Privacy Policy

1. Who we are

Verifex is a sanctions, PEP, and business-verification (KYB) screening service ("Verifex," "we," "us," or "our").

For privacy questions or to exercise your rights, use our contact form, which reaches the controller named in section 16. This policy explains what personal data we process, why, on what legal basis, who we share it with, how long we keep it, and the rights available to you.

2. Our roles: controller and processor

Verifex acts in different capacities depending on the data:

• Controller. For data relating to your account, billing, the operation of the service, security, and support, Verifex determines the purposes and means of processing and is the controller.
• Processor. When you submit names, entities, or other inputs to our screening or KYB features for your own compliance purposes, you (the customer) are the controller and Verifex processes that data on your behalf and on your instructions. The data you screen may include personal data of third parties; it is not simply "public data."
• Controller of our screening data. Verifex compiles the sanctions, politically exposed person (PEP) and news data that screening is checked against, from official and public sources. For that data Verifex is the controller. Section 6 explains it for the people it is about.

3. Data we process

• Account data: name, email address, hashed password, and optional company name, website, role, country, timezone, phone number, industry, use case and preferred language; the secret and backup codes for two-factor sign-in if you turn it on.
• Authentication and signup data: signup IP address, user-agent, referrer, and UTM/campaign parameters, together with password-reset and verification tokens.
• API usage metadata: API keys (stored as hashes), the endpoints called, timestamps, request IP addresses, and whether a match was found.
• Screening inputs and results: the names and entity details you submit for screening, including any date of birth, nationality, country or identity document number you include, plus match results, confidence scores, and decisions. Screened names may be personal data.
• Screening watches: entities you place under ongoing monitoring, and the associated risk information. Monitoring alerts sent by email, or to a Slack or webhook address you configure, include the watched name and its closest list match.
• Batch data: uploaded files, requester email, company name, and per-row names and matches.
• KYB data: company officers, persons with significant control (PSCs), and ultimate beneficial owners (UBOs), including names and, where provided by the source, dates of birth, plus sanctions and adverse-media findings.
• Verifex Shield data: where you use Shield for transaction and fraud monitoring, the details of your own customers and their activity that you send: names, dates of birth, account balances, payment amounts and events, and device information, with bank account numbers, card numbers and IP addresses stored as one-way hashes or masked.
• Billing data: customer email and subscription details held by our payment provider; we do not store your card details.
• Transactional email data: recipient email and message content for verification, reset, receipt, and notification emails.
• Support and contact-form communications: the content of messages you send us. Messages sent through our website forms also include the sender's IP address and browser details, to help us spot abuse.
• Business contact data: names, job titles, work email addresses and public professional profile links of people at organisations we think may be interested in Verifex, taken from public web sources together with the page where we found them, and our record of any emails we send them.
• Account review signals: internal scores and notes about customer accounts, used to detect abuse and to understand which accounts may need sales or support attention.
• Security and operational logs: authentication events, administrator audit logs, error logs, uptime checks, and rate-limiting data.

4. Purposes and legal bases

Where data-protection law such as the GDPR applies to our processing as a controller, we rely on the following legal bases:

• Contract: to create and administer your account, authenticate API requests, deliver screening and KYB results, and manage billing and subscriptions.
• Legitimate interests: to secure the service, prevent fraud and abuse, apply rate limiting, monitor and improve reliability, provide support, review customer accounts, and tell business contacts about Verifex, balanced against your interests and rights. You can object to direct marketing at any time, and we will stop.
• Legal obligation: to keep certain records and to respond to lawful requests where the law requires it.
• Consent: where we specifically ask for it; you may withdraw consent at any time.

Where Verifex acts as a processor for the screening and KYB data you submit, we process it only on your documented instructions and for the purpose of providing results to you. The service can preserve screening history, monitoring watches, entity context and decision evidence. Whether a particular activity is treated as profiling under applicable law depends on the processing context and is subject to legal review. We do not use your screening inputs to train models for other customers.

5. AI-assisted processing

The adverse-media feature (Growth plan and above) uses a third-party AI provider, Anthropic, to classify news headlines found about a screened name. This is only active when the feature is enabled; when it is not configured, the feature does nothing. When enabled, only limited data is sent to Anthropic through its commercial API: the screened name and its aliases, entity type, country and industry, and the headline, website and date of each article. Article text beyond the headline is not sent. This is done under Anthropic's commercial terms, which include data-processing terms; our review of the transfer arrangements is still in progress (see /subprocessors). Under those commercial terms, this data is not used for general model training by default. Your account email, API keys, and payment data are never sent for AI processing.

6. If you appear in our screening data

Screening only works if there is something to screen against. Verifex compiles that data, and is its controller. This section is for the people it is about.

• What we hold: names, aliases, dates and places of birth, nationalities, identity document numbers, positions held, the reasons and dates of a listing, and links to the official or public source, as published by that source.
• Where it comes from: official sanctions, debarment and watch lists published by governments and international bodies (for example the UN, the EU, the UK and the US); public sources about people who hold or held prominent public positions (politically exposed persons), such as Wikidata and national registers; company registries; and, for the adverse-media feature, news headlines found through the GDELT Project.
• Why: so that banks, payment companies and other businesses can meet their legal duties to check customers and payments against sanctions, anti-money-laundering and similar rules, and keep a record that they did.
• Legal basis: our legitimate interest, and that of our customers, in preventing financial crime and complying with those laws. Some entries concern alleged offences, or show political roles. We use them only for these checks, keep them to what the checks need, and do not use them for marketing.
• Who sees it: our customers, when a name they screen may match an entry, and the service providers listed at /subprocessors.
• How long: while the entry is published by its source. When a source removes an entry, we mark it inactive so that it is no longer matched, and keep it, with our records of past screening results, so that a customer can show what was checked at the time.

Being in this data is not, on its own, a finding of wrongdoing. Many people are listed only because of a public role. If you believe an entry about you is wrong or out of date, or you want to object, tell us through the contact form. We will check it against the source and correct or remove what is inaccurate. Where an official list itself is wrong, the change has to be made by the authority that publishes it, and we will tell you which one.

7. Recipients and subprocessors

We share personal data with a limited set of service providers who process it on our behalf: for hosting, payments, email, optional AI features, error monitoring, uptime monitoring and operational alerting. Some features also send a name to an independent public source, such as a news search or a company registry, to fetch results. Alerts you configure are sent to the Slack or webhook address you choose. The current, canonical list is maintained at /subprocessors. We do not sell, rent, or trade personal data.

8. International transfers

Our primary infrastructure is hosted in the European Union (Hetzner, Germany/Finland). Some subprocessors are located in the United States or elsewhere. Where personal data is transferred outside the EU/EEA or the UK and a transfer mechanism is required, we use, or are putting in place, the European Commission's Standard Contractual Clauses (SCCs), with the UK Addendum for UK data, or another valid mechanism. Some vendor transfer arrangements are still under review; see /subprocessors for the per-vendor status.

9. Data retention

10. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data, subject to legal retention requirements.
• Port your data in a machine-readable format.
• Restrict or object to processing in certain circumstances, and object to direct marketing at any time.
• Withdraw consent where processing is based on consent.

To exercise any of these rights, use the contact form. We reply within one month, as the law requires, to the email address you give us. Account closure is requested the same way. Where the screening or KYB data is submitted by a customer, requests from the underlying data subjects are generally directed to that customer as controller; we will assist them as processor.

Complaints. You can complain to us about how we handle personal data through the contact form. We acknowledge a complaint within 30 days and tell you what we did about it. Where the GDPR or a comparable law applies, you also have the right to complain to a data-protection supervisory authority, such as the Information Commissioner's Office in the UK or the authority where you live in the EU.

11. Automated decisions

Verifex does not itself make decisions about people that have legal or similarly significant effects. Screening, monitoring and Shield results are candidate matches, scores and recommendations returned to our customers, who decide what to do. Customers are responsible for human review where the law requires it.

12. Cookies

We use only strictly necessary cookies, plus browser storage for dashboard preferences. See our Cookie Policy for details.

13. Security

We apply technical and organizational measures to protect personal data, described on our Security page. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

14. Data Processing Agreement

If you process personal data of individuals and require a Data Processing Agreement, a draft is available for contractual review. See /dpa or ask through the contact form.

15. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you by email.

16. Contact

Questions or requests about this policy or our data practices can be sent to [email protected], or through the contact form. Both reach the controller; the address is given directly because Articles 13 and 14 require the controller's contact details, and a form alone is a thinner disclosure than an address.