Biometric Data Policy

Plain-language summary

Biometrics are optional. Face and voice protection are Executive-tier features that require your explicit, written consent before we collect anything. The rest of KnytX works without them.
We store math, not photos. Your face becomes a 512-number vector. Your voice becomes a 192-number vector. The original photos and audio are deleted immediately after we extract these embeddings.
The embeddings are encrypted with AES-256-GCM. The keys are held separately. Even our engineers can't read them in bulk.
We never sell or share biometric data. Not to advertisers, not to brokers, not to law enforcement except under a valid court order — and we will tell you if that happens unless legally gagged.
You can delete it all in one click. When you do, the embeddings are destroyed — not soft-deleted, not archived, not anonymized. Gone. We log the destruction so you can prove it happened.
If you downgrade or cancel, your biometrics are destroyed automatically within 7 days, even if you forget to ask.

Effective: 22 May 2026.

1. What this policy covers

This policy supplements the main KnytX Privacy Policy and applies specifically to biometric identifiers and biometric information collected through KnytX Executive-tier identity-protection features. Two categories of biometric data are in scope:

Facial embeddings — 512-dimensional numeric vectors derived from photos you upload during identity onboarding. We use them to detect social-media profiles that impersonate you.
Voiceprints — 192-dimensional numeric vectors derived from a voice sample you record during enrollment. We use them to detect AI voice clones used in scam calls and CEO-fraud attempts.

Both are treated as protected biometric data across the regimes we operate in:

Regime	Classification
Illinois BIPA	“biometric identifiers”
GDPR Article 9	“special category data”
CCPA §1798.140(ae)	“sensitive personal information”
Texas CUBI	“biometric identifiers”
Washington My Health My Data	“consumer health data” (when collected for impersonation defense)

Controller / Data Fiduciary: NCRYPTO Labs Private Limited, Bangalore, India. See Section 1 of the main privacy policy for full controller identification.

Lawful basis:

Regime	Basis
GDPR / UK GDPR	Article 9(2)(a) — explicit consent. Article 6(1)(a) — consent for the underlying processing.
DPDPA, 2023	§6 consent, with notice under §5. Treated as data of heightened sensitivity in our DPIA.
CCPA / CPRA	§1798.121 right-to-limit complied with by default; processing limited to the purposes you authorised.
BIPA (Illinois)	§15(b) written release obtained before collection.
Texas CUBI	§503.001 informed consent obtained before capture.
Washington My Health My Data	Affirmative, opt-in consent obtained before collection or sharing.

Consent capture: When you enroll a face or voice, we present the full consent text on-screen, you must tick an unticked box and click “I consent”, and we record:

the exact consent text shown (consent_text)
the consent version identifier (consent_version, e.g. biometric_v1 for face, voice_biometric_v1 for voice)
the timestamp (consented_at)
the IP address from which consent was given
the user account that gave consent

This record persists even after you revoke consent, because BIPA §15(a) and GDPR Article 7(1) require us to be able to demonstrate that consent was given.

2a. BIPA §15(b) written-release requirement

Illinois law (740 ILCS 14/15(b)) prohibits any private entity from collecting, capturing, or otherwise obtaining a person’s biometric identifier or biometric information unless it first:

Informs the individual in writing that biometric data is being collected or stored;
Informs the individual in writing of the specific purpose and length of term for which the biometric data is being collected, stored, and used; and
Receives a written release executed by the individual.

KnytX satisfies these requirements as follows:

Disclosure of collection (§15(b)(1)). The enrollment consent screen states plainly: “KnytX will derive a numeric facial embedding (512 numbers) / voiceprint embedding (192 numbers) from the material you upload. This is biometric data under Illinois BIPA and similar laws.”

Purpose and retention disclosure (§15(b)(2)). The same screen states:

Purpose: Detection of social-media profiles impersonating you (face) / detection of AI voice clones (voice).
Retention: Your biometric data is retained for the duration of your Executive-tier subscription, or until you revoke consent, whichever is earlier. Automatic deletion occurs within 7 days of plan downgrade, subscription cancellation, or consent revocation. Retention never exceeds 3 years — BIPA §15(a)’s statutory maximum. The full trigger table is in Section 6.

Written release (§15(b)(3)). The enrollment flow requires three steps: (i) read the full disclosure text presented on-screen, (ii) tick an unticked checkbox labelled “I have read and agree to the biometric data disclosure above”, and (iii) click the “I consent” button. This interaction is recorded with the data elements set out in Section 2 above. It constitutes the written release required by §15(b)(3). Electronic consent satisfies Illinois law under 5 ILCS 175/5-120.

Illinois residents may request a copy of their written-release record by emailing legal@knytx.com with subject line “BIPA §15(b) record request”.

3. What we collect and what we do not

We collect:

2 to 3 reference photos (face enrollment), processed on our EU servers, then deleted within seconds of embedding extraction
One short voice sample (voice enrollment), processed on our EU servers, then deleted within seconds of embedding extraction
The resulting embeddings (encrypted at rest)
The cryptographic hash of each original input (for deduplication only — the hash is not reversible)

We do not collect, derive, or store:

Raw photos or audio after embeddings have been extracted
Any embedding of a person who has not personally enrolled and consented
Embeddings of minors. Family-plan minors do not receive biometric enrollment; this is enforced in code.
Faceprints of bystanders captured in your reference photo (we reject photos containing more than one detectable face)
Health, ethnicity, age, gender, or any demographic inference from your biometrics. We do not run such models.

4. How embeddings are protected

In short: embeddings are made and stored on our own EU infrastructure, encrypted with per-customer keys. No cloud biometric API sees your raw data, and nobody can decrypt embeddings in bulk from the app.

Local extraction. Embeddings are generated by an ONNX model (ArcFace for face, ECAPA-TDNN for voice) running on our own infrastructure in the EU. No cloud biometric API touches your raw data.
Encryption. Each embedding is encrypted with AES-256-GCM using a per-tenant key. The key is held in a separate key-management service and is rotated on a documented schedule.
Access control. Bulk decryption of embeddings is not possible from the application layer. A break-glass procedure exists for incident response; every break-glass event is logged and reviewed.
No transit outside the EU. Facial and voice embeddings are stored exclusively on our own infrastructure in the Frankfurt data region, inside the European Union. Cross-border replication for disaster recovery uses the same encryption and stays within EU-adequate jurisdictions.

5. Purposes — and only these purposes

In short: we use your biometrics only to spot impersonators, catch voice clones, and verify content you send us. Never for login, advertising, or model training.

Biometric embeddings are used only for:

Impersonation detection. Comparing your facial embedding against profile photos discovered by our impersonation scanner on social platforms, returning candidates with a similarity score for your manual confirmation.
Voice-clone detection. Comparing an inbound voice sample (one you ask us to verify) against your enrolled voiceprint, and against generative-audio artifacts.
Deepfake verification on demand. When you upload a suspicious image or audio for verification, we compare it against your own enrolled biometrics to answer “is this really you?”

Biometrics are never used for:

Authentication or login (we use OIDC + passwords, not face/voice)
Advertising, profiling, or any commercial purpose other than the protection service you paid for
Training of any generalised model. Our face and voice models are pre-trained on publicly licensed datasets and are not fine-tuned on customer data.
Sharing with any third party, including data brokers, advertisers, government agencies (except under compelled legal process), or affiliated companies.

6. Retention and irrevocable destruction

In short: delete it yourself any time. We also delete it automatically within 7 days of a downgrade or cancellation. Destruction is permanent — the key is destroyed and the data is overwritten, with no backup that survives.

Trigger	What happens	Timeline
You click “Delete biometric data”	All embeddings destroyed; consent record marked revoked; detected-profile cache cleared	Immediate; confirmation event logged within 24h
You downgrade below Executive tier	Automatic deletion job destroys embeddings	Within 7 days of downgrade
You cancel your subscription	Automatic deletion of embeddings, plus all other data per main privacy policy	Within 30 days; biometrics within 7
You revoke consent without cancelling	Embeddings destroyed; affected features disabled	Immediate
Account inactivity > 24 months	Embeddings auto-purged ahead of broader account-data deletion	Within 12 months of trigger

“Destruction” means cryptographic shredding: the per-tenant encryption key is destroyed and the ciphertext is overwritten. There is no soft-delete, no archive copy, no analytics export, no backup that survives. Destruction is logged with timestamp and operator (or system job) identity for audit.

This commitment satisfies BIPA §15(a) (“permanently destroy” within statutory schedule), GDPR Article 17, DPDPA §13, CCPA §1798.105(c), Texas CUBI §503.001(c-1), and Washington My Health My Data §10.

7. Your rights

In addition to the rights in the main privacy policy, you have these biometric-specific rights:

Right to refuse. You can use every non-Executive KnytX feature without enrolling biometrics. Executive without face/voice enrollment is supported — name-only impersonation scanning remains available.
Right to withdraw consent at any time. Use the “Delete biometric data” control in your account, or email legal@knytx.com. Withdrawal is effective on receipt; we do not require a reason.
Right to a deletion certificate. On request, we will provide a signed certificate stating which embeddings existed, when they were destroyed, and the destruction method.
Right to know. You can ask what biometric data we hold. We will respond with the categories, retention period, and current encryption status. We do not reveal the encrypted vector itself, which would defeat the purpose.
Right not to be retaliated against. Withdrawing biometric consent does not affect your subscription, pricing, or access to non-biometric features.
BIPA statutory damages (Illinois residents). Under BIPA, individuals may be entitled to statutory damages of $1,000–$5,000 per violation for improper biometric data collection or disclosure. This is a disclosure of your legal rights, not a legal representation by KnytX.

8. Children

We do not collect biometric data from anyone under 18. The Executive tier is not sold to minors. Family-plan minor accounts are blocked from biometric enrollment in code. If you believe a minor’s biometric data has been collected, contact legal@knytx.com immediately and we will destroy it within 24 hours.

9. Disclosures and government requests

We will not voluntarily disclose biometric data to any government or law-enforcement agency. We may be compelled by a valid court order, in which case:

We will challenge requests that appear overbroad, jurisdictionally improper, or that target a category of users rather than a named individual.
We will notify the affected user unless we are legally prohibited from doing so.
Disclosures are logged and counted in our annual transparency report.

We do not voluntarily share biometric data with NCRYPTO Labs sister entities (Stalten, XRTE) or with KnytX commercial partners.

10. Changes to this policy

Sometimes we change the scope of biometric processing — for example, by introducing a new model, a new use case, or a new sub-processor. When we do, we obtain fresh consent before processing your existing biometric data under the new terms. Your prior consent does not roll forward silently. Material changes are notified by email at least 30 days before they take effect; you may delete your biometrics before the change without penalty.

11. Data Protection Impact Assessment

GDPR Article 35 requires a DPIA for large-scale processing of special-category data. We have completed a DPIA covering facial-embedding and voiceprint processing. A redacted summary is available on request at legal@knytx.com; the unredacted version is shared with supervisory authorities on request.

12. Contact

Biometric-specific questions: legal@knytx.com, subject line “Biometric Policy”.

For the standing controller details, postal address, and supervisory-authority routing, see Section 12 of the main Privacy Policy.