Privacy Policy

1. Who we are

Ryz One is operated by RYZ Labs (“we”, “us”). It verifies the identity of contractors who have received an offer to work with Rise and collects their signature on their contract. This policy explains what we collect through the Ryz One app and website, why, who we share it with, and how long we keep it.

2. What we collect

• Account and invitation details: your name, email address, the role you were offered and the recruiter or system that invited you.
• Face biometrics: a short video selfie used for a liveness check, a reference image of your face, and a face-similarity score comparing it to the portrait on your ID.
• Identity document: images of your passport, driver's license or national ID and the data read from it (such as name, date of birth, document number, nationality, expiry date and the machine-readable zone).
• Device and location: device model, operating system and app version, a device-integrity attestation from Apple or Google, your IP address and approximate IP location, and your GPS location at the time of verification.
• Profile and consent: the address you provide and a record of the consent you give.
• Contract: your signed contract and its DocuSign envelope status.
• Technical logs: security and audit records of actions taken in the service.

3. Why we use it

• To confirm you are a real, live person and that you are the person named in your offer.
• To check your document is genuine, unexpired and that you are at least 18.
• To detect fraud, such as emulated devices, spoofed locations or reused identities.
• To let you sign your contract and to share the verification result with Rise's hiring system (ARC).
• To meet legal, compliance and security obligations.

Where we rely on consent, for example to process biometric data, we ask for it in the app before you start, and you can withdraw it at any time by contacting us. Withdrawing consent means we cannot complete your verification.

4. Automated decisions

Ryz One scores the checks above automatically. Clear passes are approved automatically; anything uncertain is reviewed by a trained member of our staff, who makes the final decision. You can ask for a human review of any outcome.

5. Who we share it with

We do not sell your personal data. We share it only with:

• Amazon Web Services (Rekognition Face Liveness, Rekognition CompareFaces and Textract) to analyse your face and document, and Amazon SES to send emails.
• Supabase, which hosts our database, authentication and encrypted file storage.
• DocuSign, to present and store your signed contract.
• Apple and Google, which provide the device-integrity attestation.
• Rise / RYZ Labs hiring systems (ARC), which receive your verification result and contract status.
• Authorities, where we are legally required to.

These providers process data on our instructions under contracts that require them to protect it.

6. How long we keep it

• Face images, video-derived data and ID images: deleted within 90 days of your verification being completed or closed.
• Extracted ID fields, check results and device data: kept for up to 2 years for fraud prevention and audit.
• Signed contracts: kept for the duration of your engagement and as required by law afterwards.
• Invitations that are never started expire after their validity period and are deleted within 12 months.

7. Security

Data is encrypted in transit and at rest. Images are stored in a private bucket and are only viewable by authorised staff through links that expire after minutes. Access is restricted by role and logged.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your data, to object to or restrict processing, and to withdraw consent. To exercise any of these rights, email us. You may also complain to your local data protection authority.

9. Contact

Questions about this policy or your data: info@ryzlabs.com.