KVKK Disclosure Notice

VerifyBlind (hereinafter referred to as "VerifyBlind" or the "Company") acts as a data controller under Law No. 6698 on the Protection of Personal Data ("KVKK"). This notice has been prepared in accordance with Article 10 of KVKK to inform you about your rights regarding your personal data and the principles governing the Company's processing of such data.

1. Identity of the Data Controller

The data controller is VerifyBlind LLC, a technology company operating in the identity verification field (registered in Wyoming, USA; 30 N Gould St Ste N, Sheridan, WY 82801, USA). Contact: kvkk@verifyblind.com

2. Our Privacy-Focused Architecture and Data Processing Approach

VerifyBlind is built on an architecture that enables identity verification without exposing your personal data. Your Turkish national ID number (TCKN), full name, date of birth, and biometric data are end-to-end encrypted on your device and transmitted only to an AWS Nitro Enclave.

AWS Nitro Enclave is a hardware-level isolated secure processing environment. No party — including VerifyBlind employees — can access data inside the Enclave; this guarantee is enforced by cryptographic attestation. Your identity and face data are deleted inside the Enclave immediately after being processed for verification, and are not stored on our servers. Your identity data and the photo on your ID card stay only on your phone, inside the verification ticket encrypted with your key. Our servers keep only records that do not contain your identity; these are described below.

3. Personal Data Processed

3.1 Data Not Stored on Our Servers

The following data is processed only temporarily, in encrypted form, within the Enclave during verification, and deleted there once the operation completes. It is not stored on our servers, not logged, and not shared with partners. It stays in the encrypted ticket on your phone until you delete it.

• Turkish national ID number (TCKN)
• First and last name
• Date of birth
• Biometric data (face images taken at enrolment and at every verification, the facial vector, the photo on your ID card)
• Other identity information read from the NFC chip (gender, nationality, document number, expiry date)

3.2 Data Kept on Our Servers (does not contain your identity)

• Consent records: which partner, which scope and when consent was given, the result (true/false) and the Enclave signature. No IP address is kept.
• Operation and audit records: operation status and timestamps. The IP address is not recorded; it is held in temporary memory for at most one hour, only to limit abuse.
• Measurement data: liveness and face-match scores, light/sharpness measurements, device model and app version. No images.
• Device data: the notification key (push token); on iOS, the App Attest key ID.
• Contact data: only if you send support or feedback, your name, email address and message.

4. Purposes of Personal Data Processing

• Providing the identity verification service: checking by face comparison, at enrolment and at every later verification, that the card holder is the one verifying
• Verifying the age condition requested by the partner
• With your explicit consent, generating partner-specific recognition codes so the partner can recognise you on future verifications
• System security and fraud prevention
• Keeping a verifiable record of consent
• Improving service quality and diagnosing errors (with measurements that contain no identity data)
• Sending service notifications to the app
• Fulfilling legal obligations

5. Transfer of Personal Data

Only Yes/No results such as "verification successful / failed" and "over/under 18" are transmitted to partner websites. Additionally, with your explicit consent, partner-specific and irreversible recognition codes (user_id, nsbd_id, doc_id) may be transmitted so that the partner can recognise you on future verifications; these codes cannot be reversed to your ID number nor linked across partners.

Data is shared with the following service providers to deliver the service:

• Amazon Web Services: server and Enclave infrastructure (Frankfurt, Germany). Identity data is processed inside the Enclave; AWS cannot access it.
• Cloudflare: delivery and protection of app and website traffic (IP address and request information). Identity data is end-to-end encrypted.
• Google and Apple: notification delivery and device/app integrity checks. No identity data is sent.
• Sentry: app error reports (Germany). Identity and face data are redacted before sending.
• Postmark: email delivery, only if you send support or feedback.
• Dropbox / Google Drive: only an end-to-end encrypted backup file that you start yourself, written to your own account.

Transfers to US-based service providers are cross-border transfers under Article 9 of KVKK. Minimum data may be transferred to competent authorities where required by law.

6. Retention Period of Personal Data

• Identity and biometric data: on our servers only for the duration of processing; the Enclave deletes them afterwards.
• Consent records (no IP address): kept indefinitely as proof of consent. If consent is withdrawn the record is not deleted; the withdrawal date is added.
• Audit and event records (no IP address): kept indefinitely; intermediate-step records are deleted after 30 days.
• Measurement data: deleted after 180 days. Application logs: deleted after 90 days.
• Support tickets: anonymised after 365 days.

The full retention table is in the Privacy Policy.

7. Your Rights Under KVKK

Under Article 11 of KVKK, you have the following rights:

• To learn whether your personal data is processed
• If processed, to request information about it
• To learn the purpose of processing and whether it is used in accordance with its purpose
• To know third parties to whom data is transferred domestically or abroad
• To request correction if data is incomplete or inaccurate
• To request deletion or destruction under the conditions specified in Article 7 of KVKK
• To object to results arising against you through automated analysis
• To claim compensation if you suffer damage due to unlawful processing

You can withdraw the consent you gave for a verification from the Transaction History in the app, and delete all data on your phone with Settings → Delete My Data.

8. How to Apply

You can submit requests regarding your rights by email to kvkk@verifyblind.com. Applications are concluded within 30 days at the latest.

9. Changes

This disclosure notice may be revised in line with regulatory changes or service updates. The current text is always published on this page.