Biometric Information Notice

Biometrics are used only in identity checks, and only in these two situations:

• The optional ID check for operator verification. A person who is accountable for Agents can choose to verify their identity with a government document and a selfie. This check is always optional: operator verification can be completed without it, for example by a teammate’s approval, or by confirming your own email address on a PACH 1 account or the Team plan.
• Identity checks a platform requires of its consumers. A business that uses our Consumer Delegation feature may require its consumers to complete an identity check before an Agent acts for them, for example before a large transaction. The platform decides when a check is required.

No other part of the Services collects or uses biometric identifiers.

Identity checks are performed by our service provider Stripe, Inc., through Stripe Identity. During a check, Stripe collects images of your identity document and, in most check configurations, a selfie. To confirm that the selfie matches the photo on the document, Stripe may create a scan of facial geometry from those images. These are biometric identifiers and biometric information.

Eniyan does not receive, collect, store or have access to your document images, your selfie, or any facial geometry. We receive only the result of the check: whether the document check and the selfie check passed, any fraud signals Stripe reports (for example, that a document appears altered), and Stripe’s reference for its report. Stripe collects and processes the images under its own terms and privacy policy for Stripe Identity.

Biometric identifiers are used only to verify that the person taking the check is the person shown on the identity document, for the check that person started. They are not used for any other purpose, including marketing, profiling, or training any model.

Before an identity check starts, the person taking it must be told in writing that biometric information will be collected, why, and for how long it is kept, and must consent. We will not start a check until that consent has been confirmed to us, and we keep a record of it. For a check a platform requires of its consumers, the platform presents the notice and consent request and confirms the consent to us. Your consent is your written release for the purposes of the laws in Section 7. You may decline, in which case no biometric information is collected; for operator verification you can use one of the alternatives in Section 1. If a platform requires a check of its consumers, a consumer who declines cannot complete the action that required the check.

• Stripe keeps and deletes the images and facial geometry it collects according to its Stripe Identity terms and privacy policy.
• If any biometric identifier or biometric information ever comes into Eniyan's possession, we will permanently destroy it when the purpose for collecting it has been satisfied, or within three years of your last interaction with Eniyan, whichever comes first, unless a valid warrant or subpoena requires us to keep it.
• The result of a check and your consent record are not biometric information. We keep consent records for seven years as evidence that consent was given, and we keep check results as described in our Privacy Policy.

• Eniyan does not sell, lease, trade or otherwise profit from biometric identifiers or biometric information.
• Eniyan does not disclose biometric identifiers or biometric information, except to Stripe as our service provider to perform the check you consented to, or where disclosure is required by law, a valid warrant or a subpoena.
• We store, transmit and protect any information related to identity checks using a reasonable standard of care for our industry, and in a manner at least as protective as the way we handle other confidential and sensitive information.

This notice is intended to meet the requirements of the Illinois Biometric Information Privacy Act (740 ILCS 14), the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001), Washington’s biometric identifiers law (RCW 19.375), other United States state laws that regulate biometric data, and, for people in the European Economic Area, the United Kingdom and Switzerland, the requirement of explicit consent to process biometric data for identification under Article 9 of the GDPR and its United Kingdom and Swiss equivalents.

A business that requires identity checks of its consumers through Consumer Delegation is responsible for deciding when a check is needed, for showing its consumers a notice at least as complete as this one and obtaining their written consent before each check, and for complying with the laws that apply to it. Eniyan refuses to start a check until the platform confirms that consent, records it, and processes check results on the business’s behalf under our Data Processing Agreement.

To ask about this notice, or to request access to or deletion of identity-check records, use our privacy requests page, email privacy@eniyantrust.com, or write to Eniyan, Inc., Attn: Privacy, 99 Wall Street #2444, New York, NY 10005, United States.