CROWDIFAI LEGAL

KYC & Identity Verification Privacy Notice

Effective date: 25 September 2026 · Draft for legal review
Important: This document is a legal-review draft. Bracketed fields must be completed and the final text must be approved before publication.

Draft for legal review — effective 25 September 2026

This notice applies when CrowdifAI asks you to verify your identity for seller onboarding, marketplace trust, payout eligibility, fraud prevention or another clearly stated compliance purpose. It supplements the CrowdifAI Privacy Policy.

1. Who processes KYC information

CrowdifAI operator: [LEGAL ENTITY NAME], [REGISTERED ADDRESS]. Privacy contact: [PRIVACY EMAIL]. KYC support/appeal: [KYC SUPPORT EMAIL].

Depending on the verification method, CrowdifAI may process information itself and/or use an identity provider such as Stripe Identity. If a provider directly collects your information, its own privacy notice also applies.

2. Why identity verification is required

CrowdifAI may use KYC/identity verification to:

  • confirm that the person receiving creator/seller payouts is genuine;
  • reduce account takeover, duplicate/fraudulent accounts and payment abuse;
  • protect buyers, creators and the marketplace;
  • satisfy payment/payout-provider requirements; and
  • meet legal, tax, sanctions or other compliance obligations where applicable.

CrowdifAI should not require identity-document collection for features that do not genuinely need it.

3. Information we may collect

Depending on the selected verification path, this may include:

  • identity-document type;
  • front/back image of an identity document;
  • name, date of birth, document data and other information visible on the document;
  • selfie image;
  • verification-provider/session identifier;
  • image quality and anti-spoofing/liveness signals;
  • automated confidence/result information;
  • verification status;
  • rejection reason;
  • human reviewer notes; and
  • timestamps/audit evidence associated with the verification.

Do not submit more information than requested. In particular, do not include unrelated passwords or financial credentials in uploaded images.

4. Selfie, face and liveness processing

CrowdifAI’s current verification workflow can use automated image/face/liveness and quality signals to help determine whether a submitted selfie/document appears suitable and consistent for identity verification.

Depending on the exact production implementation and applicable law, face/liveness processing may be treated as sensitive or biometric processing. CrowdifAI must complete the applicable legal-basis/impact assessment before production use in each launch jurisdiction.

We do not represent that an automated score is infallible or that a low score proves fraud.

5. Automated decisions and human review

Automated checks may flag a submission for rejection or further review. Where applicable law requires human review, or where CrowdifAI’s production policy provides an appeal, you may contact [KYC SUPPORT EMAIL] and ask for review of the result.

CrowdifAI should not make a legally significant final decision based solely on an automated face/liveness score where applicable law prohibits that practice.

6. Legal basis

The legal basis depends on the jurisdiction and reason for verification. It may include:

  • performance of the seller/payout contract;
  • compliance with a legal obligation;
  • CrowdifAI’s legitimate interests in preventing fraud and protecting marketplace security, where permitted; and/or
  • explicit consent where the law requires consent for the particular sensitive/biometric processing.

CrowdifAI must document the actual basis used for each production KYC route rather than relying on this list generically.

7. Who receives KYC information

KYC information may be accessible to:

  • authorized CrowdifAI compliance/support personnel with a need to review it;
  • the configured identity-verification provider;
  • payment/payout providers where verification is required for their service;
  • hosting/storage providers acting on CrowdifAI’s instructions; and
  • regulators, courts, law enforcement or advisers where disclosure is legally required or necessary to establish/defend a legal claim.

KYC document/selfie images are not part of marketplace datasets and are not made available to dataset buyers merely because you sell a dataset.

8. Retention

CrowdifAI will keep raw KYC images only for the shortest period reasonably necessary for the verification and applicable legal/compliance requirements.

Before publication, CrowdifAI must set and disclose exact production periods:

  • raw identity document images: **[KYC RAW DOCUMENT RETENTION]**;
  • selfie images: **[KYC SELFIE RETENTION]**;
  • provider/session references: **[KYC PROVIDER RECORD RETENTION]**;
  • verification outcome/audit evidence: **[KYC RESULT RETENTION]**; and
  • rejected/incomplete verification records: **[KYC FAILED/INCOMPLETE RETENTION]**.

If a legal hold, fraud investigation or regulatory duty requires longer retention, access will be restricted to that purpose.

9. Security

CrowdifAI will restrict KYC access to authorized functions/personnel, use secure transport and appropriate protected storage, and maintain access/audit controls suitable for sensitive identity data.

Production KYC files should not be exposed through public object URLs, ordinary analytics, crash logs, support logs or marketplace previews.

10. International transfers

If a KYC provider or hosting provider processes your information outside your country, the international-transfer section of the CrowdifAI Privacy Policy applies. Where required, CrowdifAI will implement an applicable transfer mechanism and contractual safeguards.

11. Your choices and rights

You may have rights to access, correct, delete/restrict certain data, withdraw consent where consent is the legal basis, object to certain processing, or request review of certain automated decisions.

Some KYC information may need to be retained despite an account-deletion request for fraud, payment, tax, sanctions, dispute or other legal reasons. If retained, it will be restricted to the applicable purpose.

To exercise applicable rights, contact [PRIVACY EMAIL].

12. If you do not complete KYC

Where KYC is required for a regulated/payment/seller feature, you may be unable to publish commercially, receive payouts or use that feature until verification is completed. CrowdifAI should not block unrelated basic account features merely because KYC is incomplete unless there is a separate security/legal reason.

13. Changes

If CrowdifAI materially changes the KYC provider, data collected, biometric/liveness method or purpose, it will update this notice and provide any new just-in-time notice/consent required by law before the new processing begins.