Privacy Policy

VerifiedFast queries publicly available government registries, licensing boards, and official databases to verify professional credentials. We do not access private or non-public records.

Query parameters and verification results are cached in our systems for up to 90 days. This cache serves repeat queries faster and reduces redundant lookups against source registries.

Cached verification data is automatically purged after the 90-day retention window. You may request earlier deletion by contacting support.

We do not create persistent profiles, dossiers, or aggregated records of the individuals being verified. Verification data is stored solely to fulfill API requests and is keyed to the original query, not to the individual.

The ID Verification feature processes sensitive personal data differently from professional license verifications. The following practices apply specifically to ID verification sessions:

• Images are never stored. Uploaded ID photographs and selfies are processed entirely in memory. Images are passed to OpenAI's vision API over encrypted channels for analysis and are immediately discarded from our systems after processing completes.
• Only cryptographic hashes are retained. We generate and store SHA-256 hashes of uploaded images solely for the purpose of fraud detection, duplicate submission prevention, and audit trails. These hashes cannot be reversed to reconstruct the original images.
• Extracted data is stored. The AI analysis results — including face match determination, confidence score, detected ID type, and OCR-extracted fields (full name, date of birth, address, ID number, expiry date, and issuing state) — are stored in our database and associated with the API customer's session.
• OpenAI processing. Images are transmitted to OpenAI's vision API analysis. OpenAI's API data usage policies provide that API inputs and outputs are not used to train their models.
• Session expiration. Verification sessions expire automatically (default 24 hours, maximum 72 hours). Expired sessions cannot accept new image uploads.
• Hosted page privacy. The hosted verification page is not indexed by search engines (noindex, nofollow). Each session URL is unique, randomized (UUID), and single-use.

The SMS Phone Verification feature processes phone numbers for the purpose of sending one-time verification codes. The following practices apply specifically to SMS verification:

• Phone number storage. Phone numbers submitted for SMS verification are stored in E.164 format in our database for the purpose of rate limiting and session management. Phone numbers are masked in all API responses (e.g., +1***4567) and are not shared with third parties except Twilio for SMS delivery.
• Verification codes are hashed. One-time verification codes are SHA-256 hashed before being stored. The plaintext code is sent to the phone number via SMS and is never stored or logged on our systems after the SMS is dispatched.
• Twilio SMS delivery. SMS messages are delivered through Twilio, Inc. Phone numbers are transmitted to Twilio for the sole purpose of delivering the verification code. Twilio's data handling is governed by their privacy policy and terms of service.
• Session data retention. SMS verification session records (including masked phone number, verification status, attempt count, and timestamps) are retained for billing and audit purposes. Sessions expire automatically after the configured duration (default 10 minutes, maximum 30 minutes).
• No marketing use. Phone numbers collected through the SMS verification feature are never used for marketing, advertising, or any purpose other than delivering the requested verification code and enforcing rate limits.

We do not sell, rent, or trade your personal data or verification query data to any third party for marketing or advertising purposes.

We share data only with the following categories of third parties:

• Stripe, Inc. — processes payments and manages billing on our behalf. Stripe's handling of your data is governed by the Stripe Privacy Policy.
• Infrastructure and hosting providers — who store and process data on our behalf under contractual data protection obligations.
• OpenAI, L.L.C. — processes ID verification images through their vision models API for face matching and OCR analysis. Images are transmitted over encrypted channels and are not used by OpenAI for model training per their API data usage policies.

We may also disclose your information if we believe in good faith that disclosure is required by applicable law, regulation, subpoena, court order, or other governmental request, or is necessary to protect our rights, your safety, or the safety of others.

We implement technical and organizational measures designed to protect your data against unauthorized access, alteration, disclosure, or destruction.

• API keys are hashed using SHA-256 before storage. Raw API keys are never persisted in our systems after initial generation.
• All data in transit between your systems and our Service is encrypted using TLS 1.2 or higher.
• Data at rest is encrypted on our production infrastructure.
• Production systems are subject to access controls, authentication requirements, and audit logging.

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Depending on your jurisdiction, you may have certain rights regarding your personal data. You may:

• Access your personal data and API usage history via the account dashboard or by contacting us at [email protected].
• Request deletion of your account and all associated data.
• Export your API usage history in a machine-readable format.
• Opt out of non-essential email communications at any time by using the unsubscribe link in our emails or by contacting support.

To exercise any of these rights, contact us at [email protected]. We will respond to verified requests within 30 days.

We use only essential cookies that are strictly necessary for the operation of the Service, including session management and authentication tokens.

We do not use third-party advertising trackers, social media pixels, or cross-site tracking technologies. We do not participate in ad networks or data exchanges.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors.

For material changes, we will provide at least 30 days' advance notice via email to the address associated with your account before the changes take effect.

Your continued use of the Service after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms.