Last Updated: 31 March 2026 | Version: 2.0
VeriLink, operated by SkyL4rk (Pty) Ltd, is committed to protecting the privacy of all individuals whose data passes through our platform. This Privacy Policy explains how we collect, use, store, share, and safeguard personal information in connection with our identity verification, biometric authentication, and compliance screening services. It applies to Company Users, End Users, and all visitors to verilink.online and dashboard.verilink.online.
VeriLink operates under the Protection of Personal Information Act 4 of 2013 (POPIA) as its primary governing data protection framework. Where services are provided to clients in the European Union or European Economic Area, the General Data Protection Regulation (GDPR) applies additionally to those processing activities.
We collect the following categories of personal information:
Company User Account Data: Business name, registered name, contact name, email address, telephone number, physical address, and payment information (processed via PayFast — we do not store card data directly).
End User Identity Data: Full name, date of birth, ID number, passport number, nationality, and government-issued document data extracted via PDF417 barcode or MRZ scanning.
Biometric Data: Facial recognition encodings, liveness detection outputs, and facial landmark data generated during verification. Face detection, liveness checks, and template matching are performed on the End User's device. Resulting encodings may be transmitted to our servers for comparison and stored in encrypted form as part of the PVTF where the End User has consented to server storage.
Geolocation Data: GPS coordinates captured at the time of verification where Location verification is requested by the Company User and consented to by the End User.
Device and Technical Data: IP address, device type, operating system, Firebase device token, browser type, and usage logs.
Verification Transaction Data: Timestamps, request references, token consumption records, verification outcomes, and audit logs associated with each Verification Request.
Compliance Screening Data: Name, date of birth, nationality, and identification details submitted for screening against OFAC, UN, EU, and UK sanctions lists, PEP databases, and adverse media sources. Screening results including match scores, entity links, and media summaries are retained as part of the compliance record for the relevant Verification Request.
Communication Data: Support requests, emails, and any other correspondence submitted to VeriLink.
We use collected data for the following purposes:
Identity verification, biometric authentication, and liveness detection on behalf of Company Users.
Compliance screening including OFAC sanctions, UN/EU/UK sanctions, AML/PEP checks, and adverse media monitoring.
Account management, subscription billing, and token transaction processing.
xCrypt licence validation on every API-based Verification Request.
Fraud detection, platform security, and abuse prevention.
Compliance with applicable legal and regulatory obligations.
Improving platform functionality, reliability, and security.
Communicating with Company Users regarding account activity, billing, and service updates.
We process personal data under the following legal bases:
Consent: End Users provide explicit consent before biometric data is captured and processed. Consent may be withdrawn at any time via the VeriLink application.
Contractual Necessity: Processing is required to fulfil our service obligations to Company Users under their subscription or API access agreement.
Legal Obligation: Compliance screening and record-keeping obligations arising under FICA, POCA, POCDATARA, and equivalent international AML legislation.
Legitimate Interests: Fraud prevention, platform security, abuse detection, and service improvement, where such interests are not overridden by the fundamental rights and freedoms of data subjects.
Where Company Users request compliance screening services, VeriLink processes the submitted identity data against its in-house screening stack. This involves:
Sanctions screening against OFAC (US), United Nations, European Union, and United Kingdom consolidated sanctions lists.
PEP and enforcement screening against international politically exposed person and law enforcement databases.
Adverse media screening using GDELT (Global Database of Events, Language, and Tone) and licensed news data APIs. GDELT is an open-access global media monitoring dataset. Results are scored and entity-linked by VeriLink's internal processing engine.
Compliance screening results — including match scores, entity associations, source articles, and risk indicators — are retained as part of the Verification Request audit record. Company Users may access these results via the Dashboard or API response payload. VeriLink retains screening records for a minimum of five (5) years to support regulatory audit requirements, unless a shorter period is specified by applicable law.
VeriLink does not make legal determinations on the basis of screening results. Company Users are responsible for interpreting results and making their own compliance decisions in accordance with applicable AML law.
Face detection, liveness checks, and biometric template matching are performed on the End User's device. We do not use biometric data for advertising or profiling. We will only transmit biometric data or a verification result to the named Company User, and only for the purpose for which the End User gave consent.
We do not sell or rent personal information. We may share data with the following categories of recipients:
Company Users (Data Controllers): Verified payloads are delivered to the Company User who initiated the request.
Sub-Processors: Third-party services engaged to support platform delivery, including:
Regulatory authorities: Where required by law, court order, or regulatory directive.
Law enforcement: In cases of suspected fraud, money laundering, or other illegal activity.
Your Personal Verification Token File (PVTF) is stored on your device within the application's private encrypted storage. If you enable cross-device use, an encrypted copy is stored on our servers. All biometric data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
We implement the following security measures:
AES-256 encryption for all sensitive data in storage and transit.
Role-based access controls on all internal systems.
Transaction hash validation to prevent replay attacks on payment and billing events.
Regular security audits and vulnerability assessments.
Incident response procedures with a 72-hour breach notification obligation to affected controllers.
We retain personal data only as long as necessary for the purposes for which it was collected, or as required by law:
PVTF (on-device): Retained until the End User deletes it via the application or uninstalls the app.
PVTF (server-stored): Retained to support active verifications. Deleted within 30 days of an unlink or deletion request, unless longer retention is legally required.
Verification Request records: Retained for a minimum of five (5) years to support compliance audit obligations.
Compliance Screening records: Retained for a minimum of five (5) years in line with FICA and AML record-keeping obligations.
Token transaction records: Retained for a minimum of five (5) years for financial record-keeping and dispute resolution purposes.
Liveness session images/frames: Processed in memory during the active session and discarded immediately upon session completion. Not stored.
Company User account data: Retained for the duration of the account and for five (5) years following closure, unless otherwise required by law.
End Users may decline any Verification Request, withdraw biometric consent, or delete their PVTF at any time within the application. Company Users may request deletion of server-stored data by contacting us.
Depending on your jurisdiction, you may have the right to:
Access a copy of your personal data held by VeriLink.
Request correction of inaccurate or incomplete personal data.
Request deletion of personal data, subject to legal retention obligations.
Withdraw consent for biometric processing at any time without affecting the lawfulness of prior processing.
Object to processing based on legitimate interests.
Lodge a complaint with the Information Regulator of South Africa (for POPIA) or your local supervisory authority (for GDPR).
To exercise any of these rights, contact us at: privacy@verilink.online
End Users may delete their account at any time via Settings → App Info → Delete Account within the VeriLink application. Upon deletion, biometric templates and PVTF data are removed from active systems. Certain records — including verification logs, compliance screening records, and transaction histories — may be retained for the periods specified in clause 8 above, as required by applicable law. If you are unable to access your account, deletion may be initiated by contacting our support team at support@verilink.online.
VeriLink is headquartered in South Africa. Where personal data is processed or stored outside of South Africa, we ensure such transfers comply with POPIA Section 72 requirements, including that the recipient country provides adequate protection or that appropriate contractual safeguards are in place (such as Standard Contractual Clauses for EU data transfers). Sub-processors such as Google Cloud Platform and Firebase may process data in jurisdictions outside South Africa. All such sub-processors are bound by data protection obligations no less stringent than those set out in this Policy.
The VeriLink website and dashboard use cookies and similar tracking technologies to maintain session state, support authentication, and monitor platform performance. We do not use cookies for advertising or cross-site tracking. Users may manage cookie preferences through their browser settings; however, disabling essential cookies may affect platform functionality.
We may update this Privacy Policy periodically to reflect changes in our services, legal obligations, or data processing practices. Material updates will be communicated to registered Company Users by email and posted on this page with a revised effective date. Continued use of VeriLink after the effective date constitutes acceptance of the updated Policy.
For privacy-related enquiries, data subject access requests, or concerns regarding this Policy:
Email: privacy@verilink.online
Postal: SkyL4rk (Pty) Ltd, Ballito, KwaZulu-Natal, South Africa
Website: https://verilink.online
The Information Regulator of South Africa may be contacted at: https://www.justice.gov.za/inforeg/
Last Updated: 31 March 2026 | Version: 2.0
These Terms and Conditions ("Terms") govern access to and use of all VeriLink products and services, including the VeriLink API, the VeriLink Dashboard, the VeriLink mobile application, and all associated compliance screening services. By registering, accessing, or using any VeriLink service, you confirm that you have read, understood, and agree to be bound by these Terms. If you do not agree, you must not use our services.
Last Updated: 31 March 2026 | Version: 2.0
These Terms of Service ("ToS") set out the operational rules governing how VeriLink services are accessed and consumed. They supplement the Terms and Conditions above and apply to all registered users of the platform.