Biometric Data Policy
How we collect, retain, and permanently delete biometric data — in plain language.
Last updated: July 17, 2026
Who this covers
Cognau provides liveness verification: a short camera check that confirms a live human being is present — not a recording, mask, or deepfake. We run these checks on behalf of the organizations that integrate Cognau (“our customers”). For verification sessions, the customer is the data controller and Cognau acts as their processor. This policy is our public written retention and destruction schedule for biometric data.
What biometric data we collect
- Live face video captured by your camera during the verification session, together with measurements derived from it (for example, head pose and how you respond to on-screen prompts).
- Optional face template — only if you explicitly opt in on the consent screen: a mathematical representation (a list of 512 numbers) derived from your face, used solely so the organization you're verifying with can tell whether the same person returns. It is not a photograph and cannot be used to reconstruct your face.
We never collect your name, government ID, or address as part of a liveness check, and we never sell, lease, trade, or otherwise profit from biometric data.
Retention schedule
| Data | Retained for | Then |
|---|---|---|
| Verification video frames | Analyzed in real time; automatically deleted within 24 hours of capture | Permanently destroyed |
| Verification result (pass/fail and scores — no images) | Per our contract with the requesting organization | Deleted at contract end |
| Optional face template (opt-in only) | Until you or the organization request deletion, the organization ends its use of Cognau, or 3 years after your last verification — whichever comes first | Permanently destroyed |
Destruction is automatic: expiry is enforced directly in our databases, not by a manual process that can be forgotten.
Disclosure
We do not disclose biometric data to anyone except: (a) the organization that requested your verification, which receives the verification result; (b) service providers that host our infrastructure under contractual confidentiality and data-protection terms; or (c) where required by law. We never sell biometric data.
Requesting deletion
You can request deletion of your data — including an opted-in face template — at any time by emailing privacy@cognau.com or by contacting the organization you verified with. Withdrawing consent is as easy as giving it and does not affect verifications already completed.
Changes
If we change this schedule, we will update this page and its “last updated” date before the change takes effect. See also our Privacy Notice.