Privacy Policy & Accessibility

Effective July 10, 2026

This version (v2026-07) adds disclosures for Minerva’s identity verification (IDV) services and the Minerva Universal Identity Platform (Minerva Universal ID). The previous version was effective February 27, 2021.

This Privacy Policy explains how MinervaAI collects, uses, stores, discloses and otherwise manages your personal information, including in connection with our website www.minervaai.io (“Website”). Please review the following carefully so that you understand our privacy practices. Where the words “we”, “us”, or “our” is used, it is referring to MinervaAI.

In addition to this policy, we may also provide you with additional information through prompts, on-line notices and our website Terms of Use. We might also provide you with any product or service specific privacy notices at the time of your specific interaction or purchase.

Our Website may contain links to other sites that we do not own or operate. We will not give any of your personal information to these third parties without your consent, unless stated otherwise in this Privacy Policy. We may provide links to third-party sites and services for your reference. We do not endorse these sites or services.

The linked websites have separate and independent privacy statements, notices and terms of use, which we recommend you read carefully. We do not have any control over such websites, and therefore we have no responsibility or liability for the manner in which the organizations that operate such linked websites may collect, use or disclose, secure and otherwise treat your personal information.

WHAT IS PERSONAL INFORMATION?

We collect personal information for the purposes of providing you our products and services, verifying your identity, tailoring your online experience and establishing and maintaining responsible commercial relations with you and complying with regulatory and legal requirements.

The below provides an easy to use reference guide to the personal information we collect about you and our reasons for doing so.

Personal information we may collect and the purposes for collecting your personal information include:

First and last name

create and maintain your account

Billing information

process a purchase

E-mail address

create and maintain your account
receive notifications and confirmations
receive subscribed marketing materials
receive electronic receipts/invoices
validate your account and communicate with you

Last four digits of your credit card

fraud detection
address payment processing issues with our payment processing service provider

Technical

IP address
Device ID
Operating system
Type of browser
Browsing behaviour
Other device specifications such as memory availability

collect statistical information on the number of product downloads
collect information about the devices that have downloaded our licensed software and the registered accounts to which it is linked
improve our Website and services, we may collect information about how you interact with our Website, viewed pages, access dates and times, IP address and the internet browser you use

Marketing consents and preferences

meet our legal obligations
send you marketing and promotional materials that you have agreed or requested to receive

If you apply for a position with us, we will also collect any information you provide us in your curriculum vitae and throughout the recruitment process. The purpose of collecting and storing this information is to consider and make a determination on your application.

HOW AND FROM WHICH SOURCES DO WE COLLECT YOUR PERSONAL INFORMATION?

Most of the personal information we collect about you is provided from you directly. The following table provides a summary of how we collect your personal information.

FROM WHOM AND HOW IS YOUR PERSONAL INFORMATION COLLECTED?

You

When you enter your information in our system to create an account, subscribe to a newsletter or through other direct interactions

Third parties

From cookies and other similar technologies such as Sendinblue analytics
From browser extensions and features that notify us when our product has been installed or uninstalled by you.

TO WHOM DO WE DISCLOSE YOUR PERSONAL INFORMATION?

We are serious about privacy. We do not sell or rent your personal information. We are serious about safeguarding your personal information, including maintaining controls for employee and third-party access to your personal information. Below are some examples:

Service providers

In providing our services to you, we may rely on third party service providers to help perform administrative functions, assist with service delivery or troubleshooting, process payments or assist us in analyzing how our services are being used, among other things. To perform these functions, we may need to share your personal information with our service providers. Our service providers are contractually bound to protect your personal information and to use it only for the purposes for which we have instructed.

Some of these third-party service providers may be located outside of Canada, including the United States, Germany or elsewhere in the European Union. As a result, your personal information may be accessible to law enforcement, courts and regulatory authorities in accordance with the laws of these jurisdictions.

Legal transaction

In the event of a sell, assignment, or other transfer of all or a portion of our business or assets, information we might have about you might be transferred or disclosed to a purchaser or prospective purchaser. Should such a transfer occur, we will use reasonable efforts to try to ensure that the transferee uses your information in a manner that is consistent with this policy unless otherwise permitted or required by applicable law.

Other legal requirement

We may be compelled to share your information with a court of law or other person(s) or entity / entities with jurisdiction to compel production of such information.

WHERE DO WE STORE YOUR PERSONAL INFORMATION?

We store personal information that we collect from you or about you on Amazon Web Services servers in Canada and, for certain account and sign-in data, on Google infrastructure that may be located outside Canada (see “Where identity and biometric data is stored” below).

As noted, from time to time your personal information may be transferred to third party hosts outside of Canada to facilitate or provide certain services on our behalf. These third parties have access to your personal information only to perform the tasks we have instructed them to complete and are contractually bound not to disclose or use it for any other purpose.

Where personal information is transferred to and stored in a country not determined by the European Commission as providing adequate levels of protection for personal information, we take steps to provide appropriate safeguards to protect your personal information, including:

entering into standard contractual clauses approved by the European Commission, obliging recipients to protect your personal information as permitted under Article 46(2)(c) of the GDPR;
under the EU-U.S. Data Privacy Framework (where we transfer personal information to the U.S.), which enables U.S. businesses to self-certify as a means of complying with EU data protection laws.

In the absence of an adequacy decision or of appropriate safeguards as referenced above, we will only transfer personal data to a location outside the EEA where one of the following applies (as permitted under Article 49 of the GDPR):

the transfer is necessary for the performance of our contractual engagement with you;
the transfer is necessary for the establishment, exercise or defense of legal claims; or
you have provided explicit consent to the transfer.

For additional information about the way in which our service providers handle your personal information, contact us at info@minervaai.io

By using our Website, you consent to the transfer of your personal information outside of your jurisdiction for the purpose of storing your personal information or processing it.

IDENTITY VERIFICATION (IDV) AND THE MINERVA UNIVERSAL IDENTITY PLATFORM

Minerva provides biometric identity verification (“IDV”) in two distinct contexts. Your rights, and who is responsible for your personal information, depend on which one applies to you.

Merchant IDV. A business, financial institution, marketplace, or other organization (a “merchant”) uses Minerva’s IDV service to verify the identity of its own customers. In this context the merchant is the organization responsible for your personal information, and Minerva acts as its service provider (data processor).
Consumer IDV (Minerva Universal ID). You create a Minerva Universal Identity Platform account (consumer brand “Minerva Universal ID”) directly with Minerva, verify your identity once, and manage it yourself in a personal Identity Vault. In this context Minerva is the organization responsible for your personal information (the controller).

WHAT IDV COLLECTS AND HOW IT WORKS

To verify your identity, the IDV service collects:

photos and a short live video of your face, used to confirm you are a real, present person (“liveness”) and to compare against your identity document;
photos of your government-issued identity document (for example a passport, driver’s licence, national ID, permanent resident card, residence permit, or health card), including the details printed on it, such as your name, date of birth, document number, issuing jurisdiction, and expiry date;
the results of automated checks for document authenticity, tampering, screen or print replays, and AI-generated imagery, and a match / no-match assessment between your face and your document portrait; and
technical and device information associated with the capture session.

Your facial images and liveness video are biometric information and are treated as sensitive personal information. We collect and use them for a single purpose: confirming that you are who you say you are. Automated assessment is performed using Amazon Bedrock and Anthropic Claude vision models under a zero-data-retention arrangement, meaning your images and extracted details are not retained by, or used to train, the model provider’s systems. A member of Minerva’s review team may view your images only where needed to complete your verification.

MERCHANT IDENTITY VERIFICATION (MINERVA AS SERVICE PROVIDER)

Where a merchant uses Minerva to verify you, that merchant is responsible for your personal information and determines why and how it is processed. Minerva processes your information on the merchant’s behalf, under its instructions and our Identity Verification Terms of Service. If you want to access, correct, or delete the personal information collected in a merchant verification, please direct your request to the merchant that asked you to verify. Minerva will support the merchant in responding, and will action deletion on the merchant’s instruction or in accordance with the applicable retention policy. Retention for merchant verifications is set by the merchant and by applicable law: incomplete or abandoned captures are deleted within approximately 24 hours; raw facial and document images are deleted after the verification is complete (by default within 30 days, and configurable by the merchant); and derived verification results may be retained for the merchant’s contractual and regulatory period (for example, where know-your-customer audit retention is required), subject to any legal hold.

CONSUMER IDENTITY VERIFICATION: MINERVA UNIVERSAL ID (MINERVA AS CONTROLLER)

Where you create a Minerva Universal ID directly with us, Minerva is responsible for your personal information. Minerva Universal ID is built around self-owned identity:

you can see exactly what Minerva holds about you in one transparency view (“What Minerva holds”) inside your Identity Vault;
you can erase your biometric and identity-document data at any time, in one click, independently of your account;
you can delete your account entirely, with a guarantee that your biometric and identity-document data is destroyed; and
every erasure produces a durable deletion receipt that contains no personal information, which you can keep even after your account is gone.

Verification is optional: you may keep an account without verifying, but it will not be verified and some features will be unavailable. At launch, Minerva Universal ID is offered to individuals 18 years of age or older in Canada, and sign-up may be geographically restricted.

WHERE IDENTITY AND BIOMETRIC DATA IS STORED (DATA RESIDENCY)

Your sensitive identity data, including your facial and liveness captures, your identity-document images, the details read from them, and your verified attributes such as date of birth and document expiry, is stored encrypted in Canada (Amazon Web Services, Canada (Central) region). Certain account and sign-in information, such as your email address, name, sign-in provider identifiers, multi-factor authentication factors, and related account metadata, is handled through Google Firebase Authentication and may be processed outside Canada. In addition, automated identity assessment is performed on cloud AI infrastructure (Amazon Bedrock) that may process your images and their extracted details outside Canada, under a zero-data-retention arrangement. Where personal information is transferred or processed outside Canada, we put appropriate safeguards in place, including written agreements with our providers, and we assess these transfers under Quebec’s Law 25. Our retention schedule below gives a store-by-store summary.

HOW WE PROTECT IDENTITY AND BIOMETRIC DATA

Encryption. Every image and sensitive field is protected with application-layer envelope encryption (AES-256-GCM with keys wrapped by a managed key service), in addition to storage-layer encryption. Images are stored as encrypted binary objects, and the encryption is bound to your record so that access to the database alone cannot reveal your information.
Minimal logging. Our systems log identifiers only. Your name, email, images, and document details are never written to logs, traces, or metrics.
Least privilege and isolation. Access is tightly scoped, and each record is isolated to its owner. Break-glass access to decrypt material requires separate, audited permissions.
Independent assurance. These controls are aligned with our SOC 2 control framework, with audit logging and monitoring of deletion and access activity.

RETENTION SCHEDULE (MINERVA UNIVERSAL ID)

The following schedule lists every category of personal information Minerva Universal ID keeps, where it lives, why we have it, the longest we keep it, and how it is erased. It matches, category for category, the “What Minerva holds” view inside your vault. When we delete something we delete it permanently: encrypted files are destroyed first, then database fields are purged and records reduced to non-personal tombstones, and each step is evidenced on your deletion receipt.

Face photos and liveness video: Minerva’s secure verification store, encrypted, in Canada. Kept no longer than 60 days, or until you erase your verification data or delete your account, whichever comes first. You erase it from your Vault using “Erase verification data.”
Identity-document photos, and the details read from them: the same verification store. Kept no longer than 60 days, on the same trigger, and erased the same way.
Verified details (date of birth, document expiry): your account record, encrypted. Kept for the life of your account, to keep your verified status working and to power age confirmations you choose to share. Erased when you erase your verification data or delete your account.
Verification session record (statuses, dates, and decision category only; no personal details): the verification store. Retained indefinitely because it contains no personal information; disclosed here for transparency.
Account details (email, sign-in providers, security settings): Minerva’s account database and Google’s Firebase sign-in infrastructure (Google may process this outside Canada). Kept for the life of your account; on deletion, a 7-day recovery window applies before the deletion pipeline runs.
Your legal name and identity profile: Minerva’s profile system. Kept for the life of your account; on deletion, personal details are permanently redacted and only a non-personal shell is kept for audit.
Consent records and activity log: the account database. On account deletion these are reduced to non-personal stubs, kept indefinitely as legal proof of your consents and of how your data was handled.
Screening records (checks of your details against sanctions and risk lists): Minerva’s compliance systems. Kept for as long as the law requires, even after you delete your account; this cannot be erased earlier and is disclosed on your deletion receipt.
Deletion receipts: a receipt store reachable only by an unguessable link. Kept forever; they contain no personal information by design.
Deletion forensics record (a securely hashed link between a deletion request and its receipt): a restricted internal store. Kept indefinitely so we can answer legal and support questions about deletions; access is restricted to named roles and every access is logged and audited.
Email snapshot used to send your deletion receipt: the deletion job record. Removed within hours, right after the send attempt.

ERASURE, ACCOUNT DELETION, AND DELETION RECEIPTS

For a Minerva Universal ID, you can exercise two independent choices at any time:

Erase your verification data (your account stays). This immediately deletes your facial captures, identity-document images, and the details read from them, and purges your verified attributes. Any age or identity confirmations you have enabled stop immediately. Your account remains, shown as unverified, and you can re-verify at any time.
Delete your account. After a 7-day recovery window (during which signing in and confirming restores your account in one click), Minerva runs an ordered destruction pipeline: your identity-verification data is erased first, your identity profile is redacted, your account records are deleted or reduced to non-personal tombstones, and your sign-in credentials are removed last. We email your deletion receipt on a best-effort basis, and the receipt remains available permanently.

For a merchant verification, deletion requests are handled by the merchant that asked you to verify, as described above. In all cases, some information may be retained where the law requires it (for example, sanctions-screening records under anti-money-laundering law) or in the form of non-personal evidence that a deletion occurred.

SCREENING AND LEGAL OBLIGATIONS

As part of Minerva Universal ID onboarding, and from time to time afterwards, we check your details (your name, and your date of birth once verified) against public sanctions lists, lists of politically exposed persons, and similar risk lists, in order to meet legal and safety obligations. These checks run in the background; results are used by Minerva’s compliance team only and are shared outside Minerva only if you choose to share your profile with an organization. Records of these checks are kept for as long as the law requires, even if you delete your account.

AGE AND IDENTITY CONFIRMATIONS YOU CHOOSE TO SHARE

If you use Minerva Universal ID to confirm your age or verified status to another organization, Minerva shares only the minimum needed. For example, a yes/no signal that you are over a given age threshold, together with an assurance level and timestamps. We do not share your date of birth, name, document, or images, and we do not let two organizations link their records through Minerva. Erasing your verification data stops these confirmations immediately.

APPLICABLE JURISDICTIONS AND YOUR REGULATORS

Minerva Universal ID launches in Canada and is governed by Canadian federal privacy law (PIPEDA) and, in Quebec, by the Act respecting the protection of personal information in the private sector, as amended by Law 25, including its requirements for express consent to biometric processing, declaration of a biometric database to the Commission d’accès à l’information, a privacy officer whose contact is published, and a cross-border transfer assessment. As we expand, additional laws will apply depending on where you are, including the EU and UK General Data Protection Regulation, the UK Online Safety Act’s age-assurance requirements, and, in the United States, biometric privacy laws such as the Illinois Biometric Information Privacy Act and comparable state laws. You may contact our Privacy Officer at privacy@gominerva.com, and you may escalate a concern to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.

YOUR LEGAL RIGHTS TO YOUR PERSONAL INFORMATION

Depending on your jurisdiction, you may have the following rights to your personal information:

Right
Description
Right to know

You have the right to request the categories and specific pieces of personal information we collect including:

categories of personal information collected;
categories of sources from which personal information is collected;
business or commercial purposes for collecting your personal information;
categories of third parties with whom we share personal information; and

specific pieces of personal information we have collected about you.

Right to request access to your personal information

You have a right to request a copy of the personal information that we hold about you. To do so, please contact us.

Right to request the erasure of your personal information

You have the right to request that we delete or remove personal information where there is no good reason for us continuing to process it.

Erasure requests are subject to certain limitations, for example, we may retain personal information as permitted by law.

Right to request we transfer your personal information to you

Subject to certain limitations you have the right to request that the personal information we hold about you is transferred to you or to a third party. We will provide you, or the third party you have chosen, your personal information in a machine-readable format.

Right to request correction of your personal information

You have the right to request that we correct the personal information we hold about you, although we may need to verify the accuracy of the new information you provide us. We may refuse to comply with a request for rectification if the request is manifestly unfounded, excessive or repetitive in nature

Right to request restrictions on the processing of your personal information

You have the right to request that we suspend the processing of your personal information in the following scenarios:

if you contest the accuracy of the personal information we hold about you and we are verifying the accuracy of that information;
where it has been determined that the processing of your personal information is unlawful but you do not want us to erase it;
where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
for other legal purposes.

We may refuse to comply with a request for restriction if the request is manifestly unfounded, excessive or repetitive in nature.

Right to object to the processing of your personal information

In some circumstances, you have the right to object to the processing of your personal information where we are relying on a legitimate interest (or those of a third party). In this case, you must provide specific reasons for why you object to the processing of your personal information.

You have an absolute right to object to the processing of your personal data for direct marketing purposes.

Right to withdraw consent

In circumstances where we are relying on your consent to process your personal data, you have the right to withdraw your consent at any time.

The withdrawal of consent will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent

Right to non-discrimination

Exercising your right to privacy does not result in different treatment by us or different quantities or qualities of product or service that we offer. Where we request your personal information in exchange for a valuable product or service, we will let you know at the time of the exchange.

DO WE USE COOKIES OR OTHER SIMILAR TECHNOLOGIES?

Most websites use cookies. A cookie is a small text file which our website may place on your computer as a tool to remember your preferences and display more relevant information next time you visit. You may refuse to use cookies by selecting appropriate settings on your browser, however, please note that if you disable cookies, you may not be able to use the full functions of our service. Our Cookie Policy is available on our website.

In addition, our website uses Google Analytics services to help us understand non-personal facts and figures about users of the website such as:

website traffic;
number of visitors;
location of visitors;
information about the browser version and device type;
referral sources to the website;
demographics of visitors;
and website usage.

DO WE COLLECT THE PERSONAL INFORMATION OF CHILDREN?

The short answer is “no”. This Website and our Services are not directed, marketed, or meant to be used by persons under the age of eighteen (18). If you think your child might have created an account with us without your consent, you may request the deletion of the account and the data that we have about your child by writing to us via contact us.

HOW LONG DO WE RETAIN YOUR PERSONAL INFORMATION?

We will generally retain your personal information for as long as is necessary to meet our contractual obligations to you, to satisfy the purposes stated above or as otherwise required by law.

When determining the relevant retention period, we consider:

our contractual obligations and rights in relation to the information involved;
legal obligation(s) under applicable law to retain data for a certain period of time;
statute of limitations under applicable law(s);
our legitimate interests where we have carried out balancing tests (see section on ‘What Information do we collect and for what purpose’ above);
guidelines issued by relevant data protection authorities; and
other legal purposes.

In addition to the above, your personal information may be anonymized and used in aggregate. Once it is determined that your personal information is no longer necessary as indicated above, we will securely erase your personal information.

HOW DO WE PROTECT YOUR PERSONAL INFORMATION?

We take appropriate technical, physical and organizational security measures to protect personal information in our custody and control against unauthorized access, use, modification and disclosure, and accidental loss, destruction and damage.

The third-party vendors with whom we engage for specific tasks are required to have certain safeguards in place that comply with industry standards.

That having been said, we cannot guarantee the security of our database, nor can we guarantee that information you supply will not be intercepted while being transmitted to us over the Internet. Any transmission of information from you to MinervaAI is at your own risk. Where you have chosen a password that allows you to access our Website you are responsible for keeping this password confidential.

UPDATES TO THIS PRIVACY POLICY

This Privacy Policy and other service specific policies may change from time to time, in accordance with applicable laws. We will notify you of these changes by posting the updated policy on our Website. We may also notify you by sending you an e-mail or by any other reasonable means such as a pop-up notice, if available.

We encourage you to review our Privacy Policy periodically.

HOW DO I REPORT A PRIVACY CONCERN?

We are committed to maintaining high standards for privacy. We want to hear from you about any concerns you may have with our privacy practices. If you wish to raise a concern or compliment us on our privacy practices, you can contact us at info@minervaai.io

If we are not able to address your privacy concerns to your level of satisfaction, you may contact the Office of the Privacy Commissioner of Canada:

Office of the Privacy Commissioner of Canada 30, Victoria Street Gatineau, Quebec K1A 1H3

Toll-free: 1-800-282-1376 Phone: (819) 994-5444 TTY: (819) 994-6591