Privacy Policy

Last updated 8 June 2026

This policy is a starting template. Before relying on it, have it reviewed by a qualified lawyer for your jurisdiction (for example Ghana's Data Protection Act, 2012 and the EU GDPR where it applies). Replace the placeholders below with your registered company details.

Kycaro (“Kycaro”, “we”, “us”) provides online identity verification (KYC). This policy explains what personal data we collect when you use kycaro.com, why we collect it, who we share it with, and the choices and rights you have.

Who we are

Kycaro is the controller of the personal data described here. You can reach us at hello@kycaro.com.

Data we collect

Account data — your name, email address and password (stored only as a secure hash).
Identity documents — images of the government-issued ID you upload (for example passport, national ID or driver's licence) and, where requested, a selfie image used for face matching.
Biometric data — facial features derived from your selfie and document photo, used solely to confirm they are the same person and that a live person is present.
Verification data — the platform code that identifies the service that referred you, and the verification status and result code we issue.
Payment data — payments are processed by Paystack. We receive a confirmation of payment; we never see or store your full card details.
Technical data — basic device, browser and log information needed to run and secure the service.

Why we use your data

To verify your identity and confirm you are a real, unique person.
To detect and prevent fraud, impersonation and money laundering.
To process your one-time payment for verification.
To share the outcome of your verification with the platform that referred you (see below).
To meet legal, regulatory and KYC/AML obligations.

Legal bases

Depending on the law that applies to you, we process your data on the basis of performing our contract with you, your consent (which you can withdraw), our legitimate interest in preventing fraud, and compliance with legal obligations.

Who we share it with

The referring platform — when your verification is approved, the platform that sent you to Kycaro can confirm your status using your email and your unique result code. We share the verification outcome, not your document images.
Paystack — to process payments.
Infrastructure providers — hosting and storage providers that run the service on our behalf.
Authorities — where we are legally required to disclose data.

We do not sell your personal data.

How long we keep it

We keep identity documents and verification records only as long as needed for the purpose above and to meet legal retention requirements, after which they are deleted. You can ask us to delete your data, subject to those requirements.

How we protect it

We encrypt data in transit, store uploaded documents privately (never in a public location) and serve them only to you or an authorised reviewer. See our Security page for details.

Your rights

Subject to local law, you may request access to your data, correction, deletion, restriction or a copy, and you may object to certain processing or withdraw consent. Contact hello@kycaro.com and we will respond within the time the law allows.

International transfers

Your data may be processed in countries other than your own. Where it is, we take steps to ensure it remains protected to the standard described here.

Children

Kycaro is not intended for anyone under 18, and we do not knowingly verify minors.

Changes

We may update this policy and will change the date above when we do. Material changes will be highlighted on this page.

Contact

Questions about your privacy? Email hello@kycaro.com.