{
  "service": "VerifyHuman",
  "controller": "RIWI Corp, 33 Bloor Street East, 5th Floor, Toronto, Ontario M4W 3H1, Canada",
  "contact": "privacy@riwi.com",
  "lastUpdated": "2026-09-18",
  "hosting": {
    "primaryRegion": "United States — DigitalOcean New York (NYC1/NYC3)",
    "notes": "No face images are stored anywhere. Anonymous face-geometry vectors used only for duplicate detection are stored in Zilliz Cloud, Frankfurt (EU). No UK hosting. EU data residency for all records is planned, not yet available."
  },
  "subprocessors": [
    { "name": "DigitalOcean, LLC", "purpose": "Application hosting, managed Postgres and Valkey (cache), backups", "dataCategories": "Account identifiers, session and verification records (no images), billing identifiers", "region": "United States (New York)" },
    { "name": "Auth0 (Okta, Inc.)", "purpose": "Identity provider for dashboard login", "dataCategories": "Account identifiers, authentication events", "region": "United States" },
    { "name": "Stripe, Inc.", "purpose": "Payment processing, subscription billing, tax, invoices", "dataCategories": "Billing identifiers, payment tokens, tax IDs", "region": "United States" },
    { "name": "Resend, Inc.", "purpose": "Transactional email (invites, notices, billing emails)", "dataCategories": "Email addresses, message content", "region": "United States" },
    { "name": "Zilliz, Inc. (Zilliz Cloud / Milvus)", "purpose": "Vector database for anonymous duplicate-detection search", "dataCategories": "Anonymous geometric fingerprint vectors only (no images, no names)", "region": "European Union (Frankfurt, AWS eu-central-1)" }
  ],
  "changeNotice": "We give at least 30 days notice of subprocessor changes at this URL and by email to account owners."
}