Privacy Policy
Last updated: September 2026 · Version 1.3
Our core principle: VerifyBlind enables identity verification without requiring your Turkish national ID number (TCKN), full name, or date of birth to be shared in plain text with anyone — including us or our partners. This data is processed in encrypted form only inside a hardware-secured isolated environment (AWS Nitro Enclave) and immediately deleted.
1. Data Controller
As a data controller established outside Türkiye, VerifyBlind LLC must register with the Data Controllers' Registry (VERBİS) through a data controller representative it appoints in Türkiye; registration is in progress. Disclosure, explicit consent, data security and all other KVKK obligations apply regardless of registration.
2. What Data Do We Process and Why?
Mobile App — Identity Verification
Temporarily processed inside the secure Enclave — then deleted
National ID number (TCKN), full name, date of birth, gender, NFC chip contents, facial image and biometric vector
Stored in our system (does not reveal your identity)
Consent record: which partner, which scope, when consent was given, the result (only true/false); no IP address is kept.
Liveness and face-match measurements: numeric scores and device model; no images.
Never stored on our servers
TCKN, full name, date of birth, actual age value, biometric data, facial photo. This data stays only on your device, inside the encrypted verification ticket.
Partner Portal
| Data | Purpose | Retention |
|---|---|---|
| Company name, email | Account and communication | Contract + 10 years |
| Hashed password | Authentication | Until account deletion |
| Domain, callback and revoke URLs | API integration | Duration of contract |
Mobile App — Support and Feedback
| Data | Purpose | Retention |
|---|---|---|
| Name, email address, message content (+ device/OS info for diagnostics) | Responding to your support/feedback request | Support tickets anonymised after 365 days |
This information is collected only when you yourself use the in-app Feedback or Support (chat) screen; it is not required for identity verification. Your support tickets are stored in our system and, after 365 days, your email address is irreversibly anonymised (SHA-256); your IP address is never recorded. Feedback messages are delivered to our support team by email. This data is processed solely to respond to your request and is never used for advertising or marketing.
3. Parties We Share Data With
| Party | Shared | Condition |
|---|---|---|
| Partner Organisations | Verification result (true/false) and — if requested — partner-specific recognition codes (user_id, nsbd_id, doc_id). Raw identity data (national ID, name, biometrics) is never shared; the codes cannot be reversed to the ID number nor linked across partners. | With your explicit consent |
| Amazon Web Services | Encrypted processing (AWS Nitro Enclave cannot access content) | Service infrastructure |
| Cloudflare (network and protection) | Delivery of app and website traffic and protection against attacks (IP address and request information). Identity data is end-to-end encrypted, so its content is not visible to Cloudflare. | Service infrastructure |
| Google and Apple | The notification key for delivering notifications (Firebase Cloud Messaging, Apple Push); device and app integrity checks (Play Integrity, App Attest). No identity data is sent. | Providing and securing the service |
| Cloudflare Web Analytics | Anonymous page view statistics (no cookies, no IP storage, no personal data) | Service quality monitoring |
| Sentry (Crash Diagnostics) | App crash/error reports only. TCKN, MRZ, facial and biometric data are redacted before sending. Not linked to your identity; never used for advertising or tracking. | App stability / error monitoring |
| Postmark (Email Delivery) | Only if you send support/feedback: your email address and message are used to deliver your request to our team and to send you a reply. Identity verification data (national ID, name, biometrics) is never sent. | Support/feedback communication |
| Dropbox / Google Drive (optional backup) | Only if you initiate it: your transaction history backup file is written to your OWN cloud account. By default the file is encrypted with a password you choose and opens only with that password; if you choose to save it unencrypted, the file stays readable. We cannot access the file. | At your choice |
| Competent Authorities | Minimum data when legally required | KVKK Art. 8/2-a |
4. Retention Periods
5. Security
- ✓AWS Nitro Enclave — Hardware isolation; no operator, including Amazon, can look inside
- ✓End-to-end encryption — AES-256-GCM + RSA-OAEP-SHA256
- ✓Android Keystore / iOS Keychain — Your identity key is generated on your device and stays on that device only; using it requires biometric or screen-lock approval
- ✓Nonce-based protection — Every operation is unique and non-replayable
- ✓Data minimisation — Only the minimum necessary data is written to the system
6. Your Rights
| Right | How to Exercise |
|---|---|
| View my data | The identity data and history on your device are visible in the app (Settings → Transaction History); for anything else, kvkk@verifyblind.com |
| Delete my data | App → Settings → Delete My Data |
| Withdraw consent | App → Settings → Transaction History → swipe the record to the right |
| Data portability | App → Settings → Encrypted Backup |
| Object / Complain | kvkk@verifyblind.com or kvkk.gov.tr |
7. Contact
For questions about our privacy policy or your personal data: kvkk@verifyblind.com