Verify privacy notice

The company that sent you the verification link (the “team”) decides to verify you and what to do with the result. It is the controller of your data, and its name is shown at the top of the verification page.

UpskyAI runs Verify for that company, as its processor. We process your data only to carry out the verification it asked for, on its instructions, and never for our own purposes. UpskyAI operates in Mexico, and this notice is governed by Mexican law. You can reach us at info@upsky.dev.

What we collect depends on the kind of check the company asked for:

• Your face, during the liveness check: a short live video from your front camera, used to confirm that a real person is in front of the camera. The video is analyzed as it streams and is not recorded or kept.
• A selfie: one still frame from the liveness check, or a photo you take, used to estimate your age and, when an ID is needed, to compare with the photo on it.
• Your ID, when the check needs one: photos of the front and back, and the details read from it, such as your name, date of birth, document number, issuing country and expiry date.
• The results: whether the liveness check passed, your estimated age range, how closely your face matches your ID, and the final decision with its reasons.
• Technical data: when each step happened, and the IP address and browser your device sends, which our hosting provider records in its logs.

Your face and the photos of it are biometric data, which Mexican law treats as sensitive personal data. That's why we ask for your express consent before you start.

Your data is used only to verify your age or identity for the company that sent the link, and to protect that verification against fraud. Specifically, to:

• Confirm that a real, present person is taking part, not a photo, a screen or a mask.
• Estimate your age from your selfie and compare it with the minimum age the company set.
• Read your ID, check that it's valid, and compare its photo with your selfie.
• Give the company the result, and show it to you on the page when the company chose to.

We don't use your data for marketing, we don't sell it, and we don't use your face, your photos or your ID to train artificial intelligence models, ours or anyone else's. We don't build a face template or a database of faces, and we don't use your face to recognize you in any other verification.

Before the first photo, the verification page asks you to agree to this processing by ticking a box. Nothing is captured until you do. Your consent covers only this verification, for this company.

You can stop at any time by closing the page. Photos are saved as you take them so that you can continue on another device; if you don't finish, the link expires and the photos are deleted on the same schedule as any others. Once you've sent the verification, you can ask for your data to be deleted as described under your rights.

The checks are automated: each one gives a score, and the scores are compared with the settings the company chose. A clear result is approved or rejected automatically. When the result is unclear, it's sent to a person at the company to review.

Age estimation and face comparison can be wrong, especially in poor light. If you think a decision about you is wrong, ask the company for a review by a person, or to try again with a new link.

Your data is shared only with:

• The company that sent the link, which receives the result and, when it opens the verification, your photos and the details read from your ID.
• Amazon Web Services, which runs the liveness check, age estimation and face comparison for us. It processes the images only to return the result, and we've opted out of AWS using them to improve its services.
• Cloudflare, which stores the photos; Supabase, which hosts the database with the results; and Vercel, which hosts the verification page.
• Authorities, only when a law or a court order requires it.

These providers act as our processors, under contracts that limit them to providing their service. Some of them process data in the United States, so your data may be transferred outside Mexico. These transfers are needed to provide the service you're taking part in.

• The live video from the liveness check isn't kept.
• Your selfie and the photos of your ID are deleted automatically after the verification ends, whether you finished it or not: after 30 days, unless the company chose a different period, of up to one year. The page where you take the photos tells you how long before you start.
• The results and the details read from your ID stay with the company as its record of the verification, until it deletes them, asks us to, or closes its account. The details from your ID are stored encrypted.

The company may keep its own copy of the result for longer, under its own privacy notice.

Every verification link is unique, hard to guess, and stops working when it expires or once the verification is sent. Your data travels encrypted, the details from your ID are encrypted when stored, and only the company that sent the link can see your verification.

Inside UpskyAI, access to verification data is limited to what's needed to run and support the service.

You have the rights of access, rectification, cancellation and opposition (ARCO), and you can withdraw your consent or ask for your data to be deleted early. Since the company that sent the link is the controller, the quickest way is usually to ask it directly.

You can also write to info@upsky.dev, with your name, the company that verified you, the approximate date, and what you're asking for. We may ask for a way to confirm it's you, and we'll work with the company to answer within the timeframes set by law.

If you believe your request wasn't handled properly, you may file a complaint with the Ministry of Anti-Corruption and Good Governance, the authority for personal data held by private parties.

Any change to this notice will be published on this page with its date. A verification is always covered by the version in force when you gave your consent. If a change needs new consent, we'll ask for it.