Privacy Policy

VerifiMe Canada Inc. ("VerifiMe", "we", "us" or "our") provides third-party verification services to businesses across Canada. This Privacy Policy explains how we collect, use, disclose, store and protect personal information, and the choices and rights available to you.

We are committed to complying with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, provincial private-sector privacy laws, including Quebec's Act respecting the protection of personal information in the private sector, Alberta's Personal Information Protection Act and British Columbia's Personal Information Protection Act. Our messaging practices are designed to comply with Canada's Anti-Spam Legislation (CASL).

This policy is effective as of 3 October 2026.

Scope and who this policy covers

This policy applies to personal information we handle through:

• our website at https://verifime.ca (the "Website");
• the VerifiMe platform at verify.verifime.ca, our billing pages at billing.verifime.ca, our application programming interface (API) and related services (together, the "Services"); and
• our communications with you by email, phone, SMS or in person.

It describes our practices for three groups of people:

• Website visitors: anyone who browses the Website or contacts us through it.
• Client users: employees and representatives of businesses that subscribe to the Services ("Clients") and who use the VerifiMe portal or API on their behalf.
• Recipients: individuals to whom a Client asks us to send a verification, typically that Client's own customers who have entered into, or are about to enter into, an agreement with the Client.

This policy does not cover the practices of our Clients. Each Client is responsible for its own privacy practices, including how it collects your information before asking us to verify a transaction with you.

Our role: when we act for our Clients

When a Client uses the Services to verify a transaction with a Recipient, the Client decides what information is collected, which questions are asked and how the results are used. In that context, the Client is the organization in control of the Recipient's personal information, and VerifiMe processes that information on the Client's behalf and under its instructions as a service provider. Under PIPEDA, the Client remains accountable for that information, and we are contractually required to protect it and use it only to provide the Services.

For information about Website visitors and Client users, and for information we use to operate, secure and improve our own business, VerifiMe is the organization in control and is accountable for it under this policy.

If you are a Recipient and have a question about why you received a verification or how a business uses your information, please contact that business first. We will help them respond, and you may also contact us directly using the details at the end of this policy.

Information we collect

Website visitors

• Information you give us: your name, company, work email, phone number, industry, sales volume, systems you use, and any message you send through our demo request form or by email or phone. Demo requests are delivered to our sales team and stored as a contact in our email provider, Brevo, so we can follow up. If you tick the box to receive product updates, we also add you to our marketing list; you can unsubscribe at any time.
• Technical information: your device's IP address, browser type and version, operating system, referring page, pages viewed, date and time of your visit, and error information if something goes wrong. See our Cookie Policy for details about cookies and similar technologies.

Client users

• Account information: name, business email address, phone number, job title, company, role and permissions, and login credentials (passwords are stored only in hashed form).
• Billing information: billing contact, company address, plan, invoices and payment history. Card payments are processed by our payment provider, Stripe. We do not receive or store full card numbers.
• Usage information: actions taken in the portal and through the API, such as verifications created, sent or resent, questionnaires and reports configured, settings changed, and the time, IP address and device associated with each action. We keep these records for security, support and audit purposes.
• Support communications: messages, calls and meeting notes when you contact us for help.

Recipients

When a Client asks us to send a verification, we collect and generate the following on the Client's behalf ("Verification Data"):

• Information provided by the Client: your name, mobile phone number and/or email address, a reference number for your transaction, and the details of the agreement being verified. Depending on the Client and the product, this can include the product or service purchased, price, payment, financing or rental terms, contract dates, a vehicle identification number, a service address, and the name of the sales representative.
• Your responses: each answer you give to the verification questions, and any comments you enter.
• Your signature: if the Client requires one, an image of the signature you draw on your device.
• Identity check results: if the Client enables a one-time passcode, the fact that a code was sent and whether it was entered correctly. We do not keep the codes themselves after they expire.
• ID verification results (only where a Client sends an ID check): if a Client asks you to verify your identity, you will be asked for your consent before you photograph your government-issued photo ID and take a live selfie. The capture and the checks are performed by our identity verification partner, Didit. VerifiMe receives and keeps a summary of the result: your name and date of birth as read from the ID, the type of document and issuing jurisdiction, the last four digits of the document number, the outcome and scores of each check, and the IP address and device used. If the Client chooses, VerifiMe also keeps the face photo from your ID and your selfie. See "Identity document verification" below.
• Language preference and translations: if a Client offers other languages, we record the language you chose and the consent statement exactly as it was shown to you. Anything you type in a language other than English is translated into English for the Client.
• Technical and evidence information (the "Audit Trail"): see the next section.

We do not ask Recipients for, and Clients are instructed not to send us, social insurance numbers, payment card numbers, banking credentials or health information.

The verification audit trail

Because Clients rely on a verification as evidence that a transaction was confirmed by the right person, each verification produces a separate, internal evidence record called the Audit Trail. It may include:

• the date and time, to the second, of each event: creation, sending, delivery, opening of the link, passcode request and entry, each answer, signature, completion, failure, resending and expiry;
• who or what created or resent the verification (a named Client user or a Client API key);
• the phone number or email address the verification was delivered to, the sending number or address, and delivery status reported by the carrier or email provider;
• the IP address of the device used to open and complete the verification, and approximate location derived from that IP address (city or region level, not precise GPS location);
• browser, operating system and device type;
• the version of the questions displayed and the answers given, including whether any answer triggered a fail rule set by the Client; and
• a record of the PDF report issued and to whom it was sent.

How the Audit Trail is used: only to document and prove that a verification took place, to support the Client in responding to disputes, complaints, chargebacks, lender or regulatory inquiries, to detect and prevent fraud (for example, a verification completed by someone other than the customer), and to secure and troubleshoot the Services.

Who can see it: the Audit Trail is available only to authorized users of the Client that requested the verification, and to authorized VerifiMe personnel who need it to provide support, maintain security or meet legal obligations. It is never displayed to, or sent with the report to, the Recipient. Recipients may still request access to their own personal information as described under "Your rights".

Integrity: once a verification is completed, its answers, signature and Audit Trail are not edited. If something needs to change, the Client sends a new verification and both records are kept.

How we use personal information

We use personal information only for purposes a reasonable person would consider appropriate in the circumstances, and only for the purposes identified in this policy or at the time of collection:

• To provide the Services: creating and delivering verifications, presenting questions, recording responses and signatures, producing reports, applying fail rules, sending alerts to Client users, and making results available in the portal and through the API.
• To verify identity and prevent fraud: passcode checks, identity document verification where enabled, duplicate detection, and reviewing technical evidence for misuse.
• To manage Client accounts: setting up users and permissions, billing, plan management, customer support and service announcements.
• To respond to enquiries: answering questions and demo requests from prospective Clients.
• To secure and improve the Services: monitoring, logging, debugging, capacity planning, and measuring how features are used, using aggregated or de-identified information where possible.
• To meet legal obligations: complying with laws, regulations, court orders and lawful requests, and establishing, exercising or defending legal claims.

Recipients are never marketed to. We do not use Verification Data to send marketing, we do not combine it across Clients, and we do not sell, rent or trade personal information to anyone. We use Verification Data only for the Client that provided it, and only to provide the Services to that Client.

Consent

• Clients and Client users: by creating an account or contacting us, you consent to the collection, use and disclosure described in this policy.
• Recipients: Clients are responsible for obtaining any consent required for us to contact you and process your information for verification, and they confirm to us that they have done so. Completing a verification is voluntary. If you choose not to complete it, or you answer that you do not agree with any part of the transaction, the Client will be informed so it can follow up with you.
• Express consent: we obtain express consent before an ID check captures your ID and selfie, and before any new use of personal information not described here.
• Withdrawing consent: you may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may mean we, or the Client, cannot complete a verification or provide a service. Withdrawal does not affect records already created to document a completed verification, which are kept as described under "How long we keep information".

Messages we send

Verification messages sent by SMS or email on behalf of a Client are transactional messages that relate to an agreement the Recipient has entered into, or is about to enter into, with that Client. They are not marketing messages. Each SMS verification is sent from a number dedicated to the Client, identifies the Client, and honours standard opt-out keywords such as STOP. Email verifications identify the Client and include our contact information.

We send marketing emails to Client users and prospective Clients only with consent as required by CASL, and every marketing email includes a working unsubscribe link.

Identity document verification

Where a Client sends an ID check, our identity verification partner, Didit, checks that your photo ID is genuine, that the selfie was taken of a live person, and that the selfie matches the photo on the ID. This comparison involves biometric processing, which is sensitive information. We:

• collect it only with your express consent, given on a consent screen that names Didit before capture begins;
• use it only to confirm your identity for that verification, and never for any other purpose or for any other Client;
• never store images of your ID document, your address, or your full document number in VerifiMe;
• keep the face photo from your ID and your selfie only if the Client chooses to, in private storage that only Client users authorized to view audit trails can access; and
• record the result only after reading it directly from Didit, so a forged notification cannot create a false result.

Didit processes the images to perform the check and keeps them only as permitted under its agreement with us. We do not create biometric databases or use facial data for any other purpose.

Automated processing

The Services apply rules that Clients configure. For example, if a Recipient gives an answer the Client has marked as a failure, the verification is automatically marked as failed and the Client is alerted. Similarly, ID checks are evaluated automatically by our identity verification partner, with some checks sent to a human reviewer, and the Client may set rules such as a minimum age or a name match. These results flag the transaction for follow-up by the Client; VerifiMe does not cancel agreements or make decisions about you. If you want to know which information and rules led to a verification being marked as failed, or to have that result reviewed by a person, contact the Client or us.

Service providers we use

We rely on trusted service providers to operate the Services. They may access personal information only as needed to perform services for us, under written agreements that require them to protect it and use it only for that purpose. Our current providers are:

We may update this list as our providers change. The current list is always available on this page or on request.

We may also share personal information with:

• The Client that requested a verification, which receives the Recipient's answers, report and Audit Trail;
• Professional advisers such as lawyers, accountants and auditors, under confidentiality obligations;
• Authorities, when required by law, court order or other legal process, or when necessary to protect the rights, safety or property of VerifiMe, our Clients, Recipients or others; and
• A successor business, in connection with a proposed or completed merger, financing, acquisition, or sale of all or part of our business, under confidentiality obligations and only to the extent necessary, with the information continuing to be protected as described in this policy.

Where information is stored and cross-border transfers

VerifiMe is based in Canada. Our primary database and file storage, which hold Verification Data, Audit Trails and Client account information, are hosted in Canada. Some of our service providers process information in other countries, including the United States and member states of the European Union, as shown in the table above. When information is processed outside Canada, it is subject to the laws of that country and may be accessible to its courts, law enforcement and national security authorities.

We use contractual and technical safeguards to protect information that is transferred outside Canada, including encryption in transit and written commitments from providers. For personal information about residents of Quebec, we assess the risks before communicating it outside Quebec, as required by Quebec law.

How long we keep information

We keep personal information only as long as needed for the purposes described in this policy, or as required by law. Unless a Client instructs us otherwise in writing, or a longer period is required by law, we apply the following retention periods:

Clients may set shorter retention periods for their own Verification Data, or ask us to delete it when their agreement ends, subject to any legal holds. When information is no longer needed, we securely delete it or anonymize it so it can no longer identify an individual.

How we protect information

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including:

• encryption of data in transit (TLS) and at rest;
• role-based access so Client users see only their own organization's data, with company admins controlling what each of their users can access;
• access by VerifiMe personnel limited to those who need it, protected by multi-factor authentication, and logged;
• separate API keys for each Client, and protections against duplicate or unauthorized requests;
• expiring verification links and optional passcode checks;
• monitoring, logging and regular review of our systems and providers; and
• confidentiality obligations for our employees and contractors.

No method of transmission or storage is completely secure. Client users are responsible for keeping their login credentials and API keys confidential and for notifying us immediately of any unauthorized use.

Privacy breaches

If a breach of security safeguards involving personal information creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada and any applicable provincial regulator, as required by law, and notify affected Clients without undue delay. We keep a record of every breach of security safeguards for at least 24 months.

Your rights

Subject to applicable law, you have the right to:

• Access the personal information we hold about you and learn how it has been used and to whom it has been disclosed;
• Correct information that is inaccurate or incomplete;
• Withdraw consent as described above;
• Ask that we stop using or delete information that is no longer needed, subject to legal and contractual retention requirements;
• Receive your information in a structured, commonly used technological format (Quebec residents, for computerized personal information you have provided);
• Be informed of automated processing used to make a decision about you, and have it reviewed by a person; and
• Make a complaint to us or to a privacy regulator.

To make a request, contact our Privacy Officer, Marcus Leavington, using the details below. We may need to confirm your identity before responding. We respond within 30 days, or tell you within that time if we need an extension and why, as permitted by law. Access requests are free in most cases.

If your request concerns Verification Data, we will forward it to the Client that requested the verification and assist the Client in responding, because the Client controls that information. We will not disclose one Recipient's information to another person, and we may refuse a request where the law allows, for example where disclosure would reveal another person's information or confidential commercial information, or where the information was created for a legal dispute. If we refuse, we will explain why.

Children

Our Services are intended for businesses and for adult Recipients who are entering into agreements. We do not knowingly collect personal information from anyone under the age of majority in their province or territory. If you believe we have received information about a minor, contact us and we will delete it.

Third-party links

The Website may link to sites we do not operate. We are not responsible for their privacy practices, and we encourage you to read their privacy policies.

Changes to this policy

We may update this policy to reflect changes in our Services, our providers or the law. We will post the updated version on this page with a new effective date. If a change materially affects how we use personal information already collected, we will notify Clients by email and, where required, obtain consent before applying it.

Contact us

Questions, requests and complaints about this policy or our privacy practices can be sent to our Privacy Officer, who is responsible for VerifiMe's compliance with this policy:

Marcus Leavington
Compliance Director and Privacy Officer
VerifiMe Canada Inc.
60 Atlantic Avenue, Suite 200, Toronto, ON M6K 1X9
privacy@verifime.ca
1-877-849-3389, ext. 0041

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376) or, where applicable, your provincial privacy regulator, such as the Commission d'accès à l'information du Québec, the Office of the Information and Privacy Commissioner of Alberta, or the Office of the Information and Privacy Commissioner for British Columbia.