Privacy Policy

1. Who we are

YeboVerify is an identity-verification service operated by Omevision in Manzini, Eswatini. This policy explains what personal data we receive, how we use it, who we share it with, and how long we keep it. It applies to data collected through the YeboVerify API, the verify.yeboverify.com hosted flow, and the SDKs that wrap them.

2. Data we process

When a business asks YeboVerify to verify one of their users, we receive and process:

• ID document images — the front (and back, where applicable) of a government-issued ID, passport, or driver's licence.
• Selfie + liveness frames — photos of the user's face used to confirm a real person matches the document.
• Extracted document data — name, date of birth, sex, ID number, nationality, issue and expiry dates, and document type read from the ID via OCR.
• Reference identifiers — an `externalRef` your business may pass us (typically a user ID), a YeboVerify-generated `verificationId`, and timestamps.
• Technical signals — IP address, device user-agent, and browser language, used for fraud prevention and rate limiting.

3. Why we process it

We process this data only to deliver the verification service the business requested:

• Confirm the document is authentic and unaltered.
• Compare the selfie to the document photo to confirm the same person is presenting both.
• Return a decision (approved / rejected / needs review) plus the extracted fields to the business.
• Detect and prevent fraud — for example, a single ID submitted across many user accounts.
• Comply with KYC and AML obligations the business is using YeboVerify to meet.

We do not sell, rent, or share your personal data for advertising, profiling, or any other secondary purpose.

4. Legal basis

The business that asks you to verify is the data controller. They rely on your consent to use YeboVerify, and on their own legal obligations (e.g., financial-services KYC rules) to require verification. YeboVerify acts as a data processor on their behalf under a written data-processing agreement.

5. Sub-processors

To run the service we use a small number of vetted vendors:

• Cloudflare R2 — encrypted object storage for ID images and selfies. Bucket is private; access is granted only via short-lived signed URLs.
• Amazon Web Services (AWS Rekognition) — face comparison between the document photo and the selfie. AWS does not retain the images after processing.
• Google Gemini — OCR and structured extraction of document fields. Google does not retain the images for model training under our enterprise terms.
• Google Cloud Run + Neon Postgres — application hosting and database for verification metadata. Hosted in the EU (Belgium / Frankfurt) for prod.

6. Retention

Verification records — ID images, selfies, extracted data, decisions — are retained for as long as the requesting business requires them to meet their KYC/AML record-keeping obligations, typically 5 to 7 years under Eswatini financial-services regulations. You can ask the business that requested your verification to delete your record; they can in turn instruct YeboVerify to remove it. After deletion, images are purged from R2 within 24 hours and database rows are removed immediately.

7. Security

All data in transit is encrypted with TLS 1.2 or higher. Images at rest are encrypted with server-side AES-256. API access is gated by per- business API keys and webhook payloads are signed with HMAC-SHA256. Access to production data is limited to a small number of named Omevision engineers, audited via Google Cloud audit logs.

8. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete the personal data we hold about you, and to object to or restrict our processing. Because YeboVerify acts on behalf of the business that asked you to verify, the fastest path is to ask that business directly. They will instruct us, and we'll act within 30 days.

If you can't reach the business, or your request is about YeboVerify's own use of the data, email us at [email protected].

9. International transfers

Some of our sub-processors (AWS, Google) are headquartered in the United States. Where data leaves Eswatini or the EU, we rely on Standard Contractual Clauses and the vendors' approved transfer mechanisms to keep your protection equivalent.

10. Children

YeboVerify is not directed to children. We do not knowingly accept verifications for users under 18 unless the requesting business has a lawful basis (e.g., parental consent for a regulated minor account). If you believe a child's data has been submitted in error, contact us at [email protected] and we'll delete it.

11. Changes to this policy

We'll update this policy when we add new sub-processors, change how we handle data, or to reflect new regulation. The "Last updated" date at the top will move when we do. Material changes will be communicated to businesses using YeboVerify in advance.

12. Contact

YeboVerify by Omevision
Manzini, Eswatini
Privacy: [email protected]
General: [email protected]