Privacy Policy

1.1 Personal Identification Information

When you register for an account or use our services, we collect personal identification information that you voluntarily provide. This may include:

• Full name and date of birth
• Email address and phone number
• Government-issued identity documents (for verification purposes)
• Biometric information submitted during identity verification — see 1.2 below for exactly how this is handled
• Any additional information you choose to include in your identity profile

We do not collect personal information without your explicit consent. You retain control over the optional information you choose to add to your profile.

1.2 Biometric Information — What Actually Happens

When you enroll for face verification, your face is converted into a 128-dimension mathematical representation (a "vector") — this vector is what's compared against future scans to confirm a match. Where a photo is also submitted, that photo is separately stored and may be used by our administrators to manually review identity verification submissions.

If you remove your face verification, both the vector and any associated photo are permanently deleted from our systems — not hidden or marked inactive.

1.3 Usage Data and Analytics

We may automatically collect certain information about your interactions with the platform, such as IP address, browser type, and access times, primarily to support security and fraud detection.

1.4 Cookies and Tracking Technologies

See Section 7 for details on cookies and tracking. We have not yet finalized which specific cookie or analytics technologies are in use, and we will update that section with specifics rather than general claims once confirmed.

2.1 Providing and Improving Our Services

Your information is primarily used to deliver, maintain, and improve Cidentia's identity and trust services. This includes:

• Account creation and identity verification
• Computing and maintaining your Trust Score
• Asset registration and protection through SafeLink
• Customer support and dispute resolution
• Developing new features and platform improvements

2.2 Communication

With your consent, we may send you important updates about service changes and security alerts. You may opt out of non-essential communications at any time.

2.3 Legal Compliance and Security

We use your information to detect, prevent, and respond to fraudulent activity through our automated fraud detection system, which screens for duplicate identities, impersonation attempts, repeated verification rejections, and stolen-asset conflicts. Where we are required by applicable law to disclose information, we will do so.

We employ several real, currently active security measures to protect your information:

• TLS encryption in transit — all traffic between your device and our servers is encrypted over HTTPS
• Hardened session security — HttpOnly, Secure, SameSite cookies with short-lived, auto-refreshed access tokens
• Rate-limited authentication — login attempts are rate-limited to prevent brute-force attacks
• Role-gated administrative access — sensitive actions require verified admin privileges, checked on every request
• Automated fraud detection — duplicate identities, impersonation attempts, and stolen-asset conflicts are detected automatically
• Firewalled infrastructure with key-only server access — password-based server login is disabled
• Audit logging — sensitive actions are logged with a timestamp and the account that performed them

We have not yet confirmed encryption-at-rest for our database, or completed a formal, independent security audit or penetration test. We will state these specifically, rather than generally, once they are true and confirmed.

When you verify your identity with Cidentia, you're assigned a unique CID (for example, CID-26-00001) that acts as a persistent identifier for your identity. Individual verification statuses, credentials, or organizational memberships can expire or be renewed independently — but your underlying CID does not disappear when one of these expires.

Trust Score

Your Trust Score is a number from 0–100, recalculated live from real signals across five categories: Identity, Behaviour, Assets, Work ID, and Marketplace. It is not a one-time snapshot — it updates automatically as your account activity, verified assets, and organizational standing change, including automatic decay if your account is inactive for an extended period.

If your account has an unresolved fraud flag, your Trust Score may be capped or reduced. This is not a general judgment of your character — it reflects specific, defined signals within our system.

We do not sell, trade, or rent your personal information to third parties. We may share information only in the following limited circumstances:

• With your authorization — when you explicitly consent to share information with an organization or service
• With organizations via CidenBridge — limited to what's necessary for the relationship you've entered, not your full identity profile
• Service providers who help operate our infrastructure, under confidentiality obligations
• Legal requirements — where we are required by law, court order, or government authority to disclose information
• Security and fraud prevention — including sharing information with administrators reviewing a fraud flag on your account

We aim to comply with applicable data protection frameworks including GDPR, CCPA, and eIDAS as we finalize our legal structure and jurisdiction — this policy will be updated with specific, confirmed compliance claims once that legal review is complete, rather than stated as accomplished fact today.

Depending on your jurisdiction, you may have rights regarding your personal data, including:

• Right to Access — request a copy of the personal data we hold about you
• Right to Correction — request that inaccurate data be corrected
• Right to Deletion — request that your personal data be erased
• Right to Restriction — request that we restrict processing of your data
• Right to Portability — receive your data in a structured, machine-readable format
• Right to Object — object to certain types of processing
• Right to Withdraw Consent — withdraw any consent you have previously given at any time

We have not yet finalized the specific cookies, analytics, or tracking technologies used on Cidentia's website and app. Rather than list generic categories that may not reflect what's actually running, we will update this section with a specific, accurate list once confirmed.

We do not use third-party advertising cookies or tracking pixels for ad targeting.

Different categories of information are retained for different periods:

• Your CID and core identity record may persist for as long as your account exists
• Verification status, credentials, and subscriptions may expire, be renewed, or be revoked independently of your CID
• Biometric photos submitted for identity review are retained for as long as needed for that review, and are permanently deleted on request when you remove your face verification
• Fraud and audit records may be retained longer than other account data where necessary to protect the integrity of the identity network

When data is no longer required, we work to delete or anonymize it. You may request deletion of your data at any time by contacting us.

Cidentia's services are not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected data from a person under 18, we will take steps to delete that information.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@cidentia.com.

Cidentia is intended to be used globally, and we aim to support users across many countries as we grow. Your data may be processed in a different country than your own; the specific hosting location and cross-border safeguards will be documented here once our legal entity and infrastructure arrangements are finalized.

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or platform features. We will notify you of significant changes via a prominent notice on the platform.

The "Last updated" date at the top of this page always reflects the most recent revision.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out:

We are committed to protecting your privacy and will respond to legitimate requests as promptly as we can.