the data from the identification document including the live photograph to the Customer, which initiated the Proof Service request. If expressly required by a Customer as part of the Proof Service, authID may in addition transmit the document data and live photograph (directly or indirectly) to governmental entity that issued the document for verification, or to a provider of a Third-Party Service for additional security checks or data collection.
(b) Proof Information. In addition to the information referenced in Section 5(a) when you use the Proof Service, in order to provide proof of your identity to a third-party Customer, you will enable the transmission to authID of additional personal information about you, in order to provide you with the Service. Such information may include (but is not limited to) your first and last name, your address, your nationality or residence status, the nature and number of your identification document and any other data which may be collected from such identification document. In addition, the Proof Service will require you to provide a live picture and associated facial biometrics, for the purpose of matching such picture to the picture on the identification document. (All such information collected from the identification document and the live picture is collectively referred to as “Proof Information”). Once the transfer to the Customer has been completed, the Customer as data controller is responsible for that data and therefore the storage and use of the Proof Information will be governed by the Privacy Policy of the Customer to whom you authorized authID to transfer the Proof Information. You should check with the Customer what their Privacy Policy is with respect to the Proof Information.
(c) Consent to Use Proof Information. By using the Proof Service, you consent to the transfer to, and storage by authID of all such Proof Information and the use by authID of all Proof Information, for the purpose of providing the Proof Service. You further consent to the processing, and storage of such Proof Information by authID and transmission of the Proof Information to the Customer, which initiated the Proof Service request and, if applicable, to the government entity which issued the document from which the Proof Information is derived and to authID’s provider of Third Party Services for additional security checks or data collection. In addition, authID may retain images of identity documents from Proof Transactions processed for Customer for the purposes of training authID’s Software models for improved accuracy. These identity document images will be encrypted and stored in a secure location only accessible to authorized authID employees. The enhanced precision resulting from improvements in our Software benefits all our customers in minimizing both false positives and false negatives. Neither the images, nor any data derived therefrom will be sold, or otherwise made available to any third party.
(d) Disclaimer. Use of the Proof Service does not guarantee that a User’s application to the Customer for the Third-Party Service will be accepted, or that the Customer will not require additional documentation, including proof of your identity.

7C Third-Party Services
(a) authID makes available to its Customers certain Third-Party Services, including Services to which authID can connect in order to validate an ID document, or the data in the ID document by comparing it to a commercial data base (for example for US, Canadian or Mexican Driver’s licenses), or to the relevant government registry which issued the ID (for example for South Africa), or for checking sanctions compliance, or verifying other demographic data, or personal information regarding a User. A list of the providers of such Third-Party Services currently used by authID is available .
(b) You acknowledge that Third-Party Services are made available by authID by means of its Services but the content and delivery of those Third-Party Services are the responsibility of such third-party provider. While authID has taken reasonable care in selecting which Third-Party Services to provide, such Third-Party Services are provided “as is” and authID bears no responsibility for the content, accuracy or legal compliance of such Third-Party Services and the Third-Party Materials they may provide, nor for the reliability or availability of such Third-Party Services and Third-Party Materials. authID reserves the right to change the provider of such Third-Party Services at any time, at its sole discretion.
(c) Third-Party Materials. In addition to the information referenced in Section 5(a) and Proof Information, when you a Customer requires the use of a Third-Party Service, in order to provide additional verification of your identity to such Customer, or to comply with applicable “know your client” anti-money laundering, or sanctions regulations, when you authorize a Proof Transaction You will also authorize the transmission of data as follows:
(i) by authID to the provider of the Third-Party Service of some or all of your Proof Information sufficient to provide the Third-Party Service; and
(ii) by the provider of the Third-Party Services to authID of the Third-Party Materials which may contain additional personal information about You; and
(iii) by authID to the Customer of the Third-Party Materials received by authID which may contain additional personal information about you
in each case in order to provide you and the third-party Customer with the Service. Such information may include (but is not limited to) your first and last name, your address, date of birth, occupation and whether you are listed on certain governmental databases. authID does not store or process such Third-Party Materials once the transfer to the Customer has been completed and therefore the storage and use of the Third-Party Materials will be governed by the Privacy Policy of the Customer to whom You authorized authID to transfer the Third-Party Materials. You should check with the Customer what their Privacy Policy is with respect to the Third-Party Materials.

7D FIDO2 Passkey Authentication
When you use our passwordless FIDO2 Passkey authentication service, , once your identity is verified, we set a FIDO2 compliant cryptographic key on your device, which is used in the future to automatically authenticate your device and tie it to your identity, so that we can confirm to the Customer that it is you who are accessing their service. In subsequent log-ins to our Customer’s services, or when asked to authenticate yourself before undertaking particular transactions with that Customer, authID may access the cryptographic key and ask you to take a selfie which we compare to your reference biometric that we maintain on file, in order to provide confirmation to the Customer, that you are duly authenticated for their purposes.

8. Termination.
(a) This License is effective until terminated. Your rights under this License and any agreement to provide Services will terminate automatically or otherwise cease to be effective without notice from authID if you fail to comply with any term(s) of this License or if authID’s ceases to provide Services to the Customer who requested or required your use of the Services.
(b) Upon the termination of this License, you shall cease all use of the authID Software. Sections 4, 5, 6, 7A7B, 8, 9, 10, 12, 13, 14, 15, 16, 17 and 18 of this License shall survive any such termination.

9. Disclaimer of Warranties.
(a) If you are a consumer (someone who uses the authID Software outside of your trade, business or profession, or as otherwise defined by applicable law), you may have legal rights in your State or country of residence which would prohibit the following limitations from applying to you, and where prohibited they will not apply to you. To find out more about rights, you should contact a local consumer advice organization.
(b) YOU EXPRESSLY ACKNOWLEDGE AND AGREE THAT, TO THE EXTENT PERMITTED BY APPLICABLE LAW, USE OF THE AUTHID SOFTWARE AND ANY SERVICES PERFORMED BY OR ACCESSED THROUGH THE AUTHID SOFTWARE IS AT YOUR SOLE RISK AND THAT THE ENTIRE RISK AS TO SATISFACTORY QUALITY, PERFORMANCE, ACCURACY AND EFFORT IS WITH YOU.
(c) TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE AUTHID SOFTWARE AND SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE”, WITH ALL FAULTS AND WITHOUT WARRANTY OF ANY KIND, AND AUTHID HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS WITH RESPECT TO THE AUTHID SOFTWARE AND SERVICES, EITHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES AND/OR CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, QUIET ENJOYMENT, AND NON-INFRINGEMENT OF THIRD PARTY RIGHTS.
(d) AUTHID DOES NOT WARRANT AGAINST INTERFERENCE WITH YOUR USE OF THE AUTHID SOFTWARE AND SERVICES, THAT THE FUNCTIONS CONTAINED IN, OR SERVICES PERFORMED OR PROVIDED BY, THE AUTHID SOFTWARE WILL MEET YOUR REQUIREMENTS, THAT THE OPERATION OF THE AUTHID SOFTWARE AND SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE, THAT ANY SERVICE WILL CONTINUE TO BE MADE AVAILABLE, THAT DEFECTS IN THE AUTHID SOFTWARE OR SERVICES WILL BE CORRECTED, OR THAT THE AUTHID SOFTWARE WILL BE COMPATIBLE OR WORK WITH ANY DEVICE, THIRD PARTY SOFTWARE, APPLICATIONS OR THIRD PARTY SERVICES. INSTALLATION OF AUTHID SOFTWARE MAY AFFECT THE AVAILABILITY AND USABILITY OF THIRD PARTY SOFTWARE, APPLICATIONS OR THIRD PARTY SERVICES.
(e) YOU FURTHER ACKNOWLEDGE THAT THE AUTHID SOFTWARE AND SERVICES ARE NOT INTENDED OR SUITABLE FOR USE IN SITUATIONS OR ENVIRONMENTS WHERE THE FAILURE OR TIME DELAYS OF, OR ERRORS OR INACCURACIES IN, THE CONTENT, DATA OR INFORMATION PROVIDED BY THE AUTHID SOFTWARE OR SERVICES COULD LEAD TO DEATH, PERSONAL INJURY, OR SEVERE PHYSICAL OR ENVIRONMENTAL DAMAGE, INCLUDING WITHOUT LIMITATION THE OPERATION OF NUCLEAR FACILITIES, AIRCRAFT NAVIGATION OR COMMUNICATION SYSTEMS, AIR TRAFFIC CONTROL, LIFE SUPPORT OR WEAPONS SYSTEMS.
(f) NO ORAL OR WRITTEN INFORMATION OR ADVICE GIVEN BY AUTHID OR AN AUTHID AUTHORIZED REPRESENTATIVE SHALL CREATE A WARRANTY. SHOULD THE AUTHID SOFTWARE OR SERVICES PROVE DEFECTIVE, YOU ASSUME THE ENTIRE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES OR LIMITATIONS ON APPLICABLE STATUTORY RIGHTS OF A CONSUMER, SO THE ABOVE EXCLUSION AND LIMITATIONS MAY NOT APPLY TO YOU.

10. Limitation of Liability.
(a) TO THE EXTENT NOT PROHIBITED BY APPLICABLE LAW, IN NO EVENT SHALL AUTHID, ITS AFFILIATES, DIRECTORS, OFFICERS, STOCKHOLDERS, EMPLOYEES OR AGENTS BE LIABLE FOR PERSONAL INJURY, OR ANY INCIDENTAL, SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES WHATSOEVER, INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, CORRUPTION OR LOSS OF DATA, FAILURE TO TRANSMIT OR RECEIVE ANY DATA, BUSINESS INTERRUPTION OR ANY OTHER COMMERCIAL DAMAGES OR LOSSES, ARISING OUT OF OR RELATED TO YOUR USE OR INABILITY TO USE THE AUTHID SOFTWARE AND SERVICES OR ANY THIRD PARTY SOFTWARE OR APPLICATIONS IN CONJUNCTION WITH THE AUTHID SOFTWARE OR SERVICES, HOWEVER CAUSED, REGARDLESS OF THE THEORY OF LIABILITY (CONTRACT, TORT OR OTHERWISE) AND EVEN IF AUTHID HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR PERSONAL INJURY, OR OF INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THIS LIMITATION MAY NOT APPLY TO YOU. IN NO EVENT SHALL AUTHID’S TOTAL LIABILITY TO YOU FOR ALL DAMAGES (OTHER THAN AS MAY BE REQUIRED BY APPLICABLE LAW IN CASES INVOLVING PERSONAL INJURY) EXCEED THE AMOUNT OF TWO HUNDRED AND FIFTY DOLLARS (US$250.00). THE FOREGOING LIMITATIONS WILL APPLY EVEN IF THE ABOVE STATED REMEDY FAILS OF ITS ESSENTIAL PURPOSE.
(b) YOU ARE SOLELY RESPONSIBLE FOR MAINTAINING THE SECURITY OF YOUR DEVICE AND OF ANY PASSCODE AND PIN. YOU AGREE THAT AUTHID DOES NOT HAVE ANY RESPONSIBILITY IF YOU LOSE OR SHARE ACCESS TO YOUR DEVICE. YOU AGREE THAT AUTHID DOES NOT HAVE ANY RESPONSIBILITY IF YOU MAKE UNAUTHORIZED MODIFICATIONS TO ANY AUTHID SOFTWARE. IF YOUR DEVICE IS LOST OR STOLEN YOU SHOULD CONTACT THE CUSTOMER WHO ISSUED YOUR CREDENTIALS IN ORDER TO PREVENT UNAUTHORIZED ACCESS TO OR USE OF YOUR CREDENTIALS.

11. Complete Agreement; Governing Language.
This License constitutes the entire agreement between you and authID relating to the authID Software and supersedes all prior or contemporaneous understandings regarding such subject matter. No amendment to or modification of this License will be binding unless in writing and signed by authID. Any translation of this License is done for local requirements, or for convenience and in the event of any conflict between the English and any non-English versions, the English version of this License shall govern, to the extent not prohibited by local law in your jurisdiction.

12. Export Control.
You may not use or otherwise export or re-export the authID Software except as authorized by United States law and the laws of the jurisdiction(s) in which the authID Software was obtained. In particular, but without limitation, the authID Software may not be exported or re-exported (a) into any U.S. embargoed countries or (b) to anyone on the U.S. Treasury Department’s list of Specially Designated Nationals or the U.S. Department of Commerce Denied Person’s List or Entity List or any other restricted party lists. By using the authID Software, you represent and warrant that you are not located in any such country or on any such list. You also agree that you will not use the authID Software for any purposes prohibited by United States law.

13. Government End Users.
The authID Software and related documentation are “Commercial Items”, as that term is defined at 48 C.F.R. §2.101, consisting of “Commercial Computer Software” and “Commercial Computer Software Documentation”, as such terms are used in 48 C.F.R. §12.212 or 48 C.F.R. §227.7202, as applicable. Consistent with 48 C.F.R. §12.212 or 48 C.F.R. §227.7202-1 through 227.7202-4, as applicable, the Commercial Computer Software and Commercial Computer Software Documentation are being licensed to U.S. Government end users (a) only as Commercial Items and (b) with only those rights as are granted to all other end users pursuant to these Terms and Conditions. Unpublished-rights reserved under the copyright laws of the United States.

14. Controlling Law and Severability.
This License will be governed by and construed in accordance with the laws of the State of New York, excluding its conflict of law principles. If for any reason a court of competent jurisdiction finds any provision, or portion thereof, to be unenforceable, the remainder of this License shall continue in full force and effect.

15. Arbitration Agreement
BY AGREEING TO THIS LICENSE, YOU AGREE THAT YOU ARE REQUIRED TO RESOLVE ANY CLAIM THAT YOU MAY HAVE AGAINST AUTHID ON AN INDIVIDUAL BASIS IN ARBITRATION, AS SET FORTH IN THIS ARBITRATION AGREEMENT. THIS WILL PREVENT YOU FROM BRINGING ANY CLASS, COLLECTIVE, OR REPRESENTATIVE ACTION AGAINST AUTHID, AND ALSO PREVENT YOU FROM PARTICIPATING IN OR RECOVERING RELIEF UNDER ANY CURRENT OR FUTURE CLASS, COLLECTIVE, CONSOLIDATED, OR REPRESENTATIVE ACTION BROUGHT AGAINST AUTHID BY SOMEONE ELSE.
(a) Agreement to Binding Arbitration Between You and authID. You and authID agree that any dispute, claim or controversy arising out of or relating to (i) this License or the existence, breach, termination, enforcement, interpretation or validity thereof, or (ii) your access to or use of the authID Software or any Services at any time, whether before or after the date you agreed to the Terms, will be settled by binding arbitration between you and authID, and not in a court of law.
(b) Prohibition of Trial by Jury and Class Actions. You acknowledge and agree that you and authID are each waiving the right to a trial by jury and may bring claims against the other only on an individual basis and not as a plaintiff or class member in any purported class action or representative proceeding. Unless both you and authID otherwise agree in writing, any arbitration will be conducted only on an individual basis and not in a class, collective, consolidated, or representative proceeding. However, you and authID each retain the right to bring an individual action in small claims court and the right to seek injunctive or other equitable relief in a court of competent jurisdiction to prevent the actual or threatened infringement, misappropriation or violation of a party’s copyrights, trademarks, trade secrets, patents or other intellectual property rights
(c) Rules and Governing Law. The arbitration will be administered by the American Arbitration Association in accordance with the AAA’s Consumer Arbitration Rules then in effect, except as modified by this Arbitration Agreement. Further information about the AAA and the AAA Rules are available at https://www.adr.org/Consumer. Notwithstanding any choice of law or other provision in this License, the parties agree and acknowledge that the interpretation and enforcement of this Arbitration Agreement shall be governed by the Federal Arbitration Act.
(d) Arbitrator Authority. The parties agree that the Arbitrator, and not any federal, state, or local court or agency, shall have exclusive authority to resolve any disputes relating to the interpretation, applicability, enforceability or formation of this Arbitration Agreement, including any claim that all or any part of this Arbitration Agreement is void or voidable except that issues relating to arbitrability, the scope or enforceability of this Agreement to Arbitrate, or the interpretation of the Prohibition of Trial by Jury and Class Actions section above, shall be for a court of competent jurisdiction to decide.
(e) Process. A party who desires to initiate arbitration must provide the other party with a written Demand for Arbitration by certified mail or e-mail as specified in the AAA Rules. You should send this notice to authID Inc. 670 Long Beach Boulevard, Long Beach, NY 11561 United States of America, Attn: General Counsel or (b) by email from the email address associated with your Account to: legal@authID.ai. authID will send any notice to you to the address or e-mail address we have on file associated with your authID account; it is your responsibility to keep your address up to date. All information called for in the notice must be provided including a description of the nature and basis of the claims the party is asserting and the relief sought. The Arbitrator will be either (1) a retired judge or (2) an attorney specifically licensed to practice law in the state of New York and will be selected by the parties from the AAA’s roster of consumer dispute arbitrators. If the parties are unable to agree upon an Arbitrator within seven (7) days of delivery of the Demand for Arbitration, then the AAA will appoint the Arbitrator in accordance with the AAA Rules.
(f) Location and Procedure. Unless you and authID otherwise agree, the arbitration will be conducted in the county where you reside. If your claim does not exceed $10,000, then the arbitration will be conducted solely on the basis of documents you and authID submit to the Arbitrator, unless you request a hearing, or the Arbitrator determines that a hearing is necessary. If your claim exceeds $10,000, your right to a hearing will be determined by the AAA Rules. Subject to the AAA Rules, the Arbitrator will have the discretion to direct a reasonable exchange of information by the parties, consistent with the expedited nature of the arbitration.
(g) Arbitrator’s Decision. The Arbitrator will render an award within the time frame specified in the AAA Rules. An Arbitrator’s decision shall be final and binding on all parties. Judgment on the arbitration award may be entered in any court having competent jurisdiction to do so. The Arbitrator may award declaratory or injunctive relief only in favor of the claimant and only to the extent necessary to provide relief warranted by the claimant’s individual claim. An Arbitrator’s decision and judgment thereon shall have no precedential or collateral estoppel effect. If you prevail in arbitration you will be entitled to an award of reasonable attorneys’ fees and expenses, to the extent provided under applicable law. authID will not seek, and hereby waives all rights authID may have under applicable law to recover, attorneys’ fees and expenses if authID prevails in arbitration.
(h) Fees. Your responsibility to pay any AAA filing, administrative and arbitrator fees will be solely as set forth in the AAA Rules. However, if your claim for damages does not exceed $10,000, authID will pay all such fees, unless the Arbitrator finds that either the substance of your claim or the relief sought in your Demand for Arbitration was frivolous or was brought for an improper purpose.
(i) Severability and Survival. If any portion of this Arbitration Agreement is found to be unenforceable or unlawful for any reason, (1) the unenforceable or unlawful provision shall be severed from this License; (2) severance of the unenforceable or unlawful provision shall have no impact whatsoever on the remainder of the Arbitration Agreement or the parties’ ability to compel arbitration of any remaining claims on an individual basis pursuant to the Arbitration Agreement; and (3) to the extent that any claims must therefore proceed on a class, collective, consolidated, or representative basis, such claims must be litigated in a civil court of competent jurisdiction and not in arbitration, and the parties agree that litigation of those claims shall be stayed pending the outcome of any individual claims in arbitration.

16. Third-Party Acknowledgements.
Portions of the authID Software may utilize or include third party software and other copyrighted material. Acknowledgements, licensing terms and disclaimers for such material are contained in the electronic documentation for the authID Software, and your use of such material is governed by their respective terms.

17. Notices From authID.
If authID needs to contact you about your product or account, you consent to receive the notices by email, or if no email address is provided by text message to the telephone number which is currently registered by You and is associated with your device for the use of the authID Software. You agree that any such notices that we send you electronically will satisfy any legal communication requirements.

18. Changes to this License
authID may amend this License from time to time, including the Arbitration Agreement set forth in Section 15. Amendments will be effective upon authID’s posting of such updated License at this location, or in the amended or supplemental terms of the applicable Service. Your continued access or use of the authID Software, or any Service after such posting confirms your consent to be bound by this License, as amended. If authID changes this License after the date you first agreed to this License (or to any subsequent changes to this License), you may reject any such change by providing authID written notice of such rejection within 30 days of the date such change became effective, as indicated in the first sentence of this paragraph. This written notice must be provided either (a) by mail to authID Inc. 1580 N. Logan St. Ste 660, Unit 51767, Denver, Colorado 80203 United States of America, Attn: General Counsel or (b) by email from the email address associated with your Account to: legal@authID.ai. In order to be effective, the notice must include your full name and clearly indicate your intent to reject changes to this License. By rejecting changes, you are agreeing that you will continue to be bound by the provisions of this License, including the Arbitration Agreement, as of the date you first agreed to this License (or to any subsequent changes to this License).

 

authID Inc. Privacy Notice

Effective: August 16, 2024

To see prior versions of this Privacy Notice, please email us at legal@authid.ai.

“Personal information” is information that can be used to contact or identify you and includes your biometrics, that we collect.

This Privacy Notice describes how authID Inc. (“authID”, “we”) collect and use your personal information in relation to the provision of our identity authentication and verification services known as Verified™, Proof™, and FIDO2 Passkey Authentication (“authID Services”), as well as our software, interfaces, applications, system, and database that enable such services (“authID Software”).

This Privacy Notice also applies to the collection and use of personal information from you in relation to the operation of our https://authid.ai and https://investors.authid.ai websites (together, the "Site"). (The authID Services, authID Software, and Site are collectively referred to as, the “authID Offerings”.)

The authID Services are made available to our customers (“Customer”) for use by their employees, members, or people using our Customers’ services. Your use of authID Services will also be subject to your agreement with our Customer, which may be your employer or membership organization, or a business from which you are receiving  any services when such Customer requests or requires you to use authID Services. Those Customers will have their own privacy policies, for which authID is not responsible and you should review those policies as well, in order to gain a fuller understanding of how your personal information is collected, used and disclosed by the Customer.

Personal Information We Collect

In the course of your interaction with the authID Offerings, we collect your personal information when you voluntarily provide it to us, when we collect it using automation, and when it is provided to us by third-parties, including our Customer, third-party service providers, and publicly available sources.

Personal Information That You Voluntarily Provide to Us:

Depending upon your usage of the authID Offerings, you might supply us with such information as:

  • your name, email address, physical address, phone number, and other contact information;
  • information about your location;
  • usernames, aliases, and other authentication and security credential information;
  • a live picture of your face and associated biometrics, which you provide via your device camera at onboarding or for authentication when you use the authID Services;
  • user ID document image and ID document data derived from OCR and barcode scanning of your ID document (when you use Proof™ Services), which may include your nationality or residence status, the nature and number of your ID document and other information on the document.

Personal Information That We Automatically Collect

  • computer and device information consisting of browser name and version, device manufacturer, device model, serial number, IMEI, IP address, and geo location are captured during transactions when you use the authID Services;
  • computer and device OS information;
  • authentication and security credential information;
  • operating metrics, such as usage volume, occurrences of technical errors, diagnostic reports, backup information, API calls, and other logs;
  • when you use the Site, we automatically collect the full Uniform Resource Locators (URL) clickstream to, through, and from the Site (including date and time), page response times, download errors, and page interaction information (such as scrolling, clicks, and mouse-overs);
  • identifiers and information contained in cookies. (For additional information, see our Cookie Notice.)

 Personal Information Provided to Us by Third-Parties

You use authID Services at the direction or request of one of our Customers. When the Customer is your employer or membership organization, the Customer provides us some, or all of your name, a username or employee ID. and email, or phone number, so that we can contact you to create an account. The Customer may also provide us your photo, for us to use in providing identity authentication and verification services related to your account. When the Customer is a business whose services you use, the Customer may also provide us with transaction data in connection with transactions which you are asked to approve, such as the dollar amount of funds sent, recipient name or identifier, and authentication details.

Some Customers contract with authID to use third-party services in order to provide additional verification of your identity. In such case, the third-party services provide authID third-party materials which may contain additional personal information about you, including your first and last name, your address, date of birth, telephone number, occupation and whether you are listed on certain governmental databases.

How We Use Personal Information

authID uses your personal information for the following purposes:

  • Providing the authID Offerings to You and Our Customers: We use your personal information to provide authID Offerings, including the processing of Verified, Proof, and FIDO2 Passkey Authentication transactions, as well as the Site.
  • Measuring, Supporting, and Improving authID Offerings: We use your personal information to measure use of, analyze performance of, correct errors in, provide support for, improve, and develop authID Offerings. We retain images of identity documents from Proof transactions for the purposes of training authID’s software models for improved accuracy. These identity document images are encrypted and stored in a secure location only accessible to authorized authID employees. The enhanced precision resulting from improvements in our Software benefits all our Customers and users in minimizing both false positives and false negatives.
  • Communication with You: We use your personal information to provide you information about authID, its products and services, to respond to your requests, and to contact you with marketing or promotional materials that we believe may be of interest to you.
  • De-Duplication: We use your personal information to identify and eliminate duplicate or multiple accounts created in relation to a single user
  • Reducing Data Redundancy, Fraud, and Abuse: We use your personal information for data comparison and review to reduce data redundancy and to prevent and detect fraud and abuse.
  • Compliance with Legal Obligations: In certain cases, we have a legal obligation to retain or disclose your personal information, such as for audit purposes or pursuant to a valid court order.
  • Other Purposes for Which We Seek Your Consent: We also use your personal information for other purposes for which we have expressly requested and obtained your consent.

How We Share Personal Information

authID is committed to respecting and protecting the privacy of its Customers and the users of its products and services. At the core of authID’s mission is our goal of providing secure biometric and multi-factor identity verification and authorization solutions, to combat identity theft and fraud in a wide variety of electronic transactions. We will never sell or rent your personal information and will only share it with third-parties in accordance with the terms of this Privacy Notice.

authID shares your personal information as follows:

Transactions Involving Our Customers:

You may use authID Services at the direction or request of an authID Customer that is your employer (or prospective employer) or a membership association to which you belong or apply, or that is a third-party business whose services you use or apply for. We share your personal information with such Customers when you authorize us to do so, at the time that you (a) are being onboarded to such Customer’s systems, programs or services, or (b) are required to authenticate yourself to such Customer, or (c) approve a transaction with or by such Customer.

Proof Transactions

When you use the Proof Service, in order to provide proof of your identity to a Customer, you will enable the transmission to authID of additional personal information about you, in order to provide you with the authID Service. Such information may include (but is not limited to) your first and last name, your address, your nationality or residence status the nature and number of your identification document and any other information that may be contained in such document’s personal page or barcode or machine-readable zone (MRZ). In addition, the Proof Service will require you to provide a live picture and associated facial biometrics, for the purpose of matching such picture to the picture on the identification document. (All such information collected from the identification document and the live picture is collectively referred to as “Proof Information”). By using the Proof Service, you consent to the collection and processing of the Proof Information by authID and the transmission of the Proof Information to the Customer that requested you to provide such Information and, where applicable, the provider of a Third-Party Service (as detailed below). Once the transfer to the Customer has been completed, the Customer as data controller is responsible for that data and therefore the storage and use of the Proof Information will be governed by the Privacy Policy of the Customer to whom you authorized authID to transfer the Proof Information. You should check with the Customer what their Privacy Policy is with respect to the Proof Information.

Verified Transactions

When you use the Verified Service, the Customer has requested you to authenticate yourself by means of the authID Services.  If the Customer is your employer, this will typically be for the purpose of accessing your employer’s computer systems, or certain applications or functions.  If the Customer is your service provider, authentication may be for the purpose of accessing the Customer’s online systems and services, or to approve a particular transaction. When you authenticate yourself or approve a transaction that is presented to you while using authID Services, you are consenting to send authID biometric and other information for such purpose (depending on the Customer’s requirements) and consenting to authID sending a message to the Customer that is providing the relevant services, which will include information about you that is necessary to authenticate your identity and provide your approval. Personal information that is shared with the Customer includes your name, email address, phone number, device and OS details, and transaction data.

FIDO2 Passkey Authentication

When you use our passwordless authentication service, FIDO2 Passkey Authentication, once your identity is verified we set a FIDO2 compliant cryptographic key on your device, which is used in the future to automatically authenticate your device and tie it to your identity, so that we can confirm to the Customer that it is you who are accessing their service.

Third-Party Subprocessors and Service Providers:

authID employs other companies to perform certain functions that enable us to deliver and support the authID Offerings and to provide certain additional services that may be requested by our Customers (“Third-Party Functions”). authID shares your personal information with these other companies as needed for them to perform such Third-Party Functions. They may not use your information for purposes other than providing the Third-Party Functions and must process it in accordance with this Privacy Notice and applicable data protection law.

Subprocessors

We use subprocessors (“Subprocessors”) to host the authID Software, secure your information, and provide us information that helps us to understand user engagement and improve the authID Offerings.  Currently we use Microsoft Azure to provide cloud storage of our production data and systems, including your personal information and biometrics.

We also use Google Analytics, provided by Google, Inc. (“Google”). We use Google to collect, monitor and analyze users’ engagement with the Site and the authID Services. Google Analytics uses its own cookies to help authID analyze how you and others use the Site and the authID Services. The information generated by the cookie about your use of this website may include your IP address, the internet browser and language you use, preferences, the date and hour of your access to the web page and the websites you access after visiting the Site, and will be transmitted to and stored by Google on servers in the United States. Google will use this information for evaluating your use of this website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage.

To opt out of being tracked by Google Analytics, go to https://tools.google.com/dlpage/gaoptout  and to find out more about Google’s Privacy Policy go to https://policies.google.com/privacy?hl=en

Third-Party Service Providers

Some Customers contract with authID to use a third-party service provider in order to provide additional verification of your identity to that Customer or to comply with applicable “know your client” anti-money laundering, or sanctions regulations, and as further described in our Terms & Conditions of Use (a “Third-Party Service”). In such case, authID will share with the third-party service provider some or all of your personal information sufficient to provide the Third-Party Service, and we will share with the Customer certain materials received by authID from the third-party service provider (“Third-Party Materials”) which may contain additional personal information about you.

“Third-Party Materials” include (but are not limited to) your first and last name, address, date of birth, occupation and whether you are listed on certain governmental databases.  authID does not store or process such third-party materials once the transfer to the Customer has been completed.  You should check with the Customer whether they receive Third-Party Services through authID and, if so, what Customer’s privacy policy is with respect to their use and storage of any Third-Party Materials.

  • Business Transfers: In the event that authID merges with another business, or authID or its assets are acquired by another business, your information may be among transferred assets. In such case, you will receive notice of the merger or acquisition and your personal information will continue to be protected by the terms of this Privacy Notice unless you are notified otherwise.
  • Protection of authID and Others: We disclose personal information when we believe that such disclosure is necessary to comply with applicable law or a valid court order, or to protect you or the security of authID, our Customers, or others. This includes exchanging information with other companies and organizations, as we may believe reasonable, for fraud detection and prevention.

Location of Personal Information

authID Inc. is a multinational business headquartered in the United States, with subsidiaries and affiliates in various countries around the world. Your personal information will be stored and processed in the United States, and may additionally be transmitted to other jurisdictions, including those of our subsidiaries and affiliates, third-party service providers, and the Customer with which you consent for us to work when you use the authID Services. If you are located outside the United States, your information will also be processed in the jurisdiction in which you are located. Whenever we transfer personal information to other jurisdictions, we do so in accordance with this Privacy Notice and as permitted by applicable data protection laws.

How We Secure Personal Information

authID designs and operates our systems with the privacy of your personal data as our highest priority. We adopt physical, electronic, and procedural safeguards to protect personal information.

We protect the security of your information when in transit and at rest using encryption protocols and per ISO 27001 certified ISMS policies. At least annually we conduct a cybersecurity risk assessment, the results of which drive initiatives to enhance our security controls and processes.  We deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience. Technical safeguards, include:

  • encryption of personal data in transit and at rest;
  • encryption of computer systems;
  • multiple access controls and multi-factor authentication to access company systems, including biometrics;
  • privileged access controls to production systems where personal data is stored;
  • audit logs of user activities, exceptions and security events

We maintain databases in restricted areas and secure the content by use of firewalls and other security methods, using Microsoft Azure’s state of the art cloud hosting security. We also limit access to databases containing personal information to specifically authorized employees and agents and other parties identified in the disclosure section above. We also regularly undertake independent testing of our systems and processes to ensure compliance with our security protocols and our certificates of testing may be inspected upon request.  However, you should remember that no method of data transmission over the Internet, or method of electronic data storage, is 100% secure. While authID strives to use commercially reasonable means to protect your personal information, authID cannot guarantee its absolute security.

Your Right to Access and Control Your Personal Information

To access your personal data or exercise any of your rights in relation to such data, you should contact the Customer that has requested or required you to use authID Services (e.g., your employer or membership organization, or a business from which you are receiving another service). If they are unable to assist you, you may contact us at legal@authid.ai

Cookies and Other Identifiers

Like many sites and apps, the authID Software uses "cookies" to collect information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use parts or any of the authID Offerings.

For more information about what a cookie is and how cookies are used by authID, please see authID’s Cookie Policy.

Children’s Personal Information

We don’t provide authID Offerings for use by children. If you’re under 18, you are prohibited from using any authID Offerings.

External Links

In using our AuthID Software and Services you may have access to websites and services offered by third-parties. We do not endorse or make any warranty of any type regarding the content contained on such websites or products and services offered on those websites or by any third-party. We make no representation regarding your use of such websites or any Customer or other third-party services. Please be aware that we are not responsible for the privacy practices of our Customers, third-parties, or the operators of other websites. We encourage our users to be aware when they leave our Site or apps and to read the privacy statements of each website and Customer or other third-party that collects or processes personal information. This policy applies solely to personal information collected by us. You should read any other applicable privacy and cookies policies carefully before accessing and using such other Customer or other third-party services and any other websites.

Retention, Deletion and Updating of Personal Information

We keep your personal information to enable your continued use of authID Offerings, for as long as it is required in order to fulfill the relevant purposes described in this Privacy Notice, as may be required by law (including for tax and accounting purposes), or as otherwise communicated to you. How long we retain specific personal information varies depending on the purpose for its use, and we will delete your personal information in accordance with the instructions given to us by our Customer, who are the data controllers and applicable law

We retain images of identity documents from Proof transactions for the purposes of troubleshooting and training authID’s software models for improved accuracy. These identity document images and certain associated transaction and metadata are encrypted and stored in a secure location, separate and apart from any other personal information and only accessible to authorized authID employees.

If you wish to review, modify, verify, correct, update, or delete any of your personal information collected through the authID Services, you should attempt to do so in the first instance by contacting the Customer (your employer, or other organization) who requested you to use our Services, or by emailing us at legal@authid.ai. Please note that authID may continue to use your de-identified data after your personal information is deleted. To the extent that authID retains personal information for record keeping purposes we may not use the information for any other purposes.

Biometric information will be deleted upon request by the Customer that requested you to provide it, typically within a certain period of time after your account with such Customer is closed, you cease to use the Customer’s service that requires biometric authentication, or cease to be employed by such Customer (as the case may be). Where your local law has a specific deadline for destruction we will comply with that deadline (see specific State or other jurisdiction sections below).

How to Contact Us with Any Questions or Concerns about Privacy

If you have any concerns about privacy at authID, please contact us at legal@authid.ai with a description of your concern, and we will try to resolve the issue for you.

Contact details for jurisdictions outside the United States can be found in “Additional Information for Certain Jurisdictions” below.

When you interact with authID Offerings at the request of or as required by your employer or membership organization or a business whose services you use or wish to use, then your personal information may also be subject to that employer’s or organization’s or business’s privacy practices, and you should additionally direct privacy inquiries to them.

Changes to this Privacy Notice

This Privacy Notice is effective as of the date at the top of this Privacy Notice and will remain in effect subject to any changes in its provisions in the future, which will be in effect immediately after being posted on this page. authID reserves the right to update or change this Privacy Notice at any time and thus you should check this Privacy Notice periodically. Your continued use of the Site, any authID Software or Services after authID posts any modifications to the Privacy Notice on this page will constitute your acknowledgment of the modifications and your consent to abide and be bound by the modified Privacy Notice.

Additional Information for Certain Jurisdictions

We provide additional information about our controllers and data protection officers (as applicable), the privacy, collection, use and retention and destruction of personal information for users of authID Offerings located in certain jurisdictions.

European Economic Area and United Kingdom

Controller of Personal Information: When we process your personal information to provide authID Offerings (including Verified and Proof transactions) or to identify and eliminate duplicate user credentials and accounts (De-Duplication services), the Controller of your personal information is the authID Customer that has requested such services. Our Customer is the same the business or organization that has requested or required you to use authID services. This may be your employer or prospective employer, a membership organization which you are joining or to which you belong, or a business whose services you are receiving or wish to receive.  The identity of this Customer and data Controller will be shown on the screen when using the authID Services before you agree to these terms and conditions and Privacy Notice and collection of your ID document or “selfie” (and biometric). Contact information of the Controller will be provided to you directly by the Controller.

When authID processes your personal information other than in the context of providing services to our Customers, authID is the Controller of your personal information. For example, we act as Controller when we use your personal information to analyze and improve authID Offerings, to communicate with you for marketing or promotional purposes, to prevent fraud and abuse of our technology, or to comply with our legal obligations, all as described in more detail in the section above entitled “How We Use Personal Information”.

Authorized Representative in the EEA: authID’s legal representative in the EEA is:

The DPO Centre Europe Ltd
Alexandra House
3 Ballsbridge Park
Dublin, D04C 7H2
Ireland
eurep@authid.ai
+353 1 631 9460

Authorized Representative in the UK: authID’s legal representative in the UK is:

The DPO Centre Ltd
50 Liverpool Street
London
EC2M 7PR
United Kingdom
ukrep@authid.ai
+44 (0) 203 797 1289

 Legal Basis for Processing: We process your personal information on one or more of the following legal bases:

  • as necessary for our Customer to enter into a contract with you or a legal entity you represent, for the Customer to perform their obligations under such contract, to respond to related requests from you, or to provide customer support;
  • as necessary to enter into a contract with you or a legal entity you represent, to perform our obligations under such contract or under our contract with our Customer , to respond to related requests from or related to you, or to provide customer support;
  • where we have a legitimate interest, as described in this Privacy Notice (see How We Use Personal Information above);
  • as necessary to comply with applicable law and legal obligations, including to respond to lawful requests and orders; or
  • with your consent. When you consent to our processing your personal information for a specified purpose, you may withdraw your consent at any time, and we will stop further processing of your data for that purpose.

Information We Retain After Your Account is Closed.

 If you decide to terminate your agreement and close your account with our Customer, cease to use the services of such Customer or cease to be employed by such Customer and thereby wish to close your authID account, we will retain your content until directed by our Customer to delete it. During this period, you may decide to reopen your Customer account and thereby your authID account. At the end of this period, we will delete any content remaining in your account, with the exception that after account closure, we may need to keep certain information for an additional period of time for legal and legitimate business purposes. For example, we may retain personal information such as your contact information (e.g., name, email address, physical address), a log of the dates and times when you provided us consent to capture and use your personal information, or information for tax and accounting or legal purposes. If applicable, authID may also retain records of communications with you, as well as relevant logs (e.g., a log of your account closure) for dispute resolution purposes. We further may keep records for preventing fraud and ensuring security, for example in case of misuse of our services or violation of our terms.

Your Rights. Subject to applicable law, you have the right to:

  • ask whether we hold personal information about you and request copies of such personal information and information about how it is processed;
  • request that inaccurate personal information is corrected;
  • request deletion of personal information that is no longer necessary for the purposes underlying the processing, processed based on withdrawn consent, or processed in non-compliance with applicable legal requirements;
  • request us to restrict the processing of personal information where the processing is inappropriate
  • object to the processing of personal information; and
  • request portability of personal information that you have provided to us (which does not include information derived from the collected information), where the processing of such personal information is based on consent or a contract with you and is carried out by automated means.

Questions and Contacts. If you wish to do any of these things or have a data-protection related question, please contact us at legal@authid.ai or our legal representatives in the EU or UK identified above.

The data protection officer for authID can be contacted at legal@authid.ai

You can also lodge a complaint with a local data protection authority or our principal supervisory authority, the Data Protection Commission of Ireland. Information on how to contact the Data Protection Commission of Ireland is available at https://www.dataprotection.ie/en/contact/how-contact-us.

The Information Commissioner’s Office (ICO) regulates data protection matters in the UK. Information on how to contact the ICO is available at https://ico.org.uk/for-the-public/.

Cookies. Please refer to our Cookie Policy below at https://authid.ai/cookie-policy/.

Transfers Outside of the EEA. When we transfer your personal information outside the EEA, we do so in accordance with the terms of this Privacy Notice and applicable data protection law and if applicable in accordance with the provisions of any Standard Contractual Clauses we may have entered into with our Customer.

United States

California

These additional state-specific privacy disclosures, serve as a Notice at Collection under the California Privacy Rights Act, are required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

Categories of Personal Information Collected. The personal information that we may collect, or may have collected from consumers in the preceding twelve months, fall into the following categories established by the California Privacy Rights Act, depending on how you engage with the authID Offerings:

  • Identifiers, such as your name, alias, address, phone numbers, or IP address, your authID account log-in information, or a government-issued identifier (e.g., a state-issued ID number or an ID you provide for identity verification, which in some cases may reflect citizenship or immigration status);
  • characteristics of protected classifications under California or US federal law, such as age, race, or gender;
  • internet or other electronic network activity information, including content interaction information, which search engine you use, and a record of when you consent to authID’s Terms of Service and Privacy Policy;
  • biometric information;
  • geolocation data, which may in some cases constitute precise geolocation information, such as the location of your device or computer;
  • professional or employment-related information, for example data you may provide about your workplace location and time and attendance; and
  • inference data, such as information about your preferences

We collect this information from you, automatically through your interaction with the authID Offerings, or from third parties. We collect this information for the business and commercial purposes described in the “How We Use Personal Information” section above.

Categories of Personal Information Disclosed for a Business Purpose. The personal information that we may have disclosed about consumers for a business purpose in the preceding twelve months fall into the following categories established by the California Privacy Rights Act, depending on how you engage with the authID Offerings:

  • Identifiers, such as your name, address, or phone numbers, , or government identifier or certain types of ID you provide for identity verification that may in some cases reflect your citizenship or immigration status, for example if our Customer uses authID Services to verify your identity;
  • information that may reveal your age, gender, race, or other protected classifications under California or US federal law, for example if our Customer uses authID Services to verify your age, for sale of age restricted products;
  • commercial information, such as the details of a product or service you purchased if a Customer is seeking your approval to provide that product or service to you;
  • Internet or other electronic network activity information, such as if we use a third-party service provider to help us gather reports for analyzing the health of our devices and services;
  • geolocation data, which may constitute precise geolocation data, for example if our Customer uses authID Services to authenticate your transaction approval, for anti-fraud purposes.
  • professional or employment-related information, for example if we provide information to a third-party service provider for verification or registration as part of the authID Offerings;
  • inference data, for example if we use a third-party service provider to store information about your preferences

Categories of Recipients to Whom Personal Information May Be Disclosed. Your personal information is disclosed to the authID Customer in response to whose request or requirement you use the authID Offerings, and to such subprocessors and third party service providers, as authID may use to provide and support the authID Offerings.

Your Data Rights. You may have certain data rights under California state privacy laws, including to request information about the collection of your personal information by us, to access your personal information in a portable format, to correct or delete your personal information, to opt-out of the sale or sharing of your personal information, and the right to limit use and disclosure of sensitive personal information. Your right to request and access information also includes the right to request the categories of personal information collected; the categories of sources from which personal information is collected; the business or commercial purposes for collecting, or sharing personal information; the categories of third parties to whom personal information has been disclosed; and a copy of the specific pieces of personal information collected. If you wish to do any of these things or if you have any questions about how authID complies with California data privacy law, please contact us at legal@authid.ai. Additionally, you may have the right to appeal the denial of any of these rights by submitting a form that will be provided to you if we deny a data request. Depending on your data choices, certain services may be limited or unavailable.

To ensure the security of your authID account, we will generally ask you to verify your request using the contact information you have already provided. If you are an authorized agent making a request on behalf of a consumer pursuant to applicable state law, we may ask you to provide information verifying you have proper authority to make the request on behalf of the consumer or we may ask the consumer to verify their identity with us directly

No Sale of Personal Information; Restricted Sharing of Personal Information. We do not sell any personal information of consumers, as those terms are defined under the California Privacy Rights Act.  We only share personal information as disclosed in this Privacy Notice.

California Privacy Rights Act Sensitive Personal Information Disclosure. The categories of data that we collect and disclose for a business purpose include “sensitive personal information” as defined under the California Privacy Rights Act, in that using the Proof Service we may collect a copy of and data from your passport, alien registration card or other national ID document and we collect the precise geolocation of your computer or digital device. We do not use or disclose sensitive personal information for any purpose not expressly permitted by the California Privacy Rights Act.

California Privacy Rights Act Retention Disclosure. We retain your personal information as necessary to enable your continued use of authID Services, for as long as it is required in order to fulfill the relevant purposes described in this authID Privacy Notice, as permitted or as may be required by law, or as otherwise communicated to you. See Retention and Updating of Personal Information for additional information.

California Privacy Rights Act Non-Discrimination Statement. We will not discriminate against any consumer for exercising their rights under the California Privacy Rights Act.

California Privacy Rights Act De-identified Data Disclosure. authID may use de-identified data in some instances. authID either maintains such data without attempting to re-identify it or treats such data as personal data subject to applicable law. authID will not re-identify deidentified data, except as permitted by applicable law.

Illinois

These additional state-specific privacy disclosures, serve as notice pursuant to the Illinois Biometric Information Privacy Act, as amended (BIPA)

Consent to Processing of Biometric Information. We will never collect or use your biometric information without your prior written consent. You acknowledge that you provide a “written release” as mandated by BIPA when you click a box that says “Agree and Continue” while using the authID Services, after you are requested to consent to transact electronically and to authID collecting, transmitting, and processing your biometric information to our Customer, and after you are requested to consent to the authID Terms & Conditions of Use.

What Biometric Information Do We Collect and Store?  When you use the authID Services, you share a “selfie” photo with us which we process to extract “biometric identifiers”. These biometric identifiers are measurements related to your unique physical characteristics, comprising your facial measurements, which can be used to identify you.

For What Purposes Do We Collect, Use, and Store Biometric Information? We use your biometric information to provide Verified and Proof identity verification and authentication services to you and our Customers, as further described in this Privacy Notice. We use your biometric information in de-identified form to train and improve our platform algorithms. We never sell or share your biometric information and we do not use it other than as disclosed and consented to by you.

Biometric Information Privacy Act Retention Disclosure. We retain your biometric information as necessary to enable your continued use of authID Services, for as long as it is required in order to fulfill the relevant purposes described in this authID Privacy Notice, as permitted or as may be required by law, or as otherwise communicated and consented to by you.  Biometric information will be deleted upon request by the Customer that requested you to provide it, typically within a certain period of time after your account with such Customer is closed, you cease to use the Customer’s service that requires biometric authentication, or cease to be employed by such Customer (as the case may be).  In any event your biometric information will be deleted within 3 years of your last interaction with the authID Services.

Texas

These additional state-specific privacy disclosures, serve as notice pursuant to the Texas Business & Commerce Code Section 503.001 (“Texas Code”)

Information and Consent to Capture of Biometric Identifier. The disclosures in the Privacy Notice serve as the disclosures required for the purposes of the Texas Code. You acknowledge that you were informed about and provide consent to the capture of your biometric identifies, as mandated by the Texas Code, when you click a box that says “Agree and Continue” while using the authID Services, after you are requested to consent to transact electronically and to authID collecting, transmitting, and processing your biometric information to our Customer, and after you are requested to consent to the authID Terms & Conditions of Use.

We retain your biometric information as necessary to enable your continued use of authID Services, for as long as it is required in order to fulfill the relevant purposes described in this authID Privacy Notice, as permitted or as may be required by law, or as otherwise communicated and consented to by you.  Biometric information will be deleted upon request by the Customer that requested you to provide it, typically within a certain period of time after your account with such Customer is closed, you cease to use the Customer’s service that requires biometric authentication, or cease to be employed by such Customer (as the case may be).  In any event your biometric information will be deleted not later than the first anniversary of the date the purpose for collecting the identifier expires, except as provided by Subsection (c-1) of the Texas Code (use in connection with an instrument or document that is required by another law to be maintained for a longer period.)