Privacy Policy

1. Data Controller

Huwiyya (هوية) — Identity Verification Platform. Contact: WhatsApp +963939062915.

2. Data Collected

During an identity verification session, the following categories of data are collected and processed:

• Syrian National ID or Syrian Passport images (front and back where applicable)
• Selfie photograph(s) of the verification subject
• Guided liveness video recording
• OCR-extracted text fields (name, date of birth, document number, expiry, MRZ)
• Portrait extracted from document image
• AI inference outputs: face match similarity score, liveness score, fraud signal scores
• Model metadata: model name, model version, confidence score, inference timestamp
• Device metadata: device type, operating system, app version (mobile client)
• IP address and request timestamp
• Geographic location (optional, if permitted by partner policy)
• SHA-256 hash manifests of stored evidence files

3. Purpose of Processing

• Identity verification of natural persons for banking and regulated financial onboarding
• AI-assisted document classification, OCR, face match, and liveness detection
• Fraud signal analysis and sanctions screening
• Compliance with partner KYC obligations
• Audit trail and evidence retention for regulatory purposes
• Case management and manual review workflows

4. Self-Hosted AI Processing

All AI-assisted verification — including document classification, OCR enhancement, face matching, liveness analysis, presentation attack detection, and fraud signal extraction — is performed exclusively on infrastructure controlled by the platform operator or the deploying tenant. No verification images, biometric templates, OCR text, embeddings, or audit evidence are sent to third-party AI cloud services. AI inference services are accessible only over internal network paths.

5. Data Retention

Verification evidence and audit data are retained according to configurable tenant-specific retention policies, which must comply with applicable regulatory requirements for the Syrian banking sector. Evidence is never silently deleted. Deletion is policy-driven, audited, and logged.

6. Data Security

All evidence is encrypted at rest. All data in transit is protected by TLS. Object storage evidence is accessed only via time-limited signed URLs. SHA-256 hash manifests are maintained for chain-of-custody integrity. Access to evidence is logged and role-restricted.

7. Data Sharing

Personal data is not shared with third parties except: (a) with the partner institution that initiated the verification request, to the extent required to fulfil the verification outcome; (b) as required by applicable law or regulatory order. No biometric data is shared with external AI vendors.

8. Biometric Data

Biometric comparison scores, face embeddings, and liveness scores are treated as highly sensitive regulated data. They are stored only to the minimum extent required by audit policy, retained according to explicit policy settings, and accessible only to authorised reviewers and compliance roles.

9. Your Rights

• Right to access your stored verification data
• Right to rectification of inaccurate data
• Right to erasure, subject to applicable retention obligations
• Right to restriction of processing
• Right to data portability where technically feasible
• Right to withdraw consent where processing is consent-based

To exercise these rights, contact us via WhatsApp at +963939062915.

10. Cookies and Tracking

The Huwiyya platform does not use third-party advertising or analytics tracking cookies. Session management uses secure, server-side cookies for authentication purposes only.

11. Changes to this Policy

We reserve the right to update this Privacy Policy to reflect changes in legal requirements or platform capabilities. The current version is always available on this page.

12. Contact

For all privacy-related enquiries, contact us via WhatsApp: +963939062915.