Privacy Policy.

Bynn as Controller. Bynn is the Controller of the Personal Data collected through the Website and the Product Websites, in providing Accounts on the Platform and billing for them, through meeting bookings, enquiries and other communications with Bynn, and in managing its relationships with customers, partners, suppliers and investors. Bynn Intelligence, Inc. is a Delaware corporation with its principal place of business at 2261 Market Street STE 22340, San Francisco, CA 94114, United States.

Bynn as Processor of Customer Data. When a Customer submits Personal Data to Bynn in connection with the Services, such as the files it sends for analysis or the data of the people it checks through the Platform, Bynn processes it as a Processor or service provider on behalf of the Customer, which is the Controller, under the Data Processing Addendum, which forms part of every Account and Order Form. The Customer's own privacy notice governs that data (Section 4). An individual whose Personal Data a Customer has submitted should contact that Customer; Bynn forwards any request it receives about such data to the Customer concerned.

Products with their own notices. ZOREAL and DecisionNode describe their processing in their own privacy notices, listed on the Product terms page: the ZOREAL Privacy Notice and the ZOREAL Biometric Data Privacy Notice, which cover identity verification, KYC, KYB, AML screening and ZOREAL's biometric checks wherever they are reached, the Bynn API included, and the DecisionNode Privacy Policy. Those notices govern the Products they cover, not this Policy. Agemin and Detector24 publish no notice of their own: this Policy covers their websites, the Accounts used with them and the checks run with them. PDFChecker is part of ZOREAL Verify and is governed by the ZOREAL Product Terms; until a ZOREAL notice covers it, this Policy covers pdfchecker.com, the Accounts used with it and the documents checked on it.

A business website. The Website, the Product Websites and the Platform are intended for businesses and public bodies, and for persons aged eighteen (18) or older acting on their behalf. The people a Customer checks with a Service, for example to estimate their age, may be younger; Section 10 explains how their data is handled.

Categories. Bynn collects the following categories of Personal Data:

Purposes and legal bases. Bynn uses Personal Data for the following purposes. Where the GDPR or the UK GDPR applies, Bynn relies on the legal basis stated for each purpose.

Legitimate interests. Where Bynn relies on its legitimate interests, it has balanced them against your interests and rights, and you may object as described in Section 11.

Sale and sharing. Bynn does not sell Personal Data for money, and never sells or shares Customer Data, including the data of the people a Customer checks. If you allow Marketing on the Website, the Google Ads tag, the Meta Pixel and the TikTok Pixel let Google, Meta and TikTok collect identifiers, such as cookie identifiers and your IP address, and information about your visit, such as the pages you view and the page that referred you, which they use for advertising, including to show you Bynn's advertising on other websites and services (Section 3.7). The advertising tags on the Product Websites (Section 12.2) let Google, Meta and Reddit collect the same kinds of Personal Data for the same purposes. Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the CCPA), making Personal Data available for cross-context behavioural advertising is sharing it, and Bynn treats this use of the tags as sharing; the CCPA and the laws of other states may also treat it as a sale, or as targeted advertising. In the twelve (12) months before this Policy was last updated, the categories of Personal Data shared in this way were identifiers and internet or other electronic network activity information, and the third parties they were shared with were advertising networks. Bynn has no actual knowledge of selling or sharing the Personal Data of consumers under sixteen (16) years of age. Section 11.2 explains how to opt out.

Automated decisions. Bynn makes no decision of its own about you based solely on automated processing that produces legal or similarly significant effects for you. When a Customer uses the Services to check your age or identity, or to support another decision about you, the Customer makes that decision as Controller and must give you the human review that Section 3 of the Acceptable Use Policy requires: for an age or identity check, a way to obtain review by a person, to contest the result and to use another method.

Website analytics: Google Analytics. If you allow Analytics in the cookie banner or the cookie settings, the Website uses Google Analytics to understand, in aggregate, how it is used: which pages are visited, how visitors arrive and move between pages, and which content helps them. Google Analytics then records the pages you view and the interactions it measures automatically, such as scrolling, clicks on links to other websites and file downloads, together with the page that referred you, the date and time of your visit, your browser, device, operating system, language and screen size, and an approximate location derived from your IP address, and keeps an identifier for your browser in the _ga cookies. Google Analytics does not log or store your IP address. The Website switches off Google signals and the use of this data to personalise advertising, so that Google Analytics does not associate your visit with a Google account or use it to personalise advertising. Google Analytics is provided by Google Ireland Limited and Google LLC (Google), which process this data on Bynn's behalf under Google's data processing terms. The cookies last as the Cookie Policy states, and Google keeps the event data linked to them for the retention period set for Bynn's Google Analytics property, no longer than fourteen (14) months, after which only aggregated reports remain. Nothing is sent to Google Analytics until you allow Analytics, and you may withdraw your consent at any time (Section 12.3).

Visit counts without cookies: Ahrefs Web Analytics. For every visit, the Website counts page views with Ahrefs Web Analytics, which Ahrefs Pte. Ltd., Singapore (Ahrefs), provides as Bynn's service provider. It sets no cookies and stores nothing in your browser. For each page view Ahrefs receives the address and title of the page, the page that referred you, and your browser's language and screen size, and, with the request, your IP address and your browser's user agent. Ahrefs derives from your IP address your location to the level of a city, and counts unique visitors with a pseudonymous identifier calculated each day from your IP address, your user agent and a random value that it replaces and deletes every twenty-four (24) hours, so that the identifier cannot be used to recognise you on a later day. Ahrefs does not store your IP address. Bynn uses the resulting statistics, which do not identify you, to know how many people visit the Website and which pages they read, on the basis of its legitimate interests (Article 6(1)(f)), and you may object as Section 11 describes.

Advertising measurement: Google Ads, Meta and TikTok. If you allow Marketing in the cookie banner or the cookie settings, the Website loads the Google Ads tag, the Meta Pixel and the TikTok Pixel to measure the performance of Bynn's advertising and to show Bynn's advertising again to people who have visited the Website. These tags record each page you view, the page that referred you, the date and time of your visit, your IP address, browser and device details, identifiers kept in cookies and browser storage on the Website and on the providers' own domains, and, if you arrived from one of Bynn's ads, the click on that ad, and send them to:

1. (a)(a) Google, through the Google Ads tag. The tag also sends your visit to the Google Analytics property linked to Bynn's Google Ads account, which Bynn uses to measure its advertising, with the _ga cookies described in Section 3.5 only if you have also allowed Analytics;
2. (b)(b) Meta Platforms Ireland Limited, and Meta Platforms, Inc. for visitors outside the European Economic Area and the United Kingdom (Meta), through the Meta Pixel; and
3. (c)(c) TikTok Technology Limited, Ireland, for visitors in the European Economic Area and the United Kingdom, and its affiliates elsewhere (TikTok), through the TikTok Pixel.

Meta and TikTok may link your visit to an account you hold with them. Bynn and each provider decide together on the collection of this data on the Website and its transmission to the provider, and each provider then processes the data it receives as an independent controller, for its own purposes as well, including to deliver and improve advertising, as its own privacy notice describes. For the Meta Pixel, Bynn and Meta Platforms Ireland Limited are joint controllers of that collection and transmission under Article 26 of the GDPR, on the terms of Meta's controller addendum: Bynn is responsible for informing you and obtaining your consent before the pixel loads, and Meta is responsible for its own processing of the data once received, including your rights in respect of that processing, and you may exercise your rights with Bynn or with Meta. The roles of Bynn and Google, and of Bynn and TikTok, follow the terms that each sets for its advertising tools. Nothing is sent to these providers until you allow Marketing, and if your browser sends a Global Privacy Control signal, Marketing stays off unless you switch it on in the cookie settings (Section 11.2). The cookies last as the Cookie Policy states, each provider keeps the data it receives as its own privacy notice describes, and you may withdraw your consent at any time (Section 12.3).

Support chat: Intercom. The chat button in the corner of each page of the Website is the Website's own. Intercom's messenger, which runs the chat, loads only when you click it: until then nothing is sent to Intercom and nothing of Intercom's is stored in your browser. When you open the chat, Intercom receives the messages you send, the contact details you give, your IP address, browser and device details and the page you are on, and keeps identifiers in your browser so that the chat can show your earlier conversations and stay open as you move between pages, as the Cookie Policy lists. Intercom, Inc. (Intercom) provides the chat as Bynn's service provider and hosts it in the United States. Bynn uses the chat to answer you, as steps at your request before entering into a contract, or to perform a contract, where you are or may become a customer (Article 6(1)(b)), and otherwise on the basis of its legitimate interest in answering the people who contact it (Article 6(1)(f)). Chats are kept as Section 6.5 provides.

On the Customer's instructions. Bynn processes Customer Data only to provide the Services, on the Customer's documented instructions, as Section 8 of the Terms of Use and the Data Processing Addendum provide.

Model improvement. Bynn uses Customer Data to develop, train or improve its Models only as Section 8.3 of the Terms of Use provides: where an Order Form or the applicable Product Terms permit it, and for Agemin, to improve its liveness detection with Training Captures unless the Customer has opted out (Section 5.4).

Retention and deletion. Customer Data is kept for the period the Customer sets, the Order Form or the Data Processing Addendum provides, and is then returned or deleted, as Section 8.8 of the Terms of Use provides.

People a Customer checks. When an organisation that is Bynn's Customer uses the Platform to check a person, for example to estimate or verify a person's age with Agemin, that organisation is the Controller and Bynn processes the person's data as its Processor. Where the check shows this Policy because the organisation has not set its own privacy notice, this Section and Section 5 describe Bynn's role: the organisation decides why and how the check is made, and requests about it go to the organisation, with Bynn's help as Section 11.4 describes.

What it is. In this Policy, Biometric Data means video and images of a person's face, and the facial landmarks, measurements, templates and other data derived from them. Bynn handles all Biometric Data as sensitive Personal Data, whether or not the law treats a particular use as such: under Article 9 of the GDPR, for example, it is special category data only where it is used to identify a person, which Agemin does not do. Bynn applies the rules of the biometric privacy laws, such as the Illinois Biometric Information Privacy Act and the Texas Capture or Use of Biometric Identifier Act, wherever they apply.

Where it is processed. Under this Policy, Biometric Data is processed:

1. (a)(a) in Agemin age checks that Customers run, to estimate a person's age from their face and to check that a live person, and not a photo, a screen or a mask, is in front of the camera;
2. (b)(b) in the age-estimation demo on agemin.com, for the same purposes, with Bynn as the organisation running the check; and
3. (c)(c) where a file submitted for analysis shows a person's face, only to produce the result requested, never to identify the person.

ZOREAL's identity verification and biometric checks are described in the ZOREAL Biometric Data Privacy Notice (Section 1.3).

Who decides. In an age check a Customer runs, the Customer is the Controller, gives the notice and obtains the consent that the law requires before the camera starts, and Bynn is its Processor under Section 4.5 of the Data Processing Addendum. In the demo, Bynn is the Controller.

Training Captures. When a person completes an Agemin age check, including the demo, Bynn keeps the video of the face capture, still frames taken from it, the facial landmarks measured on those frames, the sequence of colours shown on the screen during the check and details of the device and camera (a Training Capture), unless the organisation running the check has opted out of this use for its website. Bynn uses Training Captures only to develop, test and improve its liveness detection. It does not use them to identify anyone or for any other purpose, and does not sell, lease, trade or share them. A Customer may opt out for its website at any time by notice to privacy@bynn.com, and you may ask Bynn to delete a Training Capture of you, or object to this use, at the same address.

No sale and no advertising. Bynn does not sell, lease, trade or otherwise profit from Biometric Data, does not use it for advertising or marketing, and does not disclose it to a third party except to its Sub-processors under the Data Processing Addendum, or where the law requires it.

Retention and destruction. This Section is Bynn's written retention schedule for Biometric Data under this Policy. Biometric Data processed to return the result of a check is kept for the period the Customer sets or the Data Processing Addendum provides. Training Captures are kept while they are needed to develop, test and improve liveness detection. In every case Bynn permanently destroys Biometric Data when the purpose for which it was collected has been satisfied, and no later than three (3) years after the person's last interaction with Bynn, or a shorter period where the law of the person's place of residence requires it, unless a longer period is required by law or a legal hold, and then only the data so required and only for as long as required. Destruction means deletion from active systems and, within their rotation period, from backups.

Security. Bynn protects Biometric Data with at least the care it uses for its other confidential and sensitive information, as Section 7 describes, and restricts access to the personnel who need it for the purposes above.

Bookings, enquiries and communications. Meeting bookings, enquiries and communications are kept for as long as needed to respond, to follow up and to meet Bynn's legal obligations, and are then deleted, unless a business relationship follows, in which case Section 6.2 applies.

Business relationship data. Business relationship data is kept for the duration of the relationship and afterwards for as long as necessary to comply with legal obligations, resolve disputes and enforce Bynn's agreements. Billing and accounting records are kept for the period that tax and accounting law requires.

Website data. Website data recorded by our hosting is kept for as long as needed to operate and secure the Website, the Product Websites and the Platform, and is then deleted or aggregated. Cookie choices are kept as the Cookie Policy describes. On the Website, the cookies of Google Analytics and of the advertising tags last as the Cookie Policy states and are deleted from bynn.com when you withdraw your consent, and Google keeps the Google Analytics data linked to them as Section 3.5 provides. Ahrefs keeps no IP address and no identifier that lasts beyond the day, and Bynn keeps the resulting visit statistics, which do not identify you, for as long as they are useful to it. Data collected by the advertising tags on the Website is kept by Google, Meta and TikTok, and data collected by the advertising tags on the Product Websites by Google, Meta and Reddit, as their own privacy notices describe.

Account and billing data. Account data is kept while the Account is open and, after it is closed, for as long as necessary to meet legal obligations, resolve disputes and enforce Bynn's agreements. Billing records are kept for the period that tax and accounting law requires.

Files, demos and support chats. Files submitted on a Product Website without an Account are kept only for as long as needed to give you the result, to protect the service against abuse and to meet legal obligations, and are then deleted. Biometric Data from the age-estimation demo is kept as Section 5.6 provides. Support chats, on the Website and on the Product Websites, are kept for as long as needed to help you and to keep a record of the support given, and you may ask Bynn to delete yours at privacy@bynn.com.

Service providers. Bynn uses service providers in the following categories, each bound by a written agreement that requires it to protect Personal Data and to use it only to provide its services to Bynn: (a) cloud computing and hosting; (b) computing infrastructure for running Models; (c) email delivery and business communication tools; (d) payment processing (Stripe) and accounting; (e) customer support chat on the Website and the Product Websites (Intercom); and (f) measuring how the Website is used (Google Analytics and Ahrefs Web Analytics). Meeting bookings are handled by ZOREAL Book, which Bynn operates. The current list of Sub-processors is available to Customers on request at privacy@bynn.com.

Advertising and analytics providers. Through the advertising tags on the Website, once you allow Marketing, Google, Meta and TikTok receive the Personal Data that Section 3.7 describes, and through the tags on the Product Websites, Google, Meta and Reddit receive the Personal Data that Section 12.2 describes. They are not Bynn's service providers for that data: each uses it for its own purposes as well, including advertising, under its own privacy notice, and Bynn and each of them decide together on its collection and transmission, with the roles that Section 3.7 sets out for the Website.

Other recipients. Bynn may also disclose Personal Data (a) to its Affiliates, for the purposes in this Policy; (b) to its professional advisers, under a duty of confidentiality; (c) to courts, regulators, law enforcement or other authorities, where the law requires it or where necessary to protect the rights, property or safety of Bynn, its customers or others; (d) to a successor or acquirer in a merger, acquisition, financing or sale of all or part of Bynn's business, subject to this Policy; and (e) with your consent.

European Economic Area and United Kingdom. Where the GDPR or the UK GDPR applies, you have the right to access your Personal Data; to have it rectified; to have it erased; to restrict its processing; to receive it in a portable format; to object to processing based on legitimate interests, and at any time to direct marketing; to withdraw consent at any time, without affecting earlier processing; and to lodge a complaint with a supervisory authority, in particular in the country where you live or work, or with the Information Commissioner in the United Kingdom.

United States. Where a United States state privacy law applies, including the CCPA and the comprehensive privacy laws of other states, you may have the right to know what Personal Data Bynn collects and how it uses and discloses it; to access, correct and delete it; to receive it in a portable format; to opt out of its sale, of its sharing for cross-context behavioural advertising and of targeted advertising, which concern the advertising tags on the Website and on the Product Websites (Section 3.3); to limit the use of sensitive Personal Data, such as Biometric Data; to appeal a decision about your request; and not to be discriminated against for exercising any of these rights. You can opt out of sale, sharing and targeted advertising:

1. (a)(a) on the Website, by selecting "Reject all" in the cookie banner, or by switching Marketing off in the cookie settings, which the "Cookie settings" button at the foot of every page opens: the advertising tags then stop at once and are not loaded again in that browser;
2. (b)(b) on the Website, with a browser or extension that sends the Global Privacy Control signal, which Bynn treats as a valid request to opt out of sale and sharing for that browser: while the signal is on, the advertising tags do not load, even if you select "Accept all", and a choice to allow Marketing made before you turned the signal on is not applied, unless you switch Marketing on in the cookie settings while the signal is on; and
3. (c)(c) for the Product Websites, and for any other sale or sharing, by email to privacy@bynn.com with the words "Do not sell or share", or by blocking the tags' cookies in your browser.

You may use an authorised agent, who must provide proof of authority.

How to exercise your rights. Send your request to privacy@bynn.com. Bynn will verify your identity before acting on it, and responds within one (1) month where the GDPR or the UK GDPR applies, or within forty-five (45) days where a United States state law applies, extendable as those laws permit. To appeal a decision, reply to Bynn's response with the word "appeal"; if your appeal is refused, you may contact the attorney general of your state.

Requests about Customer Data. Where your request concerns Personal Data that a Customer submitted to Bynn, Bynn forwards it to that Customer, which decides how to respond, and assists the Customer as the Data Processing Addendum provides.

The Website. The Website uses cookies and browser storage in the four categories its cookie settings show: strictly necessary, analytics, marketing and support chat. Analytics (Google Analytics, Section 3.5) and marketing (the Google Ads tag, the Meta Pixel and the TikTok Pixel, Section 3.7) are used only with your consent, and none of those tags loads until you give it. The support chat stores its items only when you open it (Section 3.8). Ahrefs Web Analytics counts visits without cookies or browser storage (Section 3.6). The Cookie Policy lists each item, what it does and how long it lasts, and how to change your choices.

The Product Websites. The Product Websites use analytics and advertising tags: today Google Analytics and Google Ads (Google), the Meta Pixel (Meta) and the Reddit Pixel (Reddit), as well as the support chat. These tags record your visit, the pages you view and actions such as a sign-up, with your IP address, device details and identifiers kept in cookies, and send them to their providers, which use them to measure and target Bynn's advertising and for their own purposes, as Section 8.2 describes. On some Product Websites the tags load when a page opens, before you make any choice about cookies.

Your choices. On the Website, you can accept or reject analytics and marketing in the cookie banner, or choose category by category in the cookie settings. You may withdraw your consent at any time, without affecting the lawfulness of the processing before you withdrew it, through the "Cookie settings" button at the foot of every page of the Website. The Website then deletes the cookies and browser storage the tags of that category set on bynn.com and reloads the page you are on, so that those tags stop at once and are not loaded again, although it cannot delete cookies that the providers set on their own domains. You can also block or delete cookies in your browser settings, use the cookie settings of a Product Website where it offers them, and opt out of the sale or sharing of your Personal Data as Section 11.2 describes. Google, Meta, TikTok and Reddit also offer their own advertising controls.