Identity Verification and Biometric Data Policy

How we verify your identity, who sees that data, and how we protect it.

Last updated: June 12, 2026

Identity verification is the most sensitive data processing VAKA does, which is why it has its own document. Here we explain with complete clarity what we ask of you, why, who can see your images, where they are stored, how long they are kept, and what happens if you decide not to verify yourself or to withdraw your consent. This document is part of the Privacy Policy and complements it in everything related to identity and biometrics.

1. Why we verify identity

At VAKA one neighbor entrusts another with a valuable item. That trust needs a real foundation: knowing that behind every account there is a real person, with a real document, who is who they say they are. Identity verification serves three purposes, and only those three:

Community safety: confirming that each account belongs to a real, identifiable person.
Fraud prevention: making it harder to create fake, duplicate, or stolen accounts, and to impersonate identities — a central part of the Anti-Fraud Policy.
Compliance: meeting customer due diligence and unlawful-activity prevention obligations when applicable law requires it.

We do not use your identity data for any other purpose: not marketing, not advertising, not commercial profiling.

2. When we ask you to verify

You can sign up and explore VAKA without verifying your identity. Verification becomes necessary for actions that involve trusting or receiving items:

Listing items to rent.
Completing rentals above the limits of the unverified tier.
Specific cases where our security signals require confirming that the account belongs to its holder.

The current trust tiers and what each one unlocks are explained in Verification.

3. What data we request

A photo of your official identity document (national ID card or passport). The document contains personal data such as your full name, document number, date of birth, photograph and, depending on the country, other data printed on it.
Selfie: a photo of your face taken in the moment, from your device's camera, to compare it with the photograph on the document.

We ask you for nothing more than that. We do not request fingerprints, voice recordings, or other biometric data.

4. This is biometric data processing

Comparing your face (in the selfie) with the photograph on your document constitutes biometric data processing: data derived from your physical features that uniquely identify you. It is the most protected data category under data protection laws, and we treat it as such:

Only with your express consent. Verification never happens silently: you decide to start it and you capture the images yourself. If you do not consent, verification simply does not take place.
With limited purpose: safety, fraud prevention, and compliance — the three purposes from section 1, and no others.
With limited retention: see section 7.
With the right to revoke: see section 8.

We also commit to something we consider basic: we do not use your images or your biometric data to train artificial intelligence models, nor do we hand them over to third parties to do so.

5. How verification works today

We want to be precise about the current state of the process, because a privacy policy is only useful if it describes reality:

You capture the two images (document and selfie) from the app or the web. They are transmitted encrypted to our systems.
The images are stored securely for review in a private repository within our storage infrastructure (Supabase Storage). They are not accessible by public link: they can only be accessed through signed links with temporary validity.
An authorized person from the VAKA team reviews the images and approves or rejects the verification. Each decision is recorded in an audit log: who reviewed, when, and with what result.
If the verification is approved, your account gets verified status. If it is rejected, the images are unlinked from your profile, we notify you of the reason, and you can try again with new captures.

Other neighbors never see your document, your selfie, or your identity data: the only thing visible to the community is the verification badge on your profile, which indicates the status and nothing more.

6. When we activate a specialized provider (Didit)

We plan to bring in Didit, a provider specialized in identity verification, to automate and reinforce the process: document reading, liveness check (confirming that the selfie is of a present person and not a photo of a photo), and automated facial comparison.

When that happens, Didit will process your images on behalf of VAKA, as a processor under contract, and VAKA will receive the verification result. The verification flow will clearly indicate when an external provider participates, and this policy will be updated to reflect the change. This policy covers both states — today's internal review and tomorrow's verification with a specialized provider — and in both the same guarantees apply: express consent, limited purpose, limited retention, and the right to revoke.

7. How long we keep your identity data

The images (document and selfie): are kept securely for a limited period, defined according to each country's legal obligations and the need to be able to audit verifications in the event of disputes or fraud. We will publish the specific period in this policy when we enable operations in each country.
The verification result (verified or not, dates and decisions): is kept while your account exists, because it is the basis of your trust level on the platform.
If the verification is rejected: the rejected images are unlinked from your profile and the process starts over; they are not used for anything else.
If you delete your account: your identity data is deleted along with the rest of your information, in accordance with the process and exceptions described in the retention section of the Privacy Policy.

8. Your consent and how to revoke it

The basis that enables us to process your biometric data is your express consent. That means you can withdraw it at any time, and we want you to know exactly what that involves:

How to revoke: write to us at soporte@vakaland.com from your account email or use Contact, indicating that you are withdrawing your identity verification consent. You can also delete your account, which removes your identity data along with it.
The consequence, with no fine print: upon revoking, your account loses verified status. That means you will not be able to list items or complete rentals that require verification, until you decide to verify yourself again. Rentals already in progress are completed as normal.
What revocation does not erase: the records we must keep due to legal obligation or due to an active dispute or fraud investigation, in accordance with the Privacy Policy.

In addition to the right to revoke, you have over this data the same rights as over the rest: access, rectification, deletion, and complaint to your country's authority. How to exercise them is in the rights section of the Privacy Policy.

9. Who can access your identity data

Authorized VAKA staff: only to review your verification or investigate a fraud or security case, with restricted access, reinforced authentication, and an audit log.
Processors: our storage infrastructure (Supabase) and, when active, Didit as a verification provider — both under contract and only for the purposes of this policy.
Authorities: only upon a valid legal request.
No one else. Never other neighbors, never advertisers, never third parties for commercial purposes. We do not sell or hand over identity data.

10. Security specific to this data

Encrypted transmission (TLS) from your device.
Storage in a private repository, with no access via public URL; internal access uses signed links that expire.
Access limited to authorized staff with reinforced authentication.
Audit log of every administrative access and every verification decision.

The platform's general security measures are in the Privacy Policy and in Safety.

11. Minors

VAKA is for people over 18. We do not accept minors' identity documents and we reject any verification whose document indicates that the person is a minor; in that case the account is deleted in accordance with the Terms of Service.

12. Applicable law by country

The data protection legal framework of each country — including the special rules for biometric data where they exist — is that of the Country Annex of the Privacy Policy. Each block is completed and updated as VAKA enables operations in each country; where local law imposes additional requirements for biometrics (for example, reinforced consent or registration of the processing), we will comply with them and reflect them here.

13. Contact

For questions or requests about your verification or your identity data: soporte@vakaland.com or the Contact. To understand the trust tiers and what each one unlocks: Verification.

Identity Verification and Biometric Data Policy

How we verify your identity, who sees that data, and how we protect it.

Last updated: June 12, 2026

1. Why we verify identity

Community safety: confirming that each account belongs to a real, identifiable person.
Fraud prevention: making it harder to create fake, duplicate, or stolen accounts, and to impersonate identities — a central part of the Anti-Fraud Policy.
Compliance: meeting customer due diligence and unlawful-activity prevention obligations when applicable law requires it.

We do not use your identity data for any other purpose: not marketing, not advertising, not commercial profiling.

2. When we ask you to verify

You can sign up and explore VAKA without verifying your identity. Verification becomes necessary for actions that involve trusting or receiving items:

Listing items to rent.
Completing rentals above the limits of the unverified tier.
Specific cases where our security signals require confirming that the account belongs to its holder.

The current trust tiers and what each one unlocks are explained in Verification.

3. What data we request

A photo of your official identity document (national ID card or passport). The document contains personal data such as your full name, document number, date of birth, photograph and, depending on the country, other data printed on it.
Selfie: a photo of your face taken in the moment, from your device's camera, to compare it with the photograph on the document.

We ask you for nothing more than that. We do not request fingerprints, voice recordings, or other biometric data.

4. This is biometric data processing

Only with your express consent. Verification never happens silently: you decide to start it and you capture the images yourself. If you do not consent, verification simply does not take place.
With limited purpose: safety, fraud prevention, and compliance — the three purposes from section 1, and no others.
With limited retention: see section 7.
With the right to revoke: see section 8.

We also commit to something we consider basic: we do not use your images or your biometric data to train artificial intelligence models, nor do we hand them over to third parties to do so.

5. How verification works today

We want to be precise about the current state of the process, because a privacy policy is only useful if it describes reality:

You capture the two images (document and selfie) from the app or the web. They are transmitted encrypted to our systems.
The images are stored securely for review in a private repository within our storage infrastructure (Supabase Storage). They are not accessible by public link: they can only be accessed through signed links with temporary validity.
An authorized person from the VAKA team reviews the images and approves or rejects the verification. Each decision is recorded in an audit log: who reviewed, when, and with what result.
If the verification is approved, your account gets verified status. If it is rejected, the images are unlinked from your profile, we notify you of the reason, and you can try again with new captures.

6. When we activate a specialized provider (Didit)

7. How long we keep your identity data

The images (document and selfie): are kept securely for a limited period, defined according to each country's legal obligations and the need to be able to audit verifications in the event of disputes or fraud. We will publish the specific period in this policy when we enable operations in each country.
The verification result (verified or not, dates and decisions): is kept while your account exists, because it is the basis of your trust level on the platform.
If the verification is rejected: the rejected images are unlinked from your profile and the process starts over; they are not used for anything else.
If you delete your account: your identity data is deleted along with the rest of your information, in accordance with the process and exceptions described in the retention section of the Privacy Policy.

8. Your consent and how to revoke it

The basis that enables us to process your biometric data is your express consent. That means you can withdraw it at any time, and we want you to know exactly what that involves:

How to revoke: write to us at soporte@vakaland.com from your account email or use Contact, indicating that you are withdrawing your identity verification consent. You can also delete your account, which removes your identity data along with it.
The consequence, with no fine print: upon revoking, your account loses verified status. That means you will not be able to list items or complete rentals that require verification, until you decide to verify yourself again. Rentals already in progress are completed as normal.
What revocation does not erase: the records we must keep due to legal obligation or due to an active dispute or fraud investigation, in accordance with the Privacy Policy.

9. Who can access your identity data

Authorized VAKA staff: only to review your verification or investigate a fraud or security case, with restricted access, reinforced authentication, and an audit log.
Processors: our storage infrastructure (Supabase) and, when active, Didit as a verification provider — both under contract and only for the purposes of this policy.
Authorities: only upon a valid legal request.
No one else. Never other neighbors, never advertisers, never third parties for commercial purposes. We do not sell or hand over identity data.

10. Security specific to this data

Encrypted transmission (TLS) from your device.
Storage in a private repository, with no access via public URL; internal access uses signed links that expire.
Access limited to authorized staff with reinforced authentication.
Audit log of every administrative access and every verification decision.

The platform's general security measures are in the Privacy Policy and in Safety.

11. Minors

12. Applicable law by country

13. Contact

For questions or requests about your verification or your identity data: soporte@vakaland.com or the Contact. To understand the trust tiers and what each one unlocks: Verification.

1. Why we verify identity

Community safety: confirming that each account belongs to a real, identifiable person.
Fraud prevention: making it harder to create fake, duplicate, or stolen accounts, and to impersonate identities — a central part of the Anti-Fraud Policy.
Compliance: meeting customer due diligence and unlawful-activity prevention obligations when applicable law requires it.

We do not use your identity data for any other purpose: not marketing, not advertising, not commercial profiling.

2. When we ask you to verify

You can sign up and explore VAKA without verifying your identity. Verification becomes necessary for actions that involve trusting or receiving items:

Listing items to rent.
Completing rentals above the limits of the unverified tier.
Specific cases where our security signals require confirming that the account belongs to its holder.

The current trust tiers and what each one unlocks are explained in Verification.

3. What data we request

A photo of your official identity document (national ID card or passport). The document contains personal data such as your full name, document number, date of birth, photograph and, depending on the country, other data printed on it.
Selfie: a photo of your face taken in the moment, from your device's camera, to compare it with the photograph on the document.

We ask you for nothing more than that. We do not request fingerprints, voice recordings, or other biometric data.

4. This is biometric data processing

Only with your express consent. Verification never happens silently: you decide to start it and you capture the images yourself. If you do not consent, verification simply does not take place.
With limited purpose: safety, fraud prevention, and compliance — the three purposes from section 1, and no others.
With limited retention: see section 7.
With the right to revoke: see section 8.

We also commit to something we consider basic: we do not use your images or your biometric data to train artificial intelligence models, nor do we hand them over to third parties to do so.

5. How verification works today

We want to be precise about the current state of the process, because a privacy policy is only useful if it describes reality:

You capture the two images (document and selfie) from the app or the web. They are transmitted encrypted to our systems.
The images are stored securely for review in a private repository within our storage infrastructure (Supabase Storage). They are not accessible by public link: they can only be accessed through signed links with temporary validity.
An authorized person from the VAKA team reviews the images and approves or rejects the verification. Each decision is recorded in an audit log: who reviewed, when, and with what result.
If the verification is approved, your account gets verified status. If it is rejected, the images are unlinked from your profile, we notify you of the reason, and you can try again with new captures.

6. When we activate a specialized provider (Didit)

7. How long we keep your identity data

The images (document and selfie): are kept securely for a limited period, defined according to each country's legal obligations and the need to be able to audit verifications in the event of disputes or fraud. We will publish the specific period in this policy when we enable operations in each country.
The verification result (verified or not, dates and decisions): is kept while your account exists, because it is the basis of your trust level on the platform.
If the verification is rejected: the rejected images are unlinked from your profile and the process starts over; they are not used for anything else.
If you delete your account: your identity data is deleted along with the rest of your information, in accordance with the process and exceptions described in the retention section of the Privacy Policy.

8. Your consent and how to revoke it

The basis that enables us to process your biometric data is your express consent. That means you can withdraw it at any time, and we want you to know exactly what that involves:

How to revoke: write to us at soporte@vakaland.com from your account email or use Contact, indicating that you are withdrawing your identity verification consent. You can also delete your account, which removes your identity data along with it.
The consequence, with no fine print: upon revoking, your account loses verified status. That means you will not be able to list items or complete rentals that require verification, until you decide to verify yourself again. Rentals already in progress are completed as normal.
What revocation does not erase: the records we must keep due to legal obligation or due to an active dispute or fraud investigation, in accordance with the Privacy Policy.

9. Who can access your identity data

Authorized VAKA staff: only to review your verification or investigate a fraud or security case, with restricted access, reinforced authentication, and an audit log.
Processors: our storage infrastructure (Supabase) and, when active, Didit as a verification provider — both under contract and only for the purposes of this policy.
Authorities: only upon a valid legal request.
No one else. Never other neighbors, never advertisers, never third parties for commercial purposes. We do not sell or hand over identity data.

10. Security specific to this data

Encrypted transmission (TLS) from your device.
Storage in a private repository, with no access via public URL; internal access uses signed links that expire.
Access limited to authorized staff with reinforced authentication.
Audit log of every administrative access and every verification decision.

The platform's general security measures are in the Privacy Policy and in Safety.

11. Minors

12. Applicable law by country

13. Contact

For questions or requests about your verification or your identity data: soporte@vakaland.com or the Contact. To understand the trust tiers and what each one unlocks: Verification.