Privacy Policy

Last updated: 10 July 2026

Veri5 is built to keep personal data off-chain. The verification ledger holds only cryptographic proofs — never document content or personal data — so records can be verified without exposing the information behind them.

This Privacy Policy explains how Hefes LLC ("Hefes", "we") handles personal data in connection with veri5.technology and the Veri5 Network. Individual applications (Passport, Notarization) provide additional, more specific privacy notices for their processing.

1. What We Collect

Account data (via Veri5 Passport): name, email, and/or mobile you provide, and a managed account identifier. Authentication is handled by Passport under its own privacy notice.
Content you submit to an application (e.g., a document you notarize). This is held encrypted, off-chain, under that application's terms — only its fingerprint (hash) is written to the ledger.
Usage & device data: basic logs (IP, timestamps, pages, user agent) for security, abuse-prevention, and reliability.
Payment data: processed by our payment provider (Stripe). We do not store full card numbers.

2. On-Ledger Data Discipline

By design, the Network records cryptographic proofs only. Document content and personal data are kept off-chain. Where an on-chain anchor is derived from personal data, it uses salted or keyed hashing, so the on-chain value cannot be reversed to the underlying data and an erasure request can be satisfied by destroying the off-chain material (Operating Charter Art. 3.4).

3. How We Use It

To provide, secure, and improve the Network and its applications;
To authenticate you and operate your account and any records you create or hold;
To prevent, detect, and investigate abuse, fraud, and unlawful use;
To comply with legal, regulatory, and supervisory obligations.

4. Sharing

We do not sell personal data. We share it only: with issuers and verifiers you choose to transact with (that is the purpose of a verifiable record); with service providers (e.g., hosting, payment) under contract; and with authorities where required or permitted by law. Verification of a record by a third party touches only the proof, not the underlying content, unless you disclose it via a share link.

5. Retention

Cryptographic proofs (fingerprint + timestamp) are, by nature of the ledger, permanent and do not contain personal data. Off-chain content and account data are retained only as long as needed for the service and legal obligations, and are then deleted or anonymized. Application-specific retention (e.g., a hosted document copy) is set out in that application's terms.

6. Your Rights

Depending on where you are, you may have rights to access, correct, delete, restrict, or port your personal data, and to object to certain processing. We honor rights under applicable law, including the GDPR (EU/EEA), PDPA (Malaysia), and PIPL (China, via the PRC Counterpart) (Operating Charter Art. 13.3). To exercise a right, contact [email protected]. Note that erasure applies to off-chain personal data; it cannot remove a content-free cryptographic proof, which contains no personal data.

7. International Transfers & Localization

Records domiciled to the People's Republic of China are homed on the PRC Counterpart with data localization; the Network holds only content-free cross-anchors (Operating Charter Art. 14). Other transfers are made under appropriate safeguards where required.

8. Cookies

We use only essential cookies for sign-in sessions and security. We do not use advertising cookies.

9. Contact

Privacy enquiries and rights requests: [email protected]. General legal: [email protected].

Note. This is a plain-language draft prepared for review by Hefes LLC and its advisers. It is not legal advice. A data-protection adviser should confirm the controller/processor mapping and lawful bases before final publication.