Quick answer:
A verification is archived within 60 minutes of the PDF report being downloaded, or 7 days after it's available if no one downloads it. When it's archived, all personal data is deleted from the portal except the phone number, assets, and your client's initials.
After that, only the phone number and IP address remain, for auditing. We also keep some non-personal data for reporting.
This guide is for APLYiD Core (support.aplyid.com).
What we collect when a verification is created
When a new Biometric Verification case is created on the APLYiD verification portal the following data, including some Personal Identifiable Information (PII) is captured:
The company name that created the case along with the Initiator of that case
The phone number the SMS is to be sent to
First name & Last name of the SMS recipient (if entered)
Reference number (if entered)
What we collect when your client does the verification
When the recipient begins the verification process, further data including more PII is captured:
Assets: Self-captured photo and video (and video thumbnail)
Pictures of scanned identity document i.e. passport or driver license
IP address of mobile device that used the link
Any data captured via OCR (Optical Character Recognition) from the scanned document such as:
First Name
Middle Name
Last Name
Date of birth
Address
Passport Number or Driver License number & version
Country of issue
Country of residence
When a verification is archived
When the background check/s finish, the Verification report becomes available on the portal for download. Once the PDF report has been downloaded by the user, the system will archive the check within 60 minutes of that download and mark it as ‘Completed’ on the portal.
If not downloaded by the user, the data is available on the portal for 7 days before being marked as ‘Completed’ and archived.
Processes run on the portal run every 5 minutes checking for and archiving any eligible verification checks.
What happens to the data once it's archived
When a Verification check is marked as ‘Completed’ and archived, all personal data is deleted from the portal leaving only the Phone Number, Assets, and IP address as well as the first letter of the First name plus the number of letters in that name e.g. John would be J*** and the first letter of the Last name plus the number of letters in that name, so Smith would be S****.
This data is held for 3 further days to assist with any necessary investigations before the Assets are deleted. No further investigation is possible after this 3-day period.
You can’t see your client’s photos or video once the check is archived, and APLYiD Support can’t retrieve them for you during these 3 days either.
This leaves only the phone number the SMS was sent to (note: the mobile number doesn’t show on the archived page but will return results from the search bar) and the IP address used by the recipient’s mobile device when they clicked on the link. This remains on the system for auditing only i.e. for the purpose of showing the original text was sent and the link contained in that text was clicked on.
Data we keep for reporting
We also retain extra non-PII data for reporting purposes:
Overall pass/fail
Liveness pass/fail
Face Match pass/fail
Device type & OS
Browser
ISP
VPN used (true/false)
Country
Timestamps
Age (at time of completion)
Time spent on each screen of flow
IP address
GPS latitude/longitude
SMS provider, status (delivered/undelivered) & destination country
This allows us to report on aggregated statistics from the site e.g. 95% of SMS were delivered, or 75% used Chrome browser, or the median age was 38.