Scope and contact
This policy covers the FaceX Verify website, developer workspace and configured API or verification services. “FaceX”, “we” and “our” refer to FaceX Verify.
Questions and privacy requests can be sent to support@facexverify.com. Our contact addresses are Flat 4, Ulumbo Plaza, Gwarinpa, Abuja, Federal Capital Territory, Nigeria; and 1 Imperial Court, Exchange Street East, Liverpool, United Kingdom.
Our role
We handle account administration, workspace billing, security and support information to provide and operate FaceX. Where a business uses a configured verification service to check an individual, that business determines the verification purpose and how it uses the outcome.
The applicable service agreement sets the processing instructions and responsibilities for that verification data. Individuals should contact the business requesting their verification about its decision or use of the result; FaceX can assist with requests concerning information held through our service.
Data we handle
| Category | Examples |
|---|---|
| Account and workspace | Name, email, company details, profile information, membership and authentication records. |
| Business compliance | Application details, registration documents, proof of address, policies, attestations and review history. |
| Billing and operations | Wallet activity, payment references, amounts, selected environment, request metadata and audit records. |
| Support | Contact information, messages, request status and replies. |
| Configured verification | Identity details, document images, registry responses, camera evidence and outcomes required by the selected flow. |
| Technical data | Session information, timestamps and network or device information associated with operating and securing the service. |
Identity and biometric processing depends on the service enabled for the integration. The requesting business should explain the information needed before you start that flow.
Purposes and lawful basis
We use account, business and support information to administer workspaces, review access applications, respond to enquiries and provide the contracted service. Operational and payment records support reconciliation, troubleshooting, security and dispute handling.
Processing must have an applicable lawful basis, such as a contract, legal obligation, consent or a legitimate purpose permitted by law. A business requesting verification is responsible for its own basis and notices. Where processing relies on consent, it must be obtained before the relevant check.
Storage and retention
Account, compliance, payment, support and audit records are retained for the purposes they serve, taking account of applicable legal, contractual and security requirements. Request the retention schedule for your service when establishing your integration.
Data-only API responses are encrypted for retry handling and available for up to 24 hours. Expired response copies are cleared hourly. Request fingerprints and operational records contain no raw identity details; data-only retry records are removed after 90 days. Businesses remain responsible for the information they retain after receiving a response.
Workspace image-retention preferences and verification-flow deletion requests must be applied through the relevant processing service. Local camera-file cleanup, cancelling an attempt and deleting a backend identity flow are distinct operations.
Our service providers may process information outside your country. The applicable processing agreement should identify locations and safeguards for the deployment; an office address is not a statement that all data is stored in that country.
Country information
We collect the country you select for your account. When you use the developer portal or submit a verification, we also estimate the connection country from the network address using a database on our server. This can differ from your residence or document’s issuing country, particularly when you use a VPN or mobile network.
Country records support account administration and verification review. Country detection does not request GPS permission or send your network address to a geolocation API. IP geolocation by DB-IP.
Browser storage
The developer dashboard uses browser storage for authentication sessions and the Remember me preference. Session storage is used for a session that is not remembered; remembered sessions use local storage. Hosting and payment providers may use their own session mechanisms.
You can sign out and clear browser storage through your browser settings. Clearing that storage does not delete information already held in the workspace or a processing service.
Your privacy rights
Depending on applicable law, you may request access, correction, deletion or portability, object to or restrict certain processing, or withdraw consent. These rights can be subject to lawful exceptions and verification of your authority to make the request.
Email support@facexverify.com with the request type and enough non-sensitive context to identify the account or flow. We may arrange a secure way to confirm your identity. For data processed for another business, contact that business first or identify it so we can direct the request appropriately.
You may raise a complaint with the relevant data-protection authority, including the NDPC for Nigerian data-protection matters.
Automated checks and review
A configured verification service may use automated document, face, liveness or capture-integrity checks. Results should be assessed under the requesting business’s policy, with review for uncertain or disputed outcomes.
If you believe an important decision about you was incorrect, contact the business making it and request an explanation or human review where applicable. FaceX support can help investigate the service information involved.
Security and incidents
Access checks, workspace separation, private compliance-document storage and server-key controls are described in our Security overview. Your organization must also protect credentials and the personal data it receives.
Report a suspected exposure to support using a redacted description. Where an incident involves personal data, notification and response obligations depend on the applicable law and service agreement.
Children and policy changes
FaceX business accounts are intended for authorized business representatives. A business wishing to verify a child must confirm that the proposed service permits that use and obtain any required parental or other authorization before submitting information.
We may update this policy as services or processing arrangements change. The date on this page identifies the current version. Material changes affecting an agreed service will be addressed through the applicable service and notification arrangements.