Privacy policy

What this website collects

This website does not use cookies, analytics, advertising tags or tracking pixels, and it does not ask you to create an account.

The demo and pilot forms do not send anything to our servers. When you submit one, your own email app opens with a pre-filled message to admin@iverifi.io. Nothing reaches us unless you choose to send that email.

Emails you send us

If you write to us, we use what you send (for example your name, organisation, contact details and message) only to reply, arrange a demo or pilot, and follow up on your enquiry. We do not sell it or use it for advertising.

Third parties involved in serving this site

• Google Fonts: the site’s typefaces are loaded from Google’s servers, so your browser’s request (including your IP address) reaches Google.
• Hosting: our hosting provider serves the pages and may keep standard request logs such as IP address, time and page requested, for security and reliability.
• External links: links to LinkedIn, the iVerifi app and other sites are governed by those sites’ own policies.

Your rights and contact

You can ask us to access, correct or delete anything you have sent us, or raise a grievance, by writing to admin@iverifi.io. Requests are handled by the Grievance Officer described in section 11 of the platform policy below.

1. Who We Are

iVerifi IAM Private Limited (CIN: U62099MP2023PTC066602) is a DPIIT-recognised startup providing cloud-based digital identity verification and KYC authentication services for business-to-business clients across hospitality, institutional, co-living, corporate, and related sectors. Our platform infrastructure is hosted on AWS Asia Pacific (Mumbai) — ap-south-1 — ensuring data residency within India.

2. Scope

This Policy covers personal data processed by iVerifi as:

• Data Processor — processing Guest personal data on behalf of Subscribers (Data Fiduciaries) for identity verification.
• Data Fiduciary — processing personal data of Subscriber representatives and administrators for account management and billing.

3. Personal Data We Collect

3.1 Guest identity data (as Data Processor)

• Full name, date of birth, gender.
• Government-issued identity document details — Aadhaar (tokenised/masked), PAN, Passport, Driving Licence — via DigiLocker/Meri Pehchaan or authorised API providers.
• Facial photograph (where biometric verification is enabled).
• Address details from the identity document.
• Verification timestamp, Subscriber reference, and transaction ID.

3.2 Subscriber account data (as Data Fiduciary)

• Authorised representative name, designation, business email, and mobile number.
• Organisation name, address, GSTIN, and PAN.
• Subscription and billing details (no full payment card data stored).
• Platform usage logs and dashboard activity.

4. Purpose & Legal Basis

4.1 Guest identity data

Processed solely for digital KYC verification, regulatory compliance (e.g. C-Form for foreign nationals under the Registration of Foreigners Act, 1946), and fraud prevention as directed by the Subscriber. Legal basis: consent of the Data Principal (Guest) obtained by the Subscriber, and processing on documented Subscriber instructions under the DPDP Act 2023.

4.2 Subscriber account data

Processed for account management, billing, support, security, and legal compliance. Legal basis: performance of contract, legitimate interests, and legal obligations.

5. Data Sharing & Third-Party Processors

iVerifi does not sell personal data. Data is shared only with:

• Government APIs: Aadhaar/DigiLocker via Meri Pehchaan/APISetu (Government of India) and authorised API providers, solely to validate documents. Raw Aadhaar numbers are never stored — only tokenised references.
• Cloud infrastructure: AWS ap-south-1 (India) as sub-processor.
• OTP/SMS providers: For login and verification OTPs only; providers are not permitted to retain OTP content beyond delivery.
• Subscriber: Verification results (status, document type, masked identifier) returned for check-in or access purposes.
• Law enforcement: Where compelled by court order or applicable law, with notice to the Subscriber where legally permissible.

6. Data Localisation

All Guest personal data is stored and processed within India (AWS ap-south-1 — Mumbai). iVerifi does not transfer Guest personal data outside India.

7. Data Retention

• Guest identity data: Five (5) years from verification date, or as required by applicable law, whichever is longer.
• Subscriber account data: Duration of active subscription plus three (3) years for audit purposes.
• OTP logs: Ninety (90) days for security purposes.
• API access logs: Twelve (12) months for security monitoring.

Upon subscription termination, Guest data will be deleted or returned within thirty (30) days of written request, subject to statutory retention obligations.

8. Rights of Data Principals (Guests)

Under the DPDP Act 2023, Guests have the right to access, correct, erase, and raise grievances regarding their personal data. Requests may be directed to the Subscriber or directly to iVerifi's Grievance Officer at admin@iverifi.io. iVerifi will respond within fifteen (15) business days of a verified request.

9. Security Measures

• TLS 1.2/1.3 encryption in transit for all API communications.
• AES-256 encryption at rest on AWS.
• OV SSL certificate (eMudhra) for api.iverifi.io.
• Role-based access control (RBAC) on a need-to-know basis.
• Multi-factor authentication for all administrative access.
• Aadhaar masking — only the last four digits are displayed; full numbers are never logged or stored.
• Regular vulnerability assessments and penetration testing.

In the event of a Personal Data Breach, affected Subscribers will be notified within twenty-four (24) hours.

10. Children's Data

The Platform is not intended for use to verify identities of persons under eighteen (18) years of age. Subscribers must not submit verification requests for minors. iVerifi will delete any such data upon becoming aware.

11. Grievance Officer

Email: admin@iverifi.io
Operational Address: 37, 8th cross, 4th main, KGE Layout, RMV 2nd stage, Bangalore 560094
Complaints are acknowledged within three (3) business days and resolved within fifteen (15) business days.

12. Amendments

Material changes will be communicated to Subscribers with thirty (30) days' notice via registered email. This Policy was last updated on 09 April 2026 (Version 2.1).

13. Governing Law

This Privacy Policy is governed by the laws of India. Disputes are subject to jurisdiction of competent courts in Indore, Madhya Pradesh, India.