truvon.id
Book a demo
Legal

Privacy Policy

How truvon.id collects, uses, shares, and protects personal information - on this website and within the platform our customers use to verify identities and manage compliance.

Last updated: 7 September 2026

This policy applies to truvon.id Inc. (“truvon.id”, “we”, “us”) and describes how we handle personal information when you visit truvon.id, contact us, or when your organisation uses the truvon.id platform. It does not change the terms of any written agreement between truvon.id and a customer; where a signed data processing agreement (DPA) exists, that agreement governs the processing of personal data submitted to the platform.

For personal information collected through our website and in the course of our own business (for example, sales enquiries, marketing, and support), truvon.id acts as a data controller.

For personal data that a customer submits to the platform, or that the platform collects on the customer’s instructions to verify an individual or business (for example, identity documents, biometric templates, screening results, and risk decisions), truvon.id acts as a data processor and processes that data only on the documented instructions of the customer, who is the controller. If you are an end user being verified through the platform, please direct privacy requests to the organisation that asked you to complete verification; we will support that organisation in responding.

Information you give us

  • Contact and account details - name, work email, company, job title, and the content of messages you send us.
  • Sales and onboarding information - details about your compliance programme that you choose to share when requesting a quote or a technical review.

Information collected automatically on our website

  • Standard server logs - IP address, browser type, pages requested, and timestamps.
  • Strictly necessary cookies and, where you consent, limited analytics (see section 11).

Information processed on a customer’s behalf within the platform

  • Identity data - government-issued document images and extracted fields, selfie or video capture, and biometric templates that cannot be reversed to an image.
  • Business and ownership data - corporate registry records, directors, shareholders, and beneficial-ownership calculations.
  • Screening and risk data - sanctions, politically-exposed-person, and adverse-media match results, fraud signals, risk scores, decisions, and investigation case records.
  • Audit metadata - timestamps, actor identifiers, and policy versions attached to each evaluation.

The categories, sources, and retention of platform data are determined by each customer in their configuration and their agreement with us.

As a controller (website and business operations), we use information to:

  • respond to enquiries, provide quotes, and run technical evaluations;
  • provide, secure, maintain, and improve our website and services;
  • send service communications and, where permitted, relevant product updates;
  • comply with legal obligations and enforce our agreements.

As a processor (platform), we use personal data only to provide the contracted services - verification, screening, risk decisioning, case management, and evidence retention - and to meet our security, audit, and legal obligations. We do not use platform personal data for our own marketing, and we do not sell personal information.

Where the GDPR, UK GDPR, or a similar law applies to our controller processing, we rely on: performance of a contract or steps taken at your request; our legitimate interests in operating and promoting a B2B service (balanced against your rights); your consent, where we ask for it (for example, non-essential cookies); and compliance with legal obligations. For platform processing, the customer (controller) is responsible for establishing the legal basis for the personal data they submit.

We share personal information only as needed and with appropriate safeguards:

  • Service providers / sub-processors - cloud hosting and storage, logging and monitoring, email delivery, and customer-support tooling, engaged under contract terms that restrict their use of the data. A current list of platform sub-processors is available to customers on request and through the DPA.
  • Screening and data providers - where a customer instructs the platform to query an external sanctions, PEP, adverse-media, registry, or biometric provider, the relevant query data is sent to that provider on the customer’s behalf.
  • Legal and safety - where required by law, legal process, or to protect the rights, safety, and security of truvon.id, our customers, or the public.
  • Corporate transactions - in connection with a merger, acquisition, or asset sale, subject to this policy and applicable law.

truvon.id may process information in countries other than the one where it was collected. Where we transfer personal data internationally, we use a lawful transfer mechanism such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision, together with additional safeguards where appropriate. Customers can configure platform data residency options where offered in their plan.

For controller data, we keep personal information for as long as needed for the purpose it was collected, then delete or de-identify it, subject to legal retention requirements. For platform data, retention periods are configured by each customer to meet their own regulatory obligations; evidence and audit records are held in non-destructive storage until the customer’s configured retention period expires.

We maintain administrative, technical, and organisational measures designed to protect personal information, including encryption in transit, encryption at rest through our cloud key-management service, hashed API credentials, tenant-scoped access controls, least-privilege internal access, and logging. No method of transmission or storage is completely secure; we work to protect information but cannot guarantee absolute security.

Depending on where you live, you may have the right to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise these rights for data we hold as a controller, contact us using section 14. For data processed on a customer’s behalf, we will refer your request to that customer. You also have the right to lodge a complaint with your local data protection authority.

Our website uses strictly necessary cookies to function. Any non-essential analytics are used only with your consent, which you can decline or withdraw at any time; declining does not affect your access to the site. We do not use advertising cookies.

Our website and platform are intended for businesses and are not directed to children. Where the platform verifies an individual’s age or identity, it does so on a customer’s instruction and under that customer’s responsibility.

We may update this policy from time to time. When we do, we will change the “last updated” date above and, for material changes, provide a more prominent notice.

For privacy or data-protection questions, email contact@truvon.id or use our contact page. Postal address available on request.