MaxVFY

Privacy Policy

Effective: August 28, 2026

MaxVFY collects the account, contact, transaction, verification-status, security, and support information needed to provide and protect the service. We use this information to operate MaxVFY, prevent abuse and fraud, process transactions, maintain appropriate records, respond to support requests, and comply with applicable law.

MaxVFY does not sell personal information. We use service providers where necessary to operate the service, including identity verification, hosting, email, security, and payment providers.

Cookies and browser storage

MaxVFY uses a first-party session cookie needed for secure session continuity, account access, and anti-forgery protections. With the visitor’s analytics preference, MaxVFY may also use first-party measurement cookies to understand website visits, landing pages, referral sources, approximate location, device category, and conversion to account registration. MaxVFY does not use third-party advertising or third-party analytics cookies on its public website. For details, see the Cookie Notice.

Identity verification

MaxVFY facilitates identity checks using Didit as the third-party verification provider. Didit—not MaxVFY—performs the underlying document, facial/liveness, face-match, device/network, and related verification processing. MaxVFY is designed to receive the result and limited information needed for the MaxVFY record rather than copying raw identity-document images or biometric media into the MaxVFY application database.

For more detail, see the Identity & Biometric Privacy Notice and the Didit Verification Privacy Notice.

MaxVFY application retention schedule

The following default periods apply to information stored in the MaxVFY application. They do not control information independently retained by service providers such as Didit or Stripe.

  • Expired security and action tokens: email-verification, password-reset, affiliate, verification-action, and verification-start token records are generally removed seven days after expiration. Expired rate-limit records are also cleaned from the system.
  • Verification invitations that never produced a verification: invitation contact and request data is generally removed 30 days after the invitation expires.
  • Verification invitations that produced a verification record: the separate invitation row is generally removed 90 days after its last activity. The related verification record may remain under the verification-retention rules below.
  • Identity-provider technical event metadata: processed technical event metadata used for secure status handling, deduplication, troubleshooting, and security is generally retained for up to 180 days. An event that remains unresolved or unprocessed may be retained longer while the issue is investigated.
  • Contact and support submissions: messages submitted through the MaxVFY contact system are generally retained for up to 365 days.
  • First-party website analytics: when a visitor allows analytics, MaxVFY may store a random visitor/session identifier, page paths, referral/UTM source, device category, approximate location when supplied locally by the server or reverse proxy, and the visitor IP address. Raw visitor IP addresses and user-agent strings are generally cleared after 30 days. Raw analytics sessions and pageviews are generally removed after 12 months.
  • Direct verification PII and provider references: direct identifying information and provider-session details are generally scrubbed after 24 months. For a successful verification, the period is generally measured from the verification date; for an incomplete or unsuccessful verification, it is generally measured from the record's most recent activity.
  • Affiliate identity-verification technical references: provider session identifiers, event identifiers, provider-status detail, and secure return-token references associated with affiliate payout verification are generally cleared after 180 days. Durable payout-verification status, verification date, consent record, and provider name may remain with the affiliate record for payout, security, and recordkeeping purposes.
  • Customer feedback and reviews: direct reviewer-account linkage, free-form comments, public display names, and supplied company names are generally scrubbed after 24 months. An approved review is removed from public rotation when this cleanup occurs. A reduced rating and moderation record may remain for aggregate service-quality and audit purposes.
  • Application and administrative audit logs: these records are generally retained for up to 24 months.
  • Billing, finance, tax, payment, and accounting records: these records are not part of the automated verification-privacy cleanup and may be retained longer where reasonably necessary for accounting, payment disputes, fraud prevention, tax, legal, or other legitimate recordkeeping requirements.

What remains after the 24-month verification scrub

The 24-month cleanup does not necessarily delete the entire verification record. MaxVFY clears direct subject identifiers and provider-session details such as the subject name and email address, provider-approved name, provider session and event references, provider-status details, document-type/result details, public sharing token, return token, and free-form request or archive notes.

A reduced verification record may remain for service integrity and audit purposes. That record may include the MaxVFY verification ID, account relationship where applicable, general verification status, identity-provider name, relevant timestamps, consent and adult-attestation timestamps, and a general verification-purpose category. Public verification sharing is disabled when direct verification information is scrubbed.

Account closure and deletion

An authenticated MaxVFY user can request account closure from the Account page. Successful closure disables sign-in, revokes the active MaxVFY session, disables public verification sharing, removes outstanding account-owned invitation access, and scrubs the active profile and direct identifying information from associated verification and review records.

MaxVFY does not physically erase every record connected with a closed account. A reduced account identifier and limited verification, security, audit, billing, finance, payment, tax, or dispute records may remain where reasonably necessary for service integrity, fraud prevention, accounting, legal obligations, or the retention periods described above. A requester account with an active or past-due monthly MaxVFY subscription must have that subscription canceled successfully before the account is closed.

Closing a MaxVFY account does not itself guarantee deletion of information held independently by identity-verification, payment, hosting, email, or other service providers. Requests concerning provider-held identity-verification information may require MaxVFY to coordinate with Didit. Payment-provider records may also remain under the provider's own legal and recordkeeping obligations.

Eligibility and consent records

MaxVFY may collect and retain eligibility and age-attestation records, including whether a user, requester, or verification recipient confirmed an applicable 18+ requirement and the date and time of that confirmation. We use these records to administer MaxVFY's adults-only policy, document consent and eligibility representations, prevent misuse, maintain audit records, and address disputes or compliance matters.

These attestations are not an independent determination or certification by MaxVFY of a person's age.

Privacy and deletion requests

For access, correction, deletion, or other privacy requests, use the secure contact form. MaxVFY may require authentication before acting on account-associated information. Some records may need to be retained where reasonably necessary for security, fraud prevention, financial recordkeeping, dispute resolution, contract enforcement, or legal obligations.

Where a request concerns detailed identity-document or biometric information maintained by Didit rather than the MaxVFY application database, MaxVFY may need to coordinate the request with Didit.

Optional customer feedback and reviews

If you voluntarily submit feedback after a completed verification, MaxVFY may store the rating, comment, publication preference, optional public display name, and optional company or organization name you provide. Feedback is not published automatically. Public display requires your permission and administrative approval.

Reviews may be moderated for spam, abusive content, personal or sensitive information, irrelevance, and authenticity concerns. You may contact MaxVFY to request removal of a published review.

Business contact

Management MaxVFY.com
138 East 12300 South, Suite 1021
Draper, UT 84020 USA