TruCheck™ Privacy Policy

1. Scope of This Policy & Regulatory Roles

VerifiedID LLC provides TruCheck™, an advanced frontend identity validation and pre-employment eligibility verification platform. This Privacy Policy explains how we collect, use, disclose, protect, and retain the personal information, sensitive data, document media, and biometric information of job applicants and candidates ("you," "your") who interact with the TruCheck™ system on behalf of potential employers, hiring enterprises, or recruiting networks ("Enterprise Clients").

Candidate Session Entry: Job applicants and candidates typically access and submit data to TruCheck™ through a secure, single-use web session link generated upon an Enterprise Client's invitation, rather than through a registered user account. This Privacy Policy applies equally to all data collected via client-initiated session links as well as registered system portals.

This Privacy Policy applies to all data processed through the TruCheck™ application workflow, including interactive photo/video capture portals, document extraction modules, automated cross-matching engines, data verification dashboards, and portable digital verification cards.

Regulatory & Operational Roles:

• Consumer Reporting Agency (CRA): VerifiedID LLC operates as a Consumer Reporting Agency governed by the Fair Credit Reporting Act (FCRA, 15 U.S.C. § 1681 et seq.) when compiling and issuing TruCheck™ Consumer Reports for employment evaluation purposes.
• Data Processor / Service Provider: In addition, VerifiedID LLC acts as a Data Processor / Service Provider handling data under instructions from our Enterprise Clients, who act as the Data Controllers.

2. Information We Collect and Extract

To cross-authenticate your identity and assess frontend employment eligibility metrics, TruCheck™ collects and processes the following data assets directly from your verification session, as well as from information supplied by the authorizing Enterprise Client:

• Personal Identifiers: Legal full name, date of birth, home address, email address, phone number, and Social Security Number (SSN) / Tax Identification Number (TIN).
• Biometric Data & Video Streams: Facial geometry templates and computational maps derived from your live photo capture and your seamlessly generated session verification video. This active session explicitly includes the capturing of a background video as part of your live video interaction.
• Stored Photographic Images: The live verification photo and live selfie capture of your face taken during the session, used for automated facial matching, administrative identity confirmation, and display on your verification profile.
• Government-Issued Identification Documents: Digital image captures (Front and Back) of Driver’s Licenses, State IDs, Tribal IDs, and U.S. or Foreign Passports captured during your live interaction. Note: Uploaded document images are processed strictly within our secure engine and are NOT shared with or made visible to Enterprise Clients.
• Employment Eligibility Documentation: Image copies of acceptable employment authorization documents (such as U.S. Passports, Permanent Resident Cards, Employment Authorization Documents, or state-issued identity documents) captured during your live interaction solely for backend verification.
• Optional State-Issued ID Documents: Providing a State-issued Driver’s License or ID Card is completely optional. If provided, it helps verify state-level jurisdiction details (DL/Real ID - Issuing Jurisdiction). This document is not required to complete your verification.
• Client-Provided Historical Documentation: Copies of your identification, credentials, or work authorization documents previously provided by you to our Enterprise Clients during current or prior application/engagement cycles and uploaded to our system by the Enterprise Client.
• U.S. Work Authorization & Immigration Data: Form I-797 receipt numbers, alien registration numbers, visa classification details, and real-time status verification data retrieved via official federal channels (including the USCIS Case Status API).
• Extracted Textual Metadata: Full Legal Name, Date of Birth (DOB), Document ID Numbers, Issue Dates, and Expiration Dates parsed directly from uploaded credentials. Note on ADEA Privacy Redaction: Date of Birth data is displayed on Candidate and CRA reports for identity verification under FCRA § 609, but is redacted (----) from Client-facing cards and consumer reports to comply with the Age Discrimination in Employment Act (ADEA).
• Identity Infrastructure Assets: Social Security Number (SSN). Note on Identity Redaction: The last four digits of your SSN are visible on Candidate and CRA reports to confirm file matching, but are redacted (----) from Client-facing consumer reports and verification cards.
• Professional & Application Data: Resumes, work history disclosures, and signed legal attestations (e.g., Exclusive Employment Attestations / Multi-Job Shield declarations).
• Technical Telemetry & Metadata: IP address, detected connection type (including VPN or proxy indicators), network geolocation, physical location coordinates, device type, operating system version, browser type, camera hardware attributes, timestamped audit logs, and session diagnostic logs.

3. How We Use and Cross-Match Your Data

VerifiedID processes your personal data via TruCheck™ exclusively for the following lawful business purposes:

• Identity Verification & Facial Matching: Evaluating your live photo, live selfie capture, verification video, and background video streams against the image on your submitted government-issued identification to prevent identity theft and substitution fraud.
• Multi-Source Data Cross-Matching & Extraction Validation: Extracting and cross-reconciling text strings, data fields, and alphanumeric identifiers across (a) your live Identity Documents, (b) your live Employability Documents, and (c) any historical verification files uploaded by the Enterprise Client. This reconciliation is performed using parsing technology and human-in-the-loop validation explicitly to identify data discrepancies, fraud vectors, age/identity manipulation, or conflicting record submissions.
• Verification Status Determination: Processing metrics to determine if an applicant achieves an evaluation status of Clear, Review Required, or a system Alert (such as network or geographic indicators) for identity and employability checks. All processing is conducted in strict compliance with federal anti-discrimination laws, including the Age Discrimination in Employment Act (ADEA), Title VII of the Civil Rights Act, and the Immigration and Nationality Act (INA § 274B). Sensitive parameters such as age, specific citizenship category, or document type are redacted on Client-facing cards to ensure unbiased evaluation by Enterprise Clients.
• Portable Identity & Employability Card Generation: Generating a secured, digital verification card containing your profile photo and authentication tokens, eligible for client sharing when evaluations return a Clear status.
• Security, SSN, Overemployment, & Geolocation Auditing: Validating the existence and approximate issuance date of your provided SSN against commercial databases and the Social Security Administration's Death Master File (DMF). An inability to match an SSN in commercial databases generates an informational alert and does not automatically confirm non-existence. Analyzing network attributes to generate security status indicators (such as VPN usage or checks initiated outside the United States). Cross-referencing internal network registries to detect multi-job/overemployment fraud. System logs and submitted assets are continuously analyzed for indicators of organized criminal activity, stolen identities, stolen SSNs, synthetic credentials, and forged or altered identification/employability documents (including counterfeit Driver’s Licenses, Passports, and Permanent Resident Cards).

4. Biometric Information Privacy Notice & Consent (BIPA & State Compliance)

PLEASE READ CAREFULLY: TruCheck™ processes biometric identifiers. By clicking "I Agree and Consent," you grant your explicit, standalone written consent to the following processing behaviors:

• Biometric Data Collected: Facial geometry signatures and mathematical facial maps extracted during your live selfie photo and generated video session (including accompanying video backgrounds).
• Specific Purpose: Verifying match consistency against your provided credentials to prevent credential and identity fraud.
• Downstream Sub-Processors: Data may be streamed to highly secure, bank-grade infrastructure partners solely to execute active face-to-photo validation.
• Strict Biometric Destruction Timeline: While flat reference images of your face may be stored for visual dashboard confirmation, all raw mathematical biometric identifiers, structural face maps, and calculations are permanently destroyed and erased from our active processing memory within twenty-four (24) hours of collection or when the primary purpose is fulfilled, whichever is shorter (aligning strictly with Illinois BIPA 740 ILCS 14/15(a)).

5. Hybrid Data Retention, Tiered Image Purge, & Deletion SLA

We implement a hybrid data retention architecture that balances strict data minimization for sensitive document media with complete seven-year audit trail compliance for legal and fraud prevention obligations:

• Tier 1: Immediate Biometric Purge (24 Hours): All raw mathematical facial geometry scans and biometric templates are permanently scrubbed and destroyed within twenty-four (24) hours of session completion.
• Tier 2: Sensitive Document Media Purge (3 Months / Card Expiration): Heavy document media files—including digital image captures of government photo IDs, driver's licenses, passports, and work authorization documents—are retained in live storage for three (3) months from submission or until the printed TruCheck Expiry date on a "Clear" Card, whichever is later. Upon reaching this threshold, all unneeded document media images are permanently purged from active repositories to minimize data liability.
• Tier 3: 7-Year FCRA & Multi-Job Audit Archiving (Dormant Records): To comply with Section 605 of the Fair Credit Reporting Act (FCRA), satisfy federal regulatory recordkeeping mandates, resolve potential consumer disputes, and enable continuous cross-tenant overemployment fraud detection (Multi-Job Shield), all alphanumeric metadata, system RefNumbers, verification audit logs, status outcome records, and secure cryptographic hashes (such as SSN and identity hashes) are safely archived for seven (7) years following session completion. Inactive or dormant candidate session records and archived files are automatically scrubbed and permanently deleted upon expiration of the 7-year retention window.

Data Deletion Requests & SLA:

Candidates and users retain the right to request permanent deletion of their stored personal data records and session files at any time.

• How to Request: Candidates do not need a registered account to exercise this right. Simply submit a written deletion request containing your full name, email address, and TruCheck™ Session Reference Number (RefNumber) to our Privacy Officer at privacy.trucheck@verifiedid.co.
• Deletion Processing Timeline: VerifiedID will verify the requester's identity and process the permanent deletion request within thirty (30) calendar days of receipt, subject to statutory record-retention exemptions under FCRA and anti-fraud regulations.

6. How We Disclose Your Information & Third-Party Restrictions

We do not sell, rent, lease, trade, or monetize your personal information or biometric data to third parties for monetary value, targeted advertising, or marketing purposes. Your data is disclosed strictly to facilitate the verification loop:

• The Requesting Enterprise Client: The potential employer or talent platform that invited you to complete TruCheck™ receives access to your document status evaluations (Clear, Review Required, or Alert), compliance tracking metrics, geolocation indicators, and your live candidate selfie image. Enterprise Clients do not receive access to raw images of your uploaded identity documents or employment documentation. Specific identifiers (such as Year of Birth and SSN) are redacted (----) on Client-facing views, and specific document types are displayed using generic labels (e.g., Candidate provided Document #1) to comply with INA § 274B anti-discrimination requirements.
• User-Initiated Sharing: Authorized third parties receive access to your portable verification card only when explicitly shared by you or the primary Enterprise Client, provided the card holds an active Clear status.
• Verified Infrastructure Partners & Federal Endpoints: Restricted alphanumeric data, document streams, or verification queries are transmitted to certified database administrators, biometric engine providers, secure cloud storage vaults, and official government endpoints (e.g., USCIS) to perform identity matching, SSN lookups, DMF safety checks, and real-time work authorization checks.
• Strict Third-Party Restrictions: Third-party use or disclosure of user information (including de-identified, anonymized, or pseudonymized data) for any purpose outside of rendering the TruCheck™ service is strictly prohibited without active user consent. All third parties are contractually bound to the terms, security standards, and privacy protections set forth in this policy.
• Fraud Prevention, Organized Crime & Law Enforcement Disclosures: VerifiedID LLC actively screens verification traffic to detect organized crime, identity theft rings, stolen Social Security Numbers, impersonation fraud, synthetic identities, and forged or counterfeit government documents (including fake Driver’s Licenses, Passports, and Permanent Resident Cards / Green Cards). We reserve the explicit right to disclose personal information, biometric indicators, document media, session diagnostic logs, and technical telemetry to federal, state, or local law enforcement agencies and regulatory authorities—including the Federal Bureau of Investigation (FBI / IC3), U.S. Homeland Security Investigations (HSI), the U.S. Secret Service, the Social Security Administration Office of the Inspector General (SSA-OIG), the Federal Trade Commission (FTC), and the U.S. Department of Justice (DOJ)—without prior notice to you, to assist in criminal investigations involving identity fraud (18 U.S.C. § 1028), Aggravated Identity Theft (18 U.S.C. § 1028A), document/visa fraud (18 U.S.C. § 1546), or pursuant to government agency disclosure authorities under FCRA § 608 (15 U.S.C. § 1681f) and state privacy exemptions.

7. Data Security Architecture

We implement rigorous administrative, technical, and physical security measures. All data streams in transit are encrypted via Transport Layer Security (TLS 1.3), and all data repositories at rest are isolated within corporate cloud environments protected by Advanced Encryption Standard (AES) 256-bit cryptography.

8. Data Breach Notification Policy

In the event of a confirmed security incident or data breach resulting in the unauthorized access, exposure, or disclosure of personal data, VerifiedID will:

• 1.Notify affected users, enterprise clients, and relevant regulatory authorities without unreasonable delay (and within statutory notification timeframes).
• 2.Provide clear, plain-language details regarding the nature of the breach, the types of data involved, and the corrective actions taken.
• 3.Issue actionable instructions and guidance on steps users can take to protect their personal information.

9. Business Transfer & Ownership Changes

If VerifiedID LLC undergoes a merger, acquisition, corporate reorganization, or sale of business assets, your personal data may be transferred as part of the transaction. In such an event:

• VerifiedID will notify users prior to the ownership transfer.
• The acquiring entity will be contractually required to honor the privacy commitments and terms established in this policy.
• Users will be provided clear options to securely download, transmit, or request the permanent disposal of their stored verification records prior to transfer completion.

10. Data Subject Rights & FCRA Consumer Rights

Depending on your state or jurisdiction of residence, as well as under the Fair Credit Reporting Act (FCRA), you possess specific rights regarding your personal data, including:

• Right to Access & Disclosure (FCRA § 609): Request a copy of the personal information and consumer verification reports held about you.
• Right to Dispute & Correct (FCRA § 611): Request a free reinvestigation or correction of inaccurate, incomplete, or disputed information in your verification file.
• Right to Deletion: Request deletion of your personal information (subject to legal retention exemptions for anti-fraud, security, or legal compliance).
• Summary of FCRA Rights: You retain all rights outlined in the official CFPB Summary of Your Rights Under the Fair Credit Reporting Act.

11. Changes to This Privacy Policy & Active Consent

We may update this Privacy Policy periodically to reflect technological, legal, or operational updates. When material changes are made, VerifiedID will:

• 1.Notify users via email or explicit portal announcements.
• 2.Provide a clear, plain-language summary highlighting the exact changes made.
• 3.Require active user consent (such as an explicit click-through acceptance prompt) before the updated policy takes effect for existing users.

12. Contact Us, FCRA Disputes, & CCPA Data Requests

If you have any questions regarding this Privacy Policy or TruCheck’s processing behaviors, please contact:

VerifiedID LLC

Attn: TruCheck Privacy and Compliance Office

11180 State Bridge Road, Suite 303, Alpharetta, GA 30022, USA

Toll-Free Phone: (888) 718-2597

Email: privacy.trucheck@verifiedid.co

FCRA Disputes: disputes.trucheck@verifiedid.co

For CCPA or Data Deletion Requests:

Attn: TruCheck Privacy and Compliance Office (CCPA – data deletion)

Email: privacy.trucheck@verifiedid.co