Identity & Biometric Privacy Notice
Effective: August 28, 2026
MaxVFY is the facilitation and recordkeeping layer and uses Didit as the third-party identity-verification provider. Didit performs the underlying identity-document, facial/liveness, face-match, device/network, and related verification processing according to the configured workflow, Didit's applicable terms and privacy notice, and applicable law. See the Didit Verification Privacy Notice and Didit End User Terms for Identity Verification for provider-specific information and terms.
Information used during verification
Depending on the verification flow, Didit may process government-issued identity-document images, facial/selfie or live-capture images, information extracted from identity documents, liveness information, verification responses, device or browser information, and fraud-detection signals.
Before a MaxVFY verification begins, the person being verified is told that Didit powers the identity-verification check, is given links to the applicable MaxVFY and Didit notices and terms, and is asked to provide affirmative consent to the identity-verification processing required for that check.
What MaxVFY stores
The MaxVFY application is designed to minimize the detailed identity information it stores. It does not store raw identity-document images, selfie or facial-image files, biometric media, document numbers, or raw provider decision payloads in the MaxVFY application database.
For an approved verification, MaxVFY may retain limited provider-derived information needed to support the MaxVFY record, including the provider-approved name, provider status, document-type label, technical session or event references, aggregate result counts, verification timestamps, and audit information.
MaxVFY application retention
Processed identity-provider technical event metadata is generally kept for up to 180 days for secure status handling, troubleshooting, and deduplication. An unresolved or unprocessed event may be retained longer while the issue is investigated.
Direct verification PII and provider-session details are generally scrubbed from the MaxVFY application after 24 months. For an approved verification, the period is generally measured from the verification date. For an incomplete or unsuccessful verification, it is generally measured from the record's most recent activity.
The 24-month cleanup clears information such as the subject name and email address, provider-approved name, provider session and event identifiers, provider-status details, document-type/result information, public verification token, return token, and free-form request or archive information. Public sharing is disabled at that time.
A reduced verification record may remain for service integrity and audit purposes. It may include the verification ID, account relationship where applicable, general status, identity-provider name, verification and record timestamps, consent and adult-attestation timestamps, and a general verification-purpose category.
Account closure
When an authenticated user successfully closes a MaxVFY account, MaxVFY disables public sharing and scrubs direct identity information and provider-session references from verification records associated with that account. Limited security, audit, verification, finance, payment, tax, or legal records may remain as described in the Privacy Policy.
Account closure affects the MaxVFY application record. It does not, by itself, guarantee deletion of identity-verification information independently maintained by Didit. If you want assistance with a request concerning provider-held verification data, use the secure contact form; MaxVFY may need to coordinate that request with Didit.
Affiliate payout identity verification
Where MaxVFY requires identity verification before an eligible affiliate payout, the affiliate record may retain the durable verification status, provider name, verification date, and consent record for payout and audit purposes. Transient provider session identifiers, event identifiers, detailed provider status, and secure return-token references are generally cleared after 180 days.
Provider processing and retention
Didit's own retention and deletion practices are separate from the MaxVFY application-retention schedule. Provider retention may depend on the service configuration, type of verification information, security requirements, requests made by the customer or verified person, provider policy, and applicable law. MaxVFY does not represent a particular Didit-side deletion period unless it has been specifically configured and confirmed for the applicable service.
Requests concerning verification data
To request access, correction, deletion, or other assistance concerning MaxVFY-associated verification information, use the secure contact form. Authentication may be required before information is disclosed or changed. Where appropriate, MaxVFY may need to coordinate with Didit because detailed identity-document and biometric information is processed by the provider rather than copied into the MaxVFY application database.
Purpose and limits
The purpose of the verification is to determine whether a person completed the configured identity-verification process, help prevent fraud and misuse, provide the requested verification status, and maintain appropriate verification and audit records.
MaxVFY does not represent identity verification as a background check, credit report, professional certification, endorsement, or guarantee of safety, honesty, financial reliability, or future conduct.