Last updated: June 30, 2022

Persona Privacy Policy

This Persona Identities, Inc. (“Persona,” “we”, “us”, or “our”) privacy policy applies to individuals using the
Persona Service to verify their identities.

Privacy Policy applicable to individuals verifying their identity through the Persona
Service

Persona’s Customers offer the Persona service (the “Service”) to securely verify the identity of individuals (“you”).
Persona processes Personal Data of individuals at the direction of its Customers. This section of the Privacy Policy
explains how Persona, under the direction of its Customers, processes Personal Data in order to provide the Service
for its Customers. Personal Data provided to Persona by Customers, and Personal Data provided to Customers from
Persona, is subject to the Customers’ Privacy Policy. This section explains what Personal Data (defined below) we
collect through the Service, how we use and share that data, and how individuals can exercise choices regarding
their Personal Data.

How We Collect and Use Personal Data to Provide the Service

This section describes the Personal Data we collect and how we use it in order to provide the Service to our
Customers. Personal Data means information that relates to an identified or identifiable individual.

You provide Personal Data to us at the direction of our Customers so that our Customer may verify your identity
and/or prevent fraud. In the course of performing the Service, we may also obtain Personal Data from other sources
such as third party databases, government records, and other publicly available sources. The Personal Data we
collect varies based on what you provide, what the Customer has directed us to analyze, and what Personal Data is
available from third parties.

You may directly provide:

● Name and contact information, including name, email address, address, and phone number;
● Demographic data, including birthdate and age;
● Files you upload, such as tax forms and utility bills;
● Government documents and identifiers, such as driver's license and Social Security Number; and
● Photos of you, namely the selfie you provide and from your government identification document.

Our Services may also collect the following from you, our Customer, or third parties:

● Current and previous name and contact information, including name, email address, address, and
phone number;
● Demographic data, including birthdate and age, gender, marital status, and similar demographic details;
● Government documents and identifiers, such as drivers license and Social Security Numbers;
● Device information, including IP address, device type, your device’s operating system, browser, cookie
and device identifiers, and other software including type, version, language, settings, and configuration;
● Account information, such as details about your account with our Customer or other third parties;
● Geolocation data; and
● Biometric Data, including a scan of your facial geometry based on the photos you provide. For more
information about Biometric Data, see the Facial Scan and Biometrics Information section below.
Based on the Personal Data we collect from you and other sources, we infer information about you for identity
verification and fraud prevention purposes. For example, we may use certain information about you including your
IP address and home address to inform our verification process.

Some data that we collect automatically is collected through cookies and similar technologies. See our Cookies
section below to learn more.

We use Personal Data to provide our Customers with the Service so they can verify the identity of individuals and
prevent fraud. This processing is necessary to perform our contract with our Customers. As part of performing the
Service, we use Personal Data to improve and troubleshoot our Services.

How We Disclose Personal Data

We may engage third parties to assist us in providing the Services, in which case we may disclose Personal Data to
them. We may also disclose Personal Data to service providers, including hosting, cloud services and other
information technology services providers; email communication and SMS software providers; and identity
verification services, background check providers, public and private records database providers, consumer
reporting services, and fraud and identity management providers. For example, we may disclose your name and
address to a third party database provider in order to request information they may have about you. Pursuant to our
instructions, these parties will access, process or store Personal Data while performing their duties to us. We may
also disclose Personal Data when required to do so by law.

Facial Scan and Biometrics Information

This section describes how Persona treats scans of facial geometry extracted from photos.

Persona, acting as a service provider to the Customer:

● compares the data from a scan of facial geometry extracted from the government identification document
that you upload to the data from a scan of facial geometry extracted from the photos of your face that you
upload, in order to help verify your identity (“Verification”); and
● may also use your information, including data from scans of facial geometry extracted from the
government identification document and photos of your face that you upload, to detect and prevent fraud
(“Fraud Prevention”).

The images obtained from government identification document and photos of your face that you upload, and data
from scans of facial geometry extracted from the government identification document and photos of your face that
you upload, are collected, used and stored directly by Persona on behalf of Customer as Customer’s service provider
through Customer’s website or app that you accessed. Depending on our relationship with the Customer, the
Customer may upload your government identification document and photos of your face directly to us.

Persona securely stores all photos of identity documents that you upload, photos of your face that you upload, and
data from scans of facial geometry extracted from the photos of your face that you upload in an encrypted format.
Persona’s third-party vendors may have access to the data from scans of facial geometry extracted from the photos
of your face that you upload to provide some or all of the analysis, to store the data, to maintain backup copies, and
to service the systems on which such data is stored. Persona will permanently destroy data from scans of facial
geometry extracted from the photos of your face that you upload upon completion of Verification or within three
years of your last interaction with Persona, consistent with the Customer’s instructions unless Persona is otherwise
required by law or legal process to retain the data.
Persona uses the reasonable standards of care within its industry to store, transmit, and protect from disclosure data
from scans of facial geometry extracted from the photos of your face that you upload in a manner that is the same as
or more protective than the manner in which it stores, transmits, and protects other confidential and sensitive
information. Persona will not sell, lease, trade, or, other than to provide the Verification and Fraud Prevention
services to Customer described in this policy, otherwise benefit from data from scans of facial geometry extracted
from the photos of your face that you upload. Other than as set forth herein, Persona will not disclose, redisclose, or
otherwise disseminate data from scans of facial geometry extracted from the photos of your face that you upload
unless doing so:

● Completes a Customer transaction requested and authorized by you or your legally authorized
representative;
● Is required by state or federal law, or municipal ordinance;
● Is required pursuant to a warrant or subpoena issued by a court of competent jurisdiction; or
● Is expressly consented to by you.

Choices Regarding Personal Data

Persona is the data processor for the processing of Personal Data on behalf of its Customers. If you are an individual
whose identity has been verified through Persona, please contact the appropriate Customer to exercise any rights that
you may have under applicable law. If you have further concerns or questions regarding the processing of your
Personal Data, please email [email protected].

Cookies, Mobile IDs, and Similar Technologies

For more information about what cookies and similar technologies we use and how we use them, see our Cookie
Policy.

Changes to the Privacy Policy

The Service, and our business may change from time to time. As a result, we may change this Privacy Policy at any
time. When we do we will post an updated version on this page, unless another type of notice is required by the
applicable law. By continuing to use our Service or providing us with Personal Data after we have posted an updated
Privacy Policy, or notified you if applicable, you consent to the revised Privacy Policy and practices described in it.

Contact Us

If you have any questions about our Privacy Policy or the information practices of the Service, please feel free to
contact us at [email protected].

If you are an individual in the EU, you can also contact Jack Baylor, who is based in the Republic of Ireland and has
been appointed as Persona’s representative in the EU pursuant to Article 27 of the GDPR on matters related to the
processing of Personal Data activities that take place in the EU. To make such an inquiry, please contact Jack Baylor
at [email protected].

Persona Identities, Inc.

San Francisco, CA 94103

United States of America