LEGAL · VERIF ID
Verif ID by Valura — Privacy Policy
Hattword Financial Consultancies LLC · CMA Category 5 · Licence No. 20200000304
1. Who We Are
Verif ID by Valura (“Verif ID” or “Verify ID”) is a digital identity verification and onboarding service operated by Hattword Financial Consultancies LLC, licensed and regulated by the Capital Markets Authority of the United Arab Emirates under Category 5 (Investment Advisory and Distribution), Licence No. 20200000304. This policy explains how we collect, use, share, and retain personal data when you use Verif ID to complete identity verification and customer due diligence (CDD) for a Valura product or for a third-party business or fund that has engaged Valura to provide onboarding services.
2. What Data We Collect
Depending on the verification workflow selected for your onboarding, we collect identity documents such as an Emirates ID, passport, or other government-issued ID; biometric data including a liveness capture and face match; government database records where applicable; AML, PEP, sanctions, and adverse media screening results; proof-of-address or bank statement data; questionnaire responses relating to source of funds, UBO, FATCA/CRS, and other regulatory matters; and technical device, session, and log data generated while you use Verif ID. Identity document data may be extracted using MRZ checksum validation and checked for compression artefacts and tampering.
3. Gmail Workspace Data — How It Is Handled
If you choose to connect your Gmail mailbox to provide proof of address instead of uploading a document, Verif ID locates only a single message: a bank or utility statement from a sender you identify or that matches a known institutional domain. We do not browse, index, or read your inbox generally, and we do not access unrelated messages. We retrieve the raw message and cryptographically validate its DKIM signature and DMARC alignment against the sending institution’s published DNS records. This deterministic check is performed on our infrastructure and does not involve an AI or machine-learning model.
Only after a message passes verification, the relevant document content is parsed once through our OCR reader to extract fields needed for your onboarding record, such as name, address, and statement date. This is a single, stateless, per-user extraction call and is not repeated. We retain the derived verification record and the outcome of the DKIM/DMARC check for the retention period described below, but do not retain, cache, or archive underlying email messages. Access is a one-time onboarding step; reconnecting a mailbox for later verification requires fresh consent. You may revoke this access at any time from your Google Account permissions, although revocation does not affect verification already completed.
Limited Use disclosure: Google Workspace user data obtained by Verif ID, whether raw or derived, is never used to develop, improve, or train any generalized, non-personalized, or foundational AI/ML model by Valura or any third party. It is not sold, used for advertising, or transferred to data brokers. The use of information received from Google Workspace scopes adheres to the Google User Data Policy, including its Limited Use requirements.
4. How We Use Your Data
We use the data described above solely to verify your identity and complete customer due diligence required by applicable AML/CFT and securities regulation; meet statutory record-keeping obligations; detect and prevent fraud in the onboarding process; and communicate with you about the status of your verification. We do not use this data to determine creditworthiness, for lending decisions, advertising, marketing profiling, or any other purpose. We do not use Google Workspace-derived data, or any data processed through Verif ID, to train or improve generalized AI/ML models.
5. Data Retention
We retain verification records, including data derived from documents and mailbox verification, for five (5) years after the end of the customer relationship, or longer where required by applicable law. We do not retain raw source documents or email messages beyond the time needed to complete verification; we retain the derived verification record for the statutory period.
6. Data Security
We use encryption in transit and at rest, role-based access controls, audit logging, and industry-standard information security controls. Access to Google Workspace-derived data is limited to the systems and personnel that need it to complete verification.
7. Your Rights
You may request access to, correction of, or deletion of your personal data, subject to our regulatory record-keeping obligations, by contacting support@valura.ai. You may withdraw mailbox access consent at any time as described in Section 3.
8. International Transfers
Your personal data may be transferred between the United Arab Emirates, India, and jurisdictions where the user’s investment may be domiciled. Where such transfers occur, appropriate contractual, technical, and organisational safeguards are implemented in accordance with applicable data protection laws.
9. Children
Verif ID is not directed at, and does not knowingly collect data from, individuals under 18 years of age.
10. Changes to This Policy
We will notify you and, where required, seek renewed consent before using your Google Workspace data in a new way or for a purpose not disclosed here.
11. Contact Us
Hattword Financial Consultancies LLC
321, Emaar Business Park 1, The Greens, Dubai, United Arab Emirates
Email: support@valura.ai
Telephone: +971 54 597 2000