TruCheck™ Privacy Policy

1. Scope of This Policy & Regulatory Roles

VerifiedID LLC provides TruCheck™, an advanced identity validation and pre-employment eligibility verification platform. This Privacy Policy explains how we collect, use, disclose, protect, and retain personal information, sensitive data, document media, and biometric information. It applies to job applicants and candidates ("you," "your") who interact with the TruCheck™ system on behalf of potential employers, hiring enterprises, or recruiting networks ("Enterprise Clients").

Homepage Access Notice: This Privacy Policy is directly accessible from the homepage of our primary website at https://verifiedid.co and through the TruCheck™ application workflow.

Candidate Session Entry: Job applicants and candidates typically access and submit data to TruCheck™ through a secure, single-use web session link generated upon an Enterprise Client's invitation, rather than through a registered user account. This Privacy Policy applies equally to all data collected via client-initiated session links as well as registered system portals.

This Privacy Policy applies to all data processed through the TruCheck™ application workflow, including interactive photo/video capture portals, document extraction modules, automated cross-matching engines, data verification dashboards, and portable digital verification cards.

Regulatory & Operational Roles:

• Consumer Reporting Agency (CRA): VerifiedID LLC operates as a Consumer Reporting Agency governed by the Fair Credit Reporting Act (FCRA, 15 U.S.C. § 1681 et seq.) when compiling and issuing TruCheck™ Consumer Reports for employment evaluation purposes.
• Data Processor / Service Provider: In addition, VerifiedID LLC acts as a Data Processor / Service Provider handling data under instructions from our Enterprise Clients, who act as the Data Controllers.

2. Information We Collect and Extract

To cross-authenticate your identity and assess employment eligibility metrics, TruCheck™ collects and processes the following data assets directly from your verification session, as well as from information supplied by the authorizing Enterprise Client:

• Personal Identifiers: Legal full name, date of birth, home address, email address, phone number, and Social Security Number (SSN) / Tax Identification Number (TIN).
• Biometric Data & Video Streams: Facial geometry templates and computational maps derived from your live photo capture and your seamlessly generated session verification video. This active session explicitly includes the capturing of a background video as part of your live video interaction.
• Stored Photographic Images: The live verification photo and live selfie capture of your face taken during the session, used for automated facial matching, administrative identity confirmation, and display on your verification profile.
• Government-Issued Identification Documents: Digital image captures (Front and Back) of Driver's Licenses, State IDs, Tribal IDs, and U.S. or Foreign Passports captured during your live interaction. Note: Uploaded document images are processed strictly within our secure engine and are NOT shared with or made visible to Enterprise Clients.
• Employment Eligibility Documentation: Image copies of acceptable employment authorization documents (such as U.S. Passports, Permanent Resident Cards, Employment Authorization Documents, or state-issued identity documents) captured during your live interaction solely for backend verification.
• State-Issued ID Documents: Depending on the verification option you select, a State-issued Driver's License or ID Card may be required or optional. When provided, it is used to verify your identity and state-level jurisdiction details (DL/Real ID - Issuing Jurisdiction).
• Client-Provided Historical Documentation: Copies of your identification, credentials, or work authorization documents previously provided by you to our Enterprise Clients during current or prior application/engagement cycles and uploaded to our system by the Enterprise Client.
• U.S. Work Authorization & Immigration Data (USCIS Receipt Numbers & PII): Form I-797 receipt numbers, alien registration numbers, visa classification details, and real-time status verification data retrieved via official federal channels (including the USCIS Case Status API). Note: VerifiedID considers USCIS receipt numbers to be Personally Identifiable Information (PII) and treats them with strict confidentiality and safeguards.
• Extracted Textual Metadata: Full Legal Name, Date of Birth (DOB), Document ID Numbers, Issue Dates, and Expiration Dates parsed directly from uploaded credentials. Note on ADEA Privacy Redaction: Your Date of Birth, including your Year of Birth, is redacted from every TruCheck™ Consumer Report, including the copy provided to you, and from Client-facing cards to comply with the Age Discrimination in Employment Act (ADEA). It is kept in your file for identity verification and is available to you on request under FCRA § 609.
• Identity Infrastructure Assets: Social Security Number (SSN). Note on Identity Redaction: The last four digits of your SSN are redacted from every TruCheck™ Consumer Report, including the copy provided to you, and from Client-facing verification cards. They are kept in your file to confirm file matching and are available to you on request under FCRA § 609.
• Professional & Application Data: Resumes, work history disclosures, and signed legal attestations (e.g., Exclusive Employment Attestations / Multi-Job Shield declarations).
• Technical Telemetry & Metadata: IP address, detected connection type (including VPN or proxy indicators), network geolocation, physical location coordinates, device type, operating system version, browser type, camera hardware attributes, timestamped audit logs, and session diagnostic logs.

2.1 Specific Disclosures on USCIS Receipt Numbers (PII Handling, Storage & Safeguards):

In strict compliance with U.S. Citizenship and Immigration Services (USCIS) integration standards:

• Purpose & API Use: USCIS receipt numbers (such as Form I-797 receipt numbers) collected during your verification session are used solely to execute automated queries against the USCIS Case Status API to retrieve real-time case status updates and confirm legal U.S. work authorization on behalf of your potential employer.
• Storage & Safeguards: Stored receipt numbers are classified as sensitive PII. They are encrypted in transit using Transport Layer Security (TLS 1.3) and encrypted at rest using Advanced Encryption Standard (AES) 256-bit cryptography. Access is strictly restricted to backend automated verification systems and authorized compliance staff for auditing.
• Protection & Commercial Prohibition: USCIS receipt numbers and query results are safeguarded against unauthorized access, disclosure, or extraction, and are never sold, leased, traded, or shared with third parties for commercial or marketing purposes.

3. How We Use and Cross-Match Your Data

VerifiedID processes your personal data via TruCheck™ exclusively for the following lawful business purposes:

• Identity Verification & Facial Matching: Evaluating your live photo, live selfie capture, verification video, and background video streams against the image on your submitted government-issued identification to prevent identity theft and substitution fraud.
• Multi-Source Data Cross-Matching & Extraction Validation: Extracting and cross-reconciling text strings, data fields, and alphanumeric identifiers across (a) your live Identity Documents, (b) your live Employability Documents, and (c) any historical verification files uploaded by the Enterprise Client. This reconciliation is performed using parsing technology and human-in-the-loop validation explicitly to identify data discrepancies, fraud vectors, age/identity manipulation, or conflicting record submissions.
• Verification Status Determination: Processing metrics to determine if an applicant achieves an evaluation status of Clear, Review Required, or a system Alert (such as network or geographic indicators) for identity and employability checks. All processing is conducted in strict compliance with federal anti-discrimination laws, including the Age Discrimination in Employment Act (ADEA), Title VII of the Civil Rights Act, and the Immigration and Nationality Act (INA § 274B). Sensitive parameters such as age, specific citizenship category, or document type are redacted on Client-facing cards to ensure unbiased evaluation by Enterprise Clients.
• Portable Identity & Employability Card Generation: Generating a secured, digital verification card containing your profile photo and authentication tokens, eligible for client sharing when evaluations return a Clear status.
• Security, SSN, & Geolocation Auditing: Validating the existence and approximate issuance date of your provided SSN against commercial databases and the Social Security Administration's Death Master File (DMF). An inability to match an SSN in commercial databases generates an informational alert and does not automatically confirm non-existence. Analyzing network attributes to generate security status indicators (such as VPN usage or checks initiated outside the United States). System logs and submitted assets are continuously analyzed for indicators of organized criminal activity, stolen identities, stolen SSNs, synthetic credentials, and forged or altered identification/employability documents (including counterfeit Driver's Licenses, Passports, and Permanent Resident Cards).

4. Biometric Information Privacy Notice & Consent (BIPA & State Compliance)

PLEASE READ CAREFULLY: TruCheck™ processes biometric identifiers. Before any biometric data is collected, we ask for your explicit, standalone written consent through the Biometric Privacy Consent in the TruCheck™ candidate consent. This notice describes the following processing behaviors:

• Biometric Data Collected: Facial geometry signatures and mathematical facial maps extracted during your live selfie photo and generated video session (including accompanying video backgrounds).
• Specific Purpose: Verifying match consistency against your provided credentials to prevent credential and identity fraud.
• Downstream Sub-Processors: Data may be streamed to highly secure, bank-grade infrastructure partners solely to execute active face-to-photo validation.
• Strict Biometric Destruction Timeline: Flat reference images of your face may be stored for visual dashboard confirmation. However, all raw mathematical biometric identifiers, structural face maps, and calculations are permanently destroyed and erased from our active processing memory. This happens within twenty-four (24) hours of collection or when the primary purpose is fulfilled, whichever is shorter. This timeline aligns strictly with Illinois BIPA 740 ILCS 14/15(a).

5. Data Retention & Archival SLA

We implement a tiered data retention architecture that balances strict biometric privacy with complete seven-year audit trail compliance for legal and regulatory obligations:

• Tier 1: Immediate Biometric Purge (24 Hours): All raw mathematical facial geometry scans and biometric templates are permanently scrubbed and destroyed within twenty-four (24) hours of session completion.
• Tier 2: Transition to 7-Year Archival Storage:
  • Active Storage Transition: All session data remains in active repositories for three (3) months from creation or until the expiration of an issued TruCheck™ Card, whichever is later. Session data includes digital document media files (e.g., photo IDs, driver's licenses, passports, work authorization documents), alphanumeric metadata, system RefNumbers, verification audit logs, status outcome records, and secure cryptographic hashes. If no TruCheck™ Card is issued, records transition out of active storage three (3) months after session creation.
  • 7-Year Archival Mandate: Upon reaching the transition threshold, all session data and records are moved to secure archival storage. They are maintained for a period of seven (7) years following session completion. This retention complies with Section 605 of the Fair Credit Reporting Act (FCRA), satisfies federal regulatory recordkeeping mandates, and allows us to resolve potential consumer disputes. All archived files and records are automatically scrubbed and permanently deleted upon the expiration of the 7-year retention window.

Data Archival & Deletion Requests SLA:

• Candidate & User Rights: Candidates and users retain the right to request deletion or update of their stored personal data records and archived session files.
• How to Request: Candidates do not need a registered account to exercise this right. Submit a written request containing your full name, email address, and TruCheck™ Session Reference Number (RefNumber) to our Privacy Officer at privacy.trucheck@verifiedid.co
• Identity Verification Requirement: To protect consumer security and prevent unauthorized record alteration, all deletion requests are subject to strict identity verification. VerifiedID reserves the right to require the requester to provide independent government-issued proof of identity prior to evaluating or executing any deletion request.
• Exceptions & In-Review Freeze (Fraud Prevention): Deletion requests will not be processed for candidate sessions that are currently under an active security flag, fraud investigation, or "Review Required" status. Records associated with pending reviews, flagged anomalies, or suspected fraudulent activity are frozen and restricted from deletion under statutory fraud prevention and security enforcement exemptions until the review or investigation is officially concluded.
• Processing Timeline: VerifiedID will verify the requester's identity and process eligible requests within thirty (30) calendar days of receipt, subject to the identity verification criteria above and statutory record-retention exemptions under FCRA and security/anti-fraud regulations.

6. How We Disclose Your Information & Third-Party Restrictions

We do not sell, rent, lease, trade, or monetize your personal information or biometric data to third parties for monetary value, targeted advertising, or marketing purposes. Your data is disclosed strictly to facilitate the verification loop:

• The Requesting Enterprise Client: The potential employer or talent platform that invited you to complete TruCheck™ receives access to your document status evaluations (Clear, Review Required, or Alert), compliance tracking metrics, geolocation indicators, and your live candidate selfie image. Enterprise Clients do not receive access to raw images of your uploaded identity documents or employment documentation. Specific identifiers (such as Year of Birth and SSN) are redacted (----) on Client-facing views, and specific document types are displayed using generic labels (e.g., Candidate provided Document #1) to comply with INA § 274B anti-discrimination requirements.
• User-Initiated Sharing: Authorized third parties receive access to your portable verification card only when explicitly shared by you or the primary Enterprise Client, provided the card holds an active Clear status.
• Verified Infrastructure Partners & Federal Endpoints: Restricted alphanumeric data, document streams, or verification queries are transmitted to certified database administrators, biometric engine providers, secure cloud storage vaults, and official government endpoints (e.g., USCIS). These transmissions are used to perform identity matching, SSN lookups, DMF safety checks, and real-time work authorization checks.
• Strict Third-Party Restrictions: Third-party use or disclosure of user information (including de-identified, anonymized, or pseudonymized data) for any purpose outside of rendering the TruCheck™ service is strictly prohibited without active user consent. All third parties are contractually bound to the terms, security standards, and privacy protections set forth in this policy. This restriction does not apply to disclosures to federal and state government agencies that you authorize in the TruCheck™ consent or that are permitted or required by law, as described in the Fraud Prevention, Organized Crime & Law Enforcement Disclosures section below.
• Fraud Prevention, Organized Crime & Law Enforcement Disclosures: VerifiedID LLC actively screens verification traffic to detect organized crime, identity theft rings, stolen Social Security Numbers, impersonation fraud, synthetic identities, and forged or counterfeit government documents. This includes fake Driver's Licenses, Passports, and Permanent Resident Cards / Green Cards.

  We reserve the explicit right to disclose personal information, biometric indicators, document media, session diagnostic logs, and technical telemetry to federal, state, or local law enforcement agencies and regulatory authorities. These include the Federal Bureau of Investigation (FBI / IC3), U.S. Homeland Security Investigations (HSI), the U.S. Secret Service, the Social Security Administration Office of the Inspector General (SSA-OIG), the Federal Trade Commission (FTC), and the U.S. Department of Justice (DOJ).

  Such disclosures may be made without prior notice to you. They are made to assist in criminal investigations involving identity fraud (18 U.S.C. § 1028), Aggravated Identity Theft (18 U.S.C. § 1028A), or document/visa fraud (18 U.S.C. § 1546). They may also be made pursuant to government agency disclosure authorities under FCRA § 608 (15 U.S.C. § 1681f) and state privacy exemptions.

7. Data Security Architecture

We implement rigorous administrative, technical, and physical security measures. All data streams in transit are encrypted via Transport Layer Security (TLS 1.3), and all data repositories at rest are isolated within corporate cloud environments protected by Advanced Encryption Standard (AES) 256-bit cryptography.

8. Data Breach Notification Policy

In the event of a confirmed security incident or data breach resulting in the unauthorized access, exposure, or disclosure of personal data, VerifiedID will:

• Notify affected users, enterprise clients, and relevant regulatory authorities without unreasonable delay (and within statutory notification timeframes).
• Provide clear, plain-language details regarding the nature of the breach, the types of data involved, and the corrective actions taken.
• Issue actionable instructions and guidance on steps users can take to protect their personal information.

9. Business Transfer & Ownership Changes

If VerifiedID LLC undergoes a merger, acquisition, corporate reorganization, or sale of business assets, your personal data may be transferred as part of the transaction. In such an event:

• VerifiedID will notify users prior to the ownership transfer.
• The acquiring entity will be contractually required to honor the privacy commitments and terms established in this policy.
• Users will be provided clear options to securely download, transmit, or request the permanent disposal of their stored verification records prior to transfer completion.

10. Data Subject Rights & FCRA Consumer Rights

Depending on your state or jurisdiction of residence, as well as under the Fair Credit Reporting Act (FCRA), you possess specific rights regarding your personal data, including:

• Right to Access & Disclosure (FCRA § 609): Request a copy of all personal information and consumer verification reports held about you in your file.
• Right to Dispute & Correct (FCRA § 611): Request a free reinvestigation or correction of inaccurate, incomplete, or disputed information in your verification file. Upon receipt of a valid dispute, VerifiedID will conduct a free reinvestigation and complete the review within thirty (30) calendar days, providing written results and an updated report copy to you upon resolution.
• Pre-Adverse & Adverse Action Notice Disclosures (FCRA § 604 & § 615): If an Enterprise Client evaluates your TruCheck™ Consumer Report and intends to take an adverse employment action (e.g., declining engagement or hiring), it must notify you first. Before taking final action, the Enterprise Client is legally required to provide you with a Pre-Adverse Action notice, a copy of the report, and a copy of the CFPB Summary of Rights.
• Right to Deletion: Request deletion of your personal information (subject to identity verification requirements and legal retention exemptions under FCRA and anti-fraud regulations as detailed in Section 5).
• Summary of FCRA Rights: You retain all rights outlined in the official CFPB Summary of Your Rights Under the Fair Credit Reporting Act.

11. Changes to This Privacy Policy & Active Consent

We may update this Privacy Policy periodically to reflect technological, legal, or operational updates. When material changes are made, VerifiedID will:

• Notify users via email or explicit portal announcements.
• Provide a clear, plain-language summary highlighting the exact changes made.
• Require active user consent (such as an explicit click-through acceptance prompt) before the updated policy takes effect for existing users.

12. Contact Us, FCRA Disputes, & CCPA Data Requests

If you have any questions regarding this Privacy Policy or TruCheck’s processing behaviors, please contact:

• FCRA Reinvestigation & Disputes: disputes.trucheck@verifiedid.co
• CCPA / State Consumer Privacy Requests: privacy.trucheck@verifiedid.co

State Privacy Exemption Notice: Sometimes a CCPA, CPRA, or state consumer deletion request cannot be executed. For example, records may be subject to an active "Review Required" status, a fraud investigation freeze, or the mandatory 7-year FCRA audit archive under Section 5. In that case, VerifiedID will issue a written notification stating the specific statutory exemption relied upon to retain the record. This notification will be sent within thirty (30) calendar days of request verification.