Effective date: [not yet in effect]
Last updated: [not yet in effect]
1. Introduction
This Biometric Information Policy ("Policy") describes how Novi Connections Inc. ("Novi," "we," "us," or "our") collects, uses, retains, and destroys biometric information in connection with identity verification on the Novi mobile application. This Policy supplements the Novi Privacy Policy and is incorporated into the Novi Terms of Service.
Every Novi profile is verified. Verification requires the processing described in this Policy, so if you do not consent to it, you will not be able to use Novi.
If you have questions about this Policy, contact us at support@novidate.com.
2. Biometric Information We Collect
Video selfie. During verification, the application captures a brief live video of your face. The video is processed in real time by our service provider to confirm that a live person is present. The video itself is never stored, by us or at our direction.
Reference image. When a verification check passes, a single still image of your face from that check is retained for a limited period, as described in Section 6, to perform the remaining verification steps and to allow a re-check if you change your first profile photograph.
Facial geometry. To perform the checks described in Section 3, our service provider derives a mathematical representation of the face in an image (sometimes called a face template or facial geometry). For members in good standing, this derivation is transient: no face template is kept in any collection or database for you. The single exception, for banned accounts only, is described in Section 7.
Verification results. We retain the numeric results of verification checks (for example, a liveness confidence score or a photo-match similarity score). These records contain no facial imagery.
3. Purposes
Biometric information is collected and used solely to:
- (a) confirm that a live person, and not a photograph, recording, or artificial image, is present;
- (b) confirm that the live person matches the first photograph on the member's profile;
- (c) estimate whether the person may be under the minimum age, in which case the verification is escalated to review by a person; and
- (d) check whether the person matches a face template retained from an account previously banned for serious misconduct, as described in Section 7. A match is reviewed by a person and never results in an automatic ban.
We do not use biometric information for any other purpose. We do not sell, lease, trade, or otherwise profit from biometric information, and we do not use it for advertising, analytics, or the training of artificial-intelligence models.
4. Consent
We collect biometric information only after you have been shown this Policy and have provided consent through an affirmative act. Your consent is recorded electronically with your account identifier, a timestamp, and the version of this Policy in effect at the time. We retain that consent record, including after account deletion, as evidence that consent was given.
If you decline consent, no biometric processing occurs, and verification, and therefore the Novi service, will not be available to you.
5. Service Providers
Verification is performed on our behalf by Amazon Web Services, Inc. ("AWS") under a written agreement requiring safeguards no less protective than this Policy. Facial analysis is performed by the AWS Rekognition service; retained reference images are stored encrypted in AWS infrastructure. No other party processes biometric information on our behalf.
6. Retention and Destruction
| Item | Retention |
|---|---|
| Video selfie | Never stored |
| Reference image | Permanently destroyed within 30 days of the verification decision, and immediately upon account deletion if sooner |
| Facial geometry (members in good standing) | Transient during processing; not retained |
| Verification results (numeric scores) | Life of the account; contain no facial imagery |
| Face template of a banned account | Retained while the ban stands; destroyed if the ban is lifted (Section 7) |
| Consent records | Retained, including after account deletion, as evidence of consent |
In no event is biometric information retained for more than one year from the date of collection, except for the banned-account templates described in Section 7 or where a longer period is required by law or legal process. Destruction under this schedule is performed by an automated deletion process.
7. Enforcement Exception for Banned Accounts
When an account is permanently banned for serious misconduct, we retain a face template derived from that account's verification imagery in a dedicated collection, for the sole purpose of preventing the banned individual from returning under a new account. Future verification checks are compared against this collection; a potential match is reviewed by a person before any action is taken.
These templates are used for no other purpose, are not shared with any third party except as required by law, survive deletion of the banned account, and are destroyed if the ban is lifted.
8. Storage and Security
Retained reference images are encrypted at rest with a dedicated key. Access to biometric information is restricted to our servers; the application and other members have no access to it. Biometric information is stored using a reasonable standard of care within our industry, and in a manner that is the same as or more protective than the manner in which we store other confidential information.
9. Changes to This Policy
We may update this Policy from time to time. Material changes take effect only after being presented in the Services, and new biometric processing under a changed Policy requires consent to the version then in effect. The current version is available at novidate.com/biometric-policy.
10. Contact
Novi Connections Inc.
support@novidate.com