Merchant representative (233 characters):
We use your selfie only to confirm you are the person on your ID. If the check passes, we destroy the selfie right away. If a person must review it, we keep it encrypted until that review ends, then destroy it. Details: [POLICY LINK]
Client (244 characters):
We keep your face photo to confirm your identity and, with your permission, for Practicle. Each yearly check replaces your old photo, which is destroyed. You can withdraw permission anytime and we will delete your photos. Details: [POLICY LINK]
Autonomous Node user (Practicle only) (218 characters):
If you choose Practicle, we keep one photo tied only to your random Autonomous ID. A new photo replaces the old one, which is destroyed. You can turn Practicle off and ask us to delete the photo. Details: [POLICY LINK]
New representative (162 characters):
A new representative must take a selfie. We use it only to confirm identity and destroy it right after the check passes or the review ends. Details: [POLICY LINK]
State line added to the in-app notice for Illinois residents (shown above the button):
Illinois residents: we collect face data only after you sign this release. We will not sell, lease, trade or otherwise profit from it, and we will destroy it as stated in our Retention and Destruction Policy, which is published at [POLICY LINK].
A. Short in-app notices (300 characters or fewer each)
B. Full biometric notice and written release
Meritwave Digital Inc ("we") will collect, store and use your face photo and a facial comparison made from it (together, "face data"). Before we do, we are telling you the following and asking for your written release.
What we collect. A selfie taken with your phone, and photos of the front and back of your government ID. Our identity-verification provider, [ID Analyzer], compares the selfie to the ID photo and tells us whether they match. [COUNSEL: confirm whether the comparison creates a stored face template, and where.]
Why. To confirm who you are and meet identity and anti-money-laundering rules, and, for clients who choose Practicle, so that a merchant you have chosen to pay can recognize you. We do not sell, lease, trade or profit from face data and we do not use it for advertising.
Who sees it. Our staff only to finish a review, and each view is logged. [ID Analyzer] processes it for us under contract. When you use Practicle near a store and have allowed location sharing, the merchant can see your current profile photo, without your name, to pick you for a payment request, and the merchant's terminal then discards it. In a Boost at a merchant, the merchant also sees your profile photo. [COUNSEL: the 'terminal discards it' statement covers Practicle only.] [COUNSEL: confirm this disclosure is enough and how to word it without revealing how Practicle works, which the company treats as a trade secret.]
How long. Merchant representatives: the selfie is destroyed as soon as the check passes; if a person must review it, it is kept encrypted only until the review ends, and in any case destroyed no later than [30] days after collection. Clients: your face photo is kept only while you authorize it, and each yearly check replaces the old one, which is destroyed. We keep your photo while your account is active and you authorize its retention for the stated purposes, including future Practicle renewal. Practicle expiration alone does not trigger deletion. We delete the photo if you withdraw permission or close your account, and delete the old photo when it is replaced. If you renew after deletion, we will request a new photo. The planned yearly check replaces the old photo with a current one. [COUNSEL: confirm the permitted retention purposes and any earlier legal deadline. The photo store, renewal and deletion procedures are not built.] Destruction happens as soon as possible and no later than [30] days after that date. ID photos (front and back of your ID) taken at sign-up are a separate category: we keep them for [three (3) years after an account closes: a proposal, not a CEO decision; COUNSEL to confirm], then destroy them. ID photos sent for a yearly check or a change of representative are used for the check and are not stored. [COUNSEL: reconcile ID-photo retention with five-year federal recordkeeping and say whether any rule requires keeping them.] What we keep from the check: the pass or fail result, a match score and the ID expiry date. We do not keep the ID number or the reader's raw answer.
Your choice. You may refuse. If you refuse, you cannot finish identity verification, and we may not be able to open your account or offer Practicle. Autonomous Node users can use the app without Practicle and without a photo.
Written release. By signing or clicking "I agree" below, you confirm that you have read this notice and give Meritwave Digital Inc your written release to collect, store and use your face data as described. You may withdraw it at any time by contacting [email protected]. [COUNSEL: say whether a fresh release is needed at each yearly check.]
Adults only. You must be at least 18 years old.
Illinois residents: we collect face data only after you sign this release. We will not sell, lease, trade or otherwise profit from it, and we will destroy it as stated in our Retention and Destruction Policy, which is published at [POLICY LINK].
C. Public retention and destruction policy
Meritwave Digital Inc keeps face data only as long as needed for the purposes in the notice. We keep a client's photo while the account is active and the client authorizes retention for the stated purposes, including future Practicle renewal. Practicle expiration alone does not trigger deletion. We delete the photo upon consent withdrawal or account closure, and delete the old photo on replacement. If the client renews after deletion, we request a new photo. The planned yearly check replaces the old photo with a current one. [COUNSEL: confirm the permitted retention purposes and any earlier legal deadline. The photo store, renewal and deletion procedures are not built.] Destruction is completed as soon as possible and no later than [30] days after that date. For merchant representatives, the selfie is destroyed when the check passes, or when a staff review ends, and in any case within the limit in section B. ID photos taken at sign-up are a separate category: they are destroyed [three (3) years after an account closes: a proposal, not a CEO decision; COUNSEL to confirm] unless a law or legal order requires us to keep them longer [COUNSEL: confirm the period and whether any rule requires keeping them]. We keep a log of destruction events, not the data. [REQUIREMENT – NOT BUILT: face data encrypted when stored and stripped of camera and location metadata; today sign-up photos are plain files that keep their metadata.] Face data is never written to logs or sent to a browser that only holds a status token. This policy is published at [POLICY LINK]. [COUNSEL: litigation-hold wording.]
D. State lines
- Illinois residents: we collect face data only after you sign this release. We will not sell, lease, trade or otherwise profit from it, and we will destroy it as stated in our Retention and Destruction Policy, which is published at [POLICY LINK].
- Indiana residents: face data is sensitive data under Indiana law. We process it only with your consent, which you give by signing this release, and you may withdraw it at any time.
- Iowa residents: face data and precise location are sensitive data under Iowa law. We give you notice and a right to opt out; we also ask for your signed release before we collect face data.
- Missouri residents: we collect face data only after you sign this release, and we follow the same retention and destruction rules for everyone.
- Wisconsin residents: we collect face data only after you sign this release, and we follow the same retention and destruction rules for everyone.