Signyd Identity Verification and Biometric Policy
Last updated: October 24, 2026 This policy explains how identity verification (Signyd Verify) works and how biometric data and identity documents are handled. It is provided by Villaces Inc., (“Signyd”), and supplements our Privacy Policy and Terms and Conditions. It is written for the people being verified (“Signers”) and for the organizations that ask for verification (“Customers”).1. What Signyd Verify is
Signyd Verify is an optional feature. When a Customer turns it on for a document, the Signer must confirm their identity before signing by presenting a government-issued identity document and completing a live selfie check. Signyd then checks that the name on the ID matches the authorized signer and that verification and signing occur on the same network. Signyd Verify is not used unless the Customer requests it. Verify is identity evidence for that request. It does not issue a certificate to the Signer and does not turn the Signer’s visual mark into an advanced or qualified electronic signature. See the Signature and Sealing Practices Statement.2. Data involved
- Identity document data: images of the document (such as a passport, driver’s license or national ID) and the information printed or encoded on it, such as name, date of birth, document number, nationality and expiry date.
- Selfie or video: a live image or short video of the Signer’s face.
- Biometric data: a mathematical representation of the face (a facial geometry template) created to compare the selfie with the document photo and to detect spoofing, such as photos, screens or masks.
- Verification result: whether the check passed or failed, and reason codes.
3. Who processes the data
The verification is performed by Didit (didit.me), which acts as Signyd’s service provider (subprocessor). The Customer that requested the check decides to use verification for its document and is responsible for having a lawful reason to ask for it. For this data, Signyd acts on the Customer’s behalf, and Didit acts on Signyd’s behalf, each under contracts that require confidentiality, security and use only for verification.4. Consent
Before any biometric data is collected:- The Signer is told that a face scan and document check will be carried out, why, who receives the result, and that biometric data will be processed.
- The Signer is shown a link to this policy and to our Privacy Policy.
- Before launching the verification interface, Signyd presents an explicit consent screen containing a direct disclosure regarding facial geometry collection and document processing, requiring the Signer to check an affirmative consent box or select a consent button before the camera is activated.
- If the Signer does not consent, no biometric data is collected, and the check does not start. The Customer may offer another way to sign.
5. Purposes and limits
We use identity and biometric data only to:- verify the Signer’s identity for the document and Customer that requested it;
- detect and prevent fraud, impersonation and abuse of the Service;
- keep the record of the verification result as evidence in the audit trail; and
- meet legal obligations.
6. Retention and destruction
We keep identity data for as short a time as possible.- Identity document images, selfie images or video, and biometric templates: permanently deleted within 1 year (365 days) after the verification is completed, both within Signyd’s infrastructure and under our data processing configuration with Didit, and in any case no later than three years after the Signer’s last interaction with the Service.
- Verification result and audit trail entry: the result (for example “identity verified”) and related evidence such as timestamp and method are kept with the Certificate of Completion for as long as the signed agreement is retained, because they are part of the evidence of the signing. They do not include the face template or the images.
- Legal holds: we may keep data longer only where the law requires, or to respond to a legal claim, and we will limit it to what is necessary.
7. Sharing
We share identity and biometric data only with Didit, as our service provider, and with the Customer that requested the check, to the extent needed to show the verification result. The Customer receives the result and may receive limited details from the document (such as the name and document type). We do not disclose biometric data to anyone else, except where we are required by law or with the Signer’s consent.8. Security
Identity data is transmitted over encrypted connections, stored with access controls, and accessed only by those who need it. See our Security page for more.9. Accuracy and limits of verification
Identity verification is a probabilistic risk-reduction tool. It may wrongly accept an impostor or wrongly reject a genuine person, and it cannot detect every forged document or every impersonation. A result is not a guarantee of identity, legal capacity or authority. The Customer remains responsible for deciding whether to rely on it, and for any further checks its situation requires. Signers who believe a result is wrong can contact the Customer or us to request review.10. Rights of Signers
Depending on where you live, you may have the right to access, correct or delete your data, object to or restrict its processing, withdraw consent, and complain to a regulator. Because the Customer controls the decision to verify, we may direct your request to the Customer, but you may also write to legal@villaces.com. We respond within the time required by law.11. Legal notes by region
- European Economic Area, United Kingdom and Switzerland: biometric data used to identify a person is special category data. We rely on the Signer’s explicit consent, and the Customer is responsible for a lawful basis for requesting verification.
- Illinois, Texas, Washington and other U.S. states with biometric laws: this policy is our public retention and destruction schedule. We obtain written or electronic consent before collecting biometric identifiers, we do not sell or profit from them, and we destroy them as described in section 6.
- California and other U.S. states with comprehensive privacy laws: biometric and government identifier data are sensitive personal information. We use them only for the purposes in section 5.