Version 2026-11-03. This notice explains how Zoi ID handles your personal data when you verify your identity. Zoi ID is a service of ZOI LABS LLC. Please read it before you start. You can stop at any time.
1. Who we are
Controller. ZOI LABS LLC, a Wyoming limited liability company (filing ID 2026-002079687), registered address 30 N Gould St Ste N, Sheridan, WY 82801, USA; main office 26 Broadway, Suite 934, New York, NY 10004, USA.
When you verify for the Zoi app (in the app or on our web page), ZOI LABS LLC is the controller of your data. When you verify for another company's app or website that uses Zoi ID, that company is the controller and we process your data on its behalf and only on its instructions. Its own privacy notice applies too.
Contact for privacy questions and requests: support@zoi.network (subject "Zoi ID privacy"). Representatives and local contacts, where the law asks for them, are listed in section 14.
2. What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Document data: name (also in the document's own script), date of birth, sex, nationality, document type, issuing country, document number, expiry date | the chip of your document, or photos of it | to confirm who you are |
| Photos of your document (front, and back when needed) | your camera | to check the document; a person may look at it |
| Data from the document chip (the files the issuing government signed, including the photo stored on the chip) | your phone's NFC reader | to prove the document is genuine and unchanged |
| A short video of your face while you turn your head, from when the camera opens until shortly after the last movement, and still frames from it | your front camera | to check that a real person is present, and to compare your face with the document photo |
| A short video recorded while you take each document photo, from when the camera opens until shortly after the photo (at most the last 30 seconds before it) | your camera | to check that the document is real and physically in front of the camera, that the photo was not replaced, and that no one else takes part |
| Country of residence (and address, only if the app that sent you asks for it) | you | for the rules of your country |
| Proof of address, only if the app that sent you asks for it: the document you send (for example a bank statement, a utility bill, or a tax or government letter, as a PDF, a photo or a file) and images of its pages; what we read from it (type of document, date, who issued it, the name and the address on it); for a digitally signed PDF, who signed it and when; technical details of the file (the software that made it, its dates and later changes); an official verification code printed on it; the address you confirm; keyed fingerprints of the file and of its signature (they cannot be turned back into the document) | you, or your digital ID or ID document when it already shows your address | to confirm where you live, for the anti-money-laundering checks of the app that sent you, and to stop the same document from being used for another account |
| Your device's time zone and language setting, compared with the country of your address (only with proof of address) | your device | to notice when something does not fit; a person then looks at the case |
| Source of funds or source of wealth, only if the app that sent you asks for it: your answers (employment status, job, employer or business name, yearly income range, where your money comes from, for example salary, business, savings, sale of assets, inheritance, investment, crypto or pension, with a short note for "other", the amount you expect to move each month with the app as a range, and for source of wealth your total wealth as a range and how you built it); only if the app also asks for documents: up to 5 documents you send (for example a payslip, an employment letter, a tax return, a bank, investment, crypto or pension statement, or a document about a sale, an inheritance or a company, as a PDF or a photo) and images of their pages; what we read from them (type of document, date, who issued it, the name on it, the employer, the main amount and its currency); for a digitally signed PDF, who signed it and when; technical details of the file; keyed fingerprints of each file and of its signature (they cannot be turned back into the document) | you | for the anti-money-laundering checks of the app that sent you (enhanced due diligence), and to stop the same document from being used by other people |
| Your answers to two questions: are you a politically exposed person, and are you acting for yourself | you | required checks against financial crime |
| Device check results (in the app only): a yes/no from Google Play Integrity or Apple App Attest, and a security key the app makes on your phone for this check (we keep only its public part), with your phone's answer on how the key is protected and whether the phone's system is locked and unmodified | your phone's operating system | to make sure the photos and videos come from the genuine app on a genuine phone |
| Technical data: the country and region of your connection, the type of network (for example a data centre, a VPN or Tor), keyed fingerprints of your IP address and of your device identifier (they cannot be turned back into the address or the identifier), fingerprints (SHA-256) of the photos and videos you upload, app version, timestamps of each step | your request and your device | security, fraud prevention, country rules |
| Results of our checks and of any human review | us | to make and record the decision |
| After the decision: a fraud label on your verification (for example "reported as fraud", "confirmed fraud" or "checked, no fraud"), a short category, who gave it (the app that sent you, a second reviewer of ours, or a later chip read of the same document) and an optional note | the app that sent you, our reviewers, our checks | to measure how often our checks let fraud through, and to improve them |
How we check. We read your document and check your photos and videos with automated tools, including AI models that run on our own servers (for example to read the text on your document). No outside AI service receives your data.
Proof of address. Only some apps ask for it. If the digital ID in your phone wallet or the ID document you already showed carries your address (signed by the issuer, stored in its chip or printed on it), we use that address and ask for nothing more. If not, you send one document. We check the digital signature of a signed PDF and look at the file for signs of editing. A bank statement can also show payments and balances: we do not copy them, and our reviewers look only at what they need. With your identity we keep only the address and how it was proven (method, type and date of the document). We do not check your address with credit bureaus, voter lists, banks or government databases.
Source of funds and source of wealth. Only some apps ask for it, usually financial services that must understand where a customer's money comes from under anti-money-laundering law (for example for large amounts, or for politically exposed persons). This is financial data. We use it only for that check, never for marketing, credit scoring or anything else. You choose ranges; you never type exact amounts. The app decides whether it also needs documents; by default it asks questions only. We check that the documents are genuine and fit your answers. We do not decide whether your money is legitimate: the app's compliance team does that under its own rules. If you already answered for the same app before, we show you your earlier answers so you can confirm or change them.
What we never collect: your Korean resident registration number, your Japanese My Number, your Indian Aadhaar number, or any other national number that the law forbids us to keep. If such a number is printed on your document, we ask you to cover it and we blur it before we store the photo. We do not use your face to guess your age, ethnicity, emotions or any other trait.
If you choose a digital ID in your phone wallet, we receive the issuer-signed name, birth date, issuing country and, when provided, nationality, expiry date, confirmation of being over 18 and portrait. We request a document number only for approved issuers where lawful. We verify the issuer signature and proof from your wallet's device key. No document photo or document capture video is needed. Verified fields and any portrait have the same retention periods as document data and photos. We do not keep the raw wallet presentation.
3. Biometric data and your choice
Comparing the face in your video with the photo on your document uses software that measures facial features. In many countries this is "biometric data", a special category of personal data.
- We do this only if you choose "Check automatically" on the consent screen. This choice is separate and optional: the other button, "Have a person check", is shown in the same way.
- If you choose "Have a person check", no software measures your face. A trained person compares the photos and watches the video instead. This takes longer but gives you the same result.
- If another verified account has the same name and date of birth as yours, the software also compares your face with the face from that account's verification, one to one, only to make sure one person has one verified account. We never search your face against all other faces.
- We never store a face template (the numbers that describe a face). They exist only in the computer's memory for the few seconds of the comparison and are then discarded.
- Details are in our Biometric Data Policy.
4. Why we use your data and on what legal basis
| Purpose | Legal basis (where such bases are required) |
|---|---|
| Verify your identity for the app that sent you (for Zoi: to unlock person-to-person transfers and to keep one account per person) | your consent; performance of the contract with you |
| Automatic face comparison and the liveness check | your explicit consent (you can choose manual review instead) |
| Check sanctions and politically exposed person lists | legal obligations (for example United States sanctions law) and our legitimate interest in preventing financial crime |
| Proof of address, when the app that sent you asks for it | the legal obligation of that app under anti-money-laundering rules, or its legitimate interest in preventing fraud (we act on its behalf) |
| Source of funds and source of wealth, when the app that sent you asks for it | the legal obligation of that app under anti-money-laundering rules (we act on its behalf) |
| Prevent fraud and duplicate accounts, keep the service secure | our legitimate interest; legal obligations |
| Keep records of decisions and screening | legal obligations; establishing or defending legal claims |
5. Automated decisions
Most verifications are decided by software, so you get an answer in minutes:
- Approved when every check passes clearly.
- Asked to try again when a photo or video cannot be used, the faces do not match, the face check fails, or the document has expired. After three tries a trained person looks at your case.
- Not approved when the document shows you are under the minimum age, when you live in or connect from a place where United States sanctions forbid us to serve you, when the same document is already verified on another account, or when you said you are not acting for yourself.
A trained person decides when a person is really needed: a possible match on a sanctions or politically exposed person list, a document our software cannot check by itself, results that disagree, signs of fraud (for example many attempts from one device or network, or a virtual camera), when you chose "Have a person check", or when you told us you cannot do the head movements of the face check.
If you photograph your document instead of reading its chip, only a person can approve it. Our software checks the photos to help that person.
You can always ask for a person to review any automated outcome with the "Ask a person to review" button or by email. You can also tell us your point of view, and the person can change the decision.
Proof of address. Software approves an address on its own only when the issuer signed it: a digital ID in your wallet, the chip of your document, or a signed PDF from an organisation on our reviewed list. Every other document, and every case where something does not fit (for example the name, the date or the country), goes to a trained person. Software never turns you down because of your address. At most it asks you for another document, and you can ask a person to review that.
Source of funds and source of wealth. If the app asks only questions, your answers complete this step. Software accepts documents on its own only when every document is a PDF signed by an organisation on our reviewed list and every check passes. All other documents go to a trained person, who can accept them, ask you for more or other documents, or decline them. Software never turns you down because of this step; at most it asks you for another document. We never decide whether your money is legitimate: the app that sent you makes that decision, and you can ask it about it.
A trusted, device-bound government digital ID can be approved automatically in a browser or app when all other checks pass. A liveness video is still required. If the credential provides no portrait, comparison with a wallet photo is skipped. Automatic approval requires your separate biometric consent. You can choose the document path and ask for human review.
6. Who sees your data
- Our reviewers: a small team trained on this notice. Only named reviewers have access, and every time they open your data it is logged. A second reviewer may look at a small random share of finished verifications again, to check our quality. This never changes your result by itself.
- The app that sent you gets only the result it needs, for example "verified, over 18, valid until", and a few fields it is allowed to see (for Zoi: issuing country, nationality and country of residence). It does not get your photos, video, document number or name unless the law requires it to hold them and we tell you so in the app. If it asked for proof of your address, it also gets whether your address is proven, how (for example a signed bank statement), the type and date of the document and the country, and the address itself only if it is allowed to see it. It does not get the document. If it asked about your source of funds or wealth, it gets the evidence level (high, medium, low or none) and the number of documents; your answers, the figures we read and our findings only if it is allowed to see financial data. We do not send it your documents. Only its compliance staff can view images of their pages in our partner dashboard, while we keep them, and each view is logged.
- The issuer of your document, only if a reviewer checks an official verification code printed on it (for example on turkiye.gov.tr). The reviewer types the code and what that page asks for (for example the ID number printed on the document) by hand. The issuer already holds this data. We never send data to these pages automatically.
- Service providers that host or carry our data under contracts that bind them to protect it: see the list of subprocessors.
- Authorities, only when the law requires it (for example a sanctions report or a valid court order).
We never sell your data and never use it for advertising.
7. Where your data is stored and international transfers
Your data is stored on servers in Germany (European Union), operated for ZOI LABS LLC, a company in the United States. Your photos, video and chip files are encrypted before they are stored. Backups are encrypted too.
When you live outside Germany, using Zoi ID means your data travels to Germany and can be accessed from the United States and Türkiye by ZOI LABS LLC staff. Here are the details the law of some countries (for example Korea, Thailand, Türkiye and Vietnam) asks us to give you before you agree:
- What is transferred: the data in section 2.
- To whom: ZOI LABS LLC (contact above), and the subprocessors listed here.
- Countries: Germany (storage and processing), United States and Türkiye (access by ZOI LABS LLC).
- When and how: each time you upload a step, over an encrypted connection (TLS).
- Purpose and retention: sections 4 and 8.
- How to refuse: do not start or do not finish the verification. You can withdraw at any time (section 9). The only effect is that features that need a verified identity stay locked.
Where the law requires an additional safeguard for a transfer (such as standard contractual clauses), we use it.
8. How long we keep your data
| Data | Kept until |
|---|---|
| A verification you never finished | deleted after 7 days |
| Photos, video, still frames, chip files, proof of address and source of funds documents | deleted 90 days after the decision (within 24 hours if you are under the minimum age; at once if you withdraw) |
| What we read from a proof of address document, its signature and file checks, and your device's time zone and language | deleted 90 days after the decision (at once if you withdraw or the verification is cancelled) |
| Your source of funds answers, what we read from those documents and our checks on them | deleted 90 days after the decision (at once if you withdraw or the verification is cancelled) |
| Your identity data (name, date of birth, document number, address and how it was proven) and a summary of your source of funds (your answers, the type, date, issuer and main amount of each accepted document, the evidence level) | while your account with the app exists, and at most 5 years after your last verification |
| Keyed fingerprints of your document, your identity and your proof of address and source of funds documents (they cannot be turned back into your data) and the decisions, without your name | 5 years after your last verification, to stop the same person from opening several accounts |
| Fraud labels on a verification, without your name | 5 years after your last verification, like the decisions; a free-text note goes with your photos (90 days after the decision, at once if you withdraw) |
| Sanctions screening records | 10 years, because United States law requires it |
| Encrypted backups | 30 days |
The full schedule is here. If we must keep data longer because of a legal claim or an order from an authority, we keep only what that requires, and only until it ends.
9. Your rights
Depending on where you live, you can:
- get a copy of your data and information about how we use it;
- correct wrong data;
- delete your data (with the limits in section 8);
- restrict or object to some uses;
- take your data to another service in a common format;
- withdraw your consent at any time with "Cancel and delete my data" in the app or on the web page, or by email. This ends your verification, also one that was already approved, and deletes your photos, video, chip files, address and source of funds documents, your source of funds answers and identity data at once; we keep only the records section 8 lists for fraud prevention and legal duties. It does not affect what happened before you withdrew;
- not be subject to a decision made only by software (section 5);
- complain to your data protection authority (section 14).
Send requests to support@zoi.network. We answer within one month (or sooner where your law requires it). We may ask you to prove it is you. If you verified through another company's app, you can also ask that company.
Deleting your Zoi account also deletes your Zoi ID data as described in section 8. You can delete your account in the app or at https://zoi.network/delete-account.
10. Security
We encrypt every photo, video and chip file with its own key, keep our keys apart from the data, give access only to named and trained reviewers, log every access, and keep encrypted backups. If a breach puts your rights at risk, we tell you and the authorities within the time the law sets (usually 72 hours).
11. Age
You must be at least 18 years old to verify (19 if you live in Korea, 20 if you live in Thailand). If your document shows that you are younger, we stop and delete your photos, video and chip files within 24 hours.
12. Changes
When we change this notice we update the version date at the top. If the change affects how we use data you already gave us, we tell you in the app first and ask again where the law requires it.
13. Country details
- European Union, EEA and United Kingdom: you can complain to the supervisory authority of your country.
- India: you can reach our grievance contact at support@zoi.network; we reply within the time set by the Digital Personal Data Protection Rules. You can then complain to the Data Protection Board of India. You may read this notice in English or in Hindi in the app.
- Korea: the transfer details in section 7 apply. You can refuse consent; refusing only means the verification cannot be completed.
- Türkiye: this notice is our information notice (aydınlatma metni) under Law No. 6698. Your explicit consent is asked separately in the app. You can apply to us under Article 11 and complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) of the Personal Data Protection Authority (KVKK).
- Brazil: you can contact the ANPD.
- United States (Illinois, Texas, Washington, Colorado and other states with biometric laws): our Biometric Data Policy is our written public policy and retention schedule. Your tap on "Check automatically" is your written release.
- Other countries: you can contact your local data protection authority.
14. Contacts and representatives
- ZOI LABS LLC, 26 Broadway, Suite 934, New York, NY 10004, USA, support@zoi.network.
- Representatives required by local law (for example in the European Union or Türkiye) are listed here once appointed.
15. Partner accounts
This section is for people who use the Zoi ID partner dashboard for their company. ZOI LABS LLC is the controller of this data.
- What we keep: your work email, your name if you add it, your organisation and role, the public part of your passkeys, your authenticator app secret (encrypted), sign-in times, and a keyed fingerprint of your IP address. Every action you take in the dashboard is written to an audit log with your email.
- Why: to run your account, keep it secure, and keep a record of changes to keys, settings and contracts (our contract with your company and our legitimate interest).
- Emails: sign-in and invite links are sent by our email provider, Resend (United States).
- How long: your account until you or your company delete it; sign-in links and sessions until 1 day after they expire; the audit log for 10 years.
- You can delete your account in the dashboard, unless you are the last owner of an organisation.