Privacy Policy

Who we are

Netrik (“Netrik”, “we”) is a face verification service. This policy explains what we collect through netrik.online, the Netrik dashboard and the verification pages at verify.netrik.online, and what we do with it. Questions: hello@netrik.online.

We have two roles. For businesses that use Netrik (their dashboard accounts, billing and this website) we decide how data is used. For the people a business verifies (its players or customers), the business decides why and when they are verified, and we process their data only on its instructions, as its processor. If you were verified by one of our customers, that customer is your first point of contact for your data.

People being verified

When a business sends you to a Netrik check, your camera runs in your browser while you follow on-screen prompts (turn your head, blink). From that check we keep:

• a face template: numbers derived from your face, used to recognise you at your next check. It is encrypted with AES-256-GCM before it is stored;
• a small face photo from registration and from each check. Each photo is sealed with the business's own public key before it is stored, so only that business can open it. Netrik staff cannot view it;
• the result of each check: pass or fail, the reason, match, liveness and anti-spoof scores, an estimated age, the time, your IP address and browser details;
• the user ID the business assigned to you. We do not ask for your name, documents or contact details.

Face templates and photos are biometric data. We use them only to run checks for the business that asked for them. We never sell them, never use them to train or improve our models, and never use them to identify you across different businesses.

How long: photos taken at a check are deleted automatically after the period of the business's plan (Free 7 days, Starter 30 days, Growth 90 days, Scale 180 days). Your face template and registration photo are kept until the business removes you (it can at any time) or closes its Netrik account. Check results stay in the business's log while its account exists.

Businesses using Netrik

• Account: your work email, company name, and either a password (stored only as a salted scrypt hash) or your Google account ID if you sign in with Google. If you turn on two-factor sign-in, its secret is stored encrypted.
• Usage and billing: your plan, credit usage, checks run, settings such as webhook URLs and allowed origins, and the Ethereum wallet addresses and transaction IDs of USDT payments. Payments are made on the public Ethereum blockchain, which is visible to anyone and which we cannot change.
• Security: failed sign-in attempts and rate-limit counters, kept for a short time to stop abuse.

We use this to run your account, bill you, keep the service secure, and email you about your account. We keep it while your account is open, and delete it within 30 days of a request after the account is closed, except what we must keep for tax or legal reasons.

Sign in with Google

If you choose “Continue with Google”, Google tells us your email address, whether Google has verified it, and a Google account ID. We use them only to create your Netrik account and sign you in. We do not request access to your contacts, files, mail or any other Google data. Netrik's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Website visitors

netrik.online uses Cloudflare Web Analytics to count page views. It sets no cookies and does not track you across sites. Our servers keep standard request logs (IP address, time, page) for security, for a short time.

Where data is stored and who helps us

• DigitalOcean, Frankfurt, Germany: servers and database (accounts, encrypted face templates, check results).
• Amazon Web Services, Stockholm, Sweden: sealed face photos.
• Google: sign-in, when you choose it.
• Cloudflare: website analytics.
• Hostinger: our email.
• Alchemy: reading the Ethereum blockchain to confirm payments.

Each only receives what it needs to do its job. Where data leaves the EU/EEA, we rely on the provider's standard contractual clauses or an equivalent safeguard.

Security

All traffic uses HTTPS. Face templates are encrypted at rest, photos are sealed so that only the business holding the private key can open them, dashboard sign-in supports two-factor authentication, sensitive actions need re-confirmation, and the database accepts connections only from our own server.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your data, to object to or restrict its use, and to complain to your data protection authority. If you were verified by a business, ask that business first: it controls your data and can delete you at any time. We will help it respond. Businesses and anyone else can contact us at hello@netrik.online. We answer within 30 days.

Children

Netrik is a service for businesses, and our customers operate age-restricted services. It is not directed at children, and we do not knowingly collect data from anyone under 18 except where a business uses a check to estimate age.

Changes

If we change this policy we will update the date above, and tell businesses by email before a significant change takes effect.