Privacy Policy
DRAFT 2025 MAY 12
Veros Privacy Policy
This is the privacy policy for Veros Inc. and its Veros Identity Provider (IDP) service including Veros App, a mobile app for palm recognition and authentication (together, the “Service”).
This policy does not apply to Veros and its affiliates’ handling of personal data unrelated to the Service.
About Our Palm Recognition Service
Our Service is built upon Veros’s palm recognition platform that allows for potential user verification and identification by showing the palm of a hand. If you enroll in the Service, you will use the Veros app you install on your mobile phone to take pictures or a video of the palm-side of your hands. Our technology analyzes the information in the photos and videos to calculate a unique descriptor for your palm, called a model. You can then use your palm as a possible means for authenticating yourself to the Veros service directly or to a third party website or application that you have authorized to use the service.
The palm models may be considered sensitive personal data under the laws of your jurisdiction.
About User Service Accounts
To start using the benefits of the Service, you must create an account with the Service. Your personal record consists of your personal metadata and indirect references to your palm biometric data. Your palm biometric data are stored and matched by an isolated Palm Matching service, which contains no personal metadata.
Information we collect from the Service, how we collect it and why
Palm Images. When you enroll in the Service, we collect—but do not store—photos and video frames of your palms to create your unique palm model. We delete the original images immediately after the creation of palm models except in limited cases where spoofing or fraudulent activity is suspected. In such cases, a palm image is anonymized, reviewed for fraudulent activity, and then securely deleted.
Palm Models. We collect and store encrypted palm models, which are representations derived from your palm images.. The palm models contain only irreversible features designed for use with our proprietary matching algorithm. They cannot be reversed to reconstruct the original palm images or patterns. When you wish to authenticate to the Service, or to a 3rd party application or website that has integrated the Service as a means of authentication, a temporary candidate palm model is created and compared against the stored palm models to confirm your identity. All palm models are encrypted in transit and at rest using industry-standard encryption protocols..
Account ID. Upon account creation, we assign you a random, unique identifier. This ID contains no personal information and serves solely to reference your Veros account.
Device Information. Each time you install or open the Veros App, the app will automatically collect non-personal data about your device and its camera. This ensures we deliver the correct app version and optimize performance for your hardware. The device information is only used locally by the app and not sent to our server.
Email Address. You may choose to provide an email when creating your Veros account. We use the email to identify your account and—only if you opt in—to send important notifications, such as updates to Privacy Policy. Supplying an email is optional and not required to use the core features of the Service.
Account History and Authentication History. When you log in to the Veros App and/or use Veros Service to authorize a transaction on a third-party platform, we record the date/time of that event. This helps us troubleshoot performance issues and investigate any questions about your authentication history.
Your Control Over Your Information and Palm Model
In order to enroll your palm model using the Veros App, and to use the Service, you must first provide explicit consent. We rely on your consent to provide the lawful basis for the processing of your personal data, including your palm models.
You may withdraw your consent by deleting your palm models from the Service by using the “Erase” function in your profile in the Veros App. This deletion completely wipes out your biometric information from our servers. Because we do not store any security tokens other than users’ palms, your identity must be successfully verified using palm matching prior to the models’ deletion. For security and privacy reasons, we are not technically able to process a request to delete a palm model (such as through an emailed request). Deletion of your palm model does not delete the record of your prior transactions that were authenticated with the deleted palm model, or your account activity. We may retain authentication transaction and other account activity records for up to 3 years, or longer if there is an ongoing investigation.
You may update your palm model at any time by deleting your stored palm models and completing the enrollment process again through the Veros App. Because palm models are derived representations, it is not possible to review or modify an existing model. To update, you must re-enroll.
Use of Service Data
We use the information we collect, store and process from the Service as follows:
To provide the Service
To enforce the legal terms that govern the Service.
We do not use your palm models or personal information for advertising, profiling, or resale purposes.
Sharing of Your Information and Palm Models
If you use the Service to log into or authenticate with a third party application or program, that third party application or program may be able to access a record of your Veros account ID and related usage metadata (e.g., timestamp, application ID)
to authenticate to the application or program. We may also share information with the third party in the event of suspected suspicious or fraudulent activity. The third party application or program will not have access to your palm model.
In addition, we may disclose personal information that we collect, or you provide as described in this policy:
To contractors, service providers and other third party service providers we use to support our business. These service providers are contractually bound to use your information solely to support our operations and are prohibited from sharing it independently. (except pursuant to a legal requirement such as a subpoena or warrant).
To our subsidiaries or affiliates.
To fulfill the purpose for which you provide the information or for any other purpose disclosed by us when you provide the information.
To comply with any law, court order, legal process, or government or regulatory request.
We do not sell or rent your biometric or personal data to any third parties.
Data Security, Storage and Retention of Palm Models
We maintain physical, organizational, and technical safeguards to manage data security risks, including with respect to palm models.
We store palm models in a dedicated database separate from any other data. Disk volumes are secured with full disk encryption.
We retain palm models until the earliest of (1) your request to delete your palm models, (2) when we no longer need it to provide the Service, and (3) 3 years after your last use of the Service. We hold other personal data for as long as necessary to fulfill the purposes set forth in this policy or as long as we are legally required or permitted to do so. However, information may persist in copies made for backup and business continuity purposes for longer than the original data.
International Users and International Data Transfers
We are based in the United States. If you are outside the United States, please be aware that privacy laws in the United States may not provide as much protection as the country in which you are located.
In order to enroll your palm model using the Veros App, and to use the Service, you must first provide your consent. If you are outside the United States, we rely on your consent to provide the lawful basis for the transfer of your personal data, including your palm models, to the United States and other jurisdictions as necessary to provide the Service, in accordance with applicable data protection laws.
If you are located in the European Union, we rely on your explicit consent in accordance with Article 49(1)(a) of the GDPR for the transfer of your biometric data to the United States.
If the laws of your jurisdiction do not permit collection, processing and transfer of biometric data based on consent, then you may not use the Service.
Children under the Age of 18
The Services are not intended for individuals under 18 years of age. We do not knowingly collect or store personal data from minors.
Changes to Our Privacy Policy
The date the privacy policy was last revised is identified at the top of the page. We will post any changes we make to our privacy policy on this page with a notice that the privacy policy has been updated via emails specified in your account. You are responsible for periodically visiting this privacy policy to check for any changes.
Contacting Veros
To ask questions or comment about this privacy policy and our privacy practices, you may contact Veros in the following ways:
Email: hello@veros.xyz
Last updated