Who we are and what this covers
KYCME operates KYCME.APP (“we”, “us”). This policy covers our website, mobile apps including test versions, customer accounts, document-text extraction and related support. App availability depends on the relevant store or testing program; this notice does not mean every planned feature is available.
We manage account, security and support data for our service. If a business uploads someone else’s document, that business is responsible for its authority, notices and use of the results; contact it as well as us about that record. We do not sell personal information or use uploaded identity documents for advertising.
Information we collect
- Account information: full name, email, company, business phone, verification status and account preferences.
- Authentication and security: password hashes if a password is set, passkey public credentials, session and verification records, device/browser information, IP-related security information and timestamps. We do not receive the fingerprint or face used by your device to unlock a passkey.
- Documents and results: front images and optional back images you upload, document category, extracted text and fields, processing status, uncertainty notes and related metadata. Images may contain portraits, names, document numbers, dates, addresses, signatures and other sensitive information.
- Service records: support messages, delivery records, administrative actions and technical/security logs.
Current uploads accept PNG and JPEG images, up to 5 MB per side. We do not offer camera capture, facial matching, liveness, fingerprint matching or sanctions screening in the current document module.
Why we use it
We use information to create and secure accounts, verify contact details, store submitted documents, run queued text extraction, display results, enforce limits, respond to support and privacy requests, prevent abuse and maintain the service.
Where applicable law requires a legal basis, the relevant purpose may rely on providing the service you request, consent, security and service-operation interests, or a legal obligation. Consent is not a substitute for an uploader having authority to submit another person’s document. We do not make automated eligibility, financial or identity-approval decisions from extraction results.
Automated document processing
When extraction is requested, we send document images, including personal information visible in them, to the processing service selected by KYCME: OpenAI API, Google Gemini API or Google Cloud Document AI (Document OCR). OpenAI and Gemini also receive extraction instructions. The service returns text for your review. Customers do not choose the provider or model. Document OCR is currently an administrator-selected option, including for authorized uploads into customer workspaces; it is not the default customer-upload service. We do not automatically send a failed request to another provider or automatically combine Document OCR with Gemini.
For OpenAI, we disable response storage (store: false). This does not mean zero retention: default abuse-monitoring retention may last up to 30 days, subject to documented safety and legal exceptions. See OpenAI’s API data controls.
We enable Gemini only for a project with active billing. Under Google’s paid-service terms, prompts and responses are not used to improve its products, but limited safety and abuse-monitoring logging and other provider retention may still apply. See Google’s Gemini API terms.
Our Document OCR integration uses Google Cloud Document AI’s online processing in the EU region. Front and back images may be combined into an in-memory document for processing. Google states that online document content is processed in memory without being saved to disk, that request metadata is temporarily logged, and that customer content is not used to train Document AI models. See Google’s Document AI data-handling information. This does not remove the copies stored by KYCME under the retention policy below, or mean that every provider record has zero retention.
Text extraction may make mistakes, especially in small or unclear text. It does not authenticate a document or verify a person. Review the output against the original. Existing queued requests keep their saved provider settings; a later settings change applies to new requests.
Where processing happens
KYCME operates from Erbil, Iraq. External providers may process information in other countries; we do not promise Iraq-only storage or processing. Applicable cross-border requirements and provider arrangements must be addressed for your use case. Contact us before submitting information subject to localization or other special restrictions.
Retention and deletion
Live documents and extracted results: the default retention is 30 days from upload. An administrator can change the period for new uploads. The upload form displays the applicable period and each record shows its expiry. A later settings change does not extend an existing record. Expired records become inaccessible; scheduled maintenance removes their images, results and associated processing records.
Encrypted database backups: copies are kept for 30 days from each snapshot, separately from live retention. A deleted or expired record may remain in a restricted backup for up to 30 additional days. Backups are for recovery, not routine access. Restored data must be checked for expired records and fulfilled deletion requests before access is reopened.
Accounts and operational information: the document expiry period does not automatically delete your account. Account details remain while the account is maintained, subject to a valid deletion request. Support, security and administrative records are kept as needed for their purpose and any applicable legal requirements; they do not all follow the document’s 30-day expiry.
Account deletion: use our Delete Account page to request removal of your profile, customer-owned documents/results and authentication records. We verify the request before acting. Limited deletion evidence and recovery-prevention markers may be retained to prevent restoring deleted accounts; de-identified administrative action history may remain. If a legal requirement prevents deletion of particular information, we will explain the applicable exception where permitted.
Provider-side retention is separate. Deleting locally cannot recall an extraction request already transmitted or erase independent copies held by a recipient. Contact us about a specific record or provider-related request.
Security and encryption
We use HTTPS for the public service and encrypted connections to our extraction provider. Stored KYC image content and extracted-result content are encrypted by the application, and database backup archives are encrypted. Access checks separate workspaces; passkeys, session controls and rate limits help protect accounts.
This is not end-to-end encryption. Authorized server processing and the extraction provider need access to readable document content. We do not claim that every database field or log is encrypted at rest: account contact details and operational metadata are not covered by the document-content encryption. Passwords are hashed rather than stored as readable passwords.
No service can guarantee absolute security. Report suspected unauthorized access to [email protected]. Never email passwords, OTPs, private keys or an identity-document copy unless a secure, necessary process has first been agreed.
Your choices and requests
Depending on applicable law, you may have rights to access, correct, delete, receive a copy of, restrict or object to processing, withdraw consent, or complain to a competent authority. Withdrawing permission for future extraction does not undo processing already carried out. You can choose not to upload a document.
Email [email protected] for privacy requests, including if you cannot sign in. We may request proportionate account-ownership confirmation, but will not ask for your password or OTP by email. We will explain next steps and any lawful limitation. See deletion instructions.
If your document belongs to another business’s or an administrator-owned workspace, deleting your own account does not remove that separate record. Identify the relevant record in your request without sending a new document copy; we will assess it and coordinate with the responsible organization where appropriate.
Children
The service is intended for adults and business users, not children. Do not create an account for a child or upload a child’s identity document through the current service. Contact us if you believe such information has been submitted so we can assess and address it.
Policy updates
We will update the effective date when this policy changes. Material changes to existing processing will receive additional notice and permission where required. Planned features are not treated as already active merely because development is underway.
Contact KYCME
Operator: KYCME, providing KYCME.APP.
Privacy and deletion requests: [email protected].
Floor 2, F26
Erbil, Kurdistan Region 44001
Iraq