Privacy Notice
What we collect, why, how long we keep it, and the rights you have over it.
Last updated: July 17, 2026
Who we are
Cognau (an Altailab product) provides liveness verification: a short camera check that confirms a live human is present. Contact for anything in this notice: [email protected].
Two roles apply. When you complete a verification inside another organization's product, that organization is the controller and Cognau is its processor. For this website (and our waitlist), Cognau is the controller.
Verification sessions
- What: live video of your face during the check, signals derived from it, basic device and connection information (browser type, screen properties, IP address), and the verification result.
- Why: to verify that a live human is present and to protect the check against fraud. The analysis is automated, and you are informed of this at the time of the check; no verification runs without your explicit consent given on the consent screen.
- Legal basis: your explicit consent (GDPR Art. 9(2)(a)) for biometric processing; legitimate interest for fraud-prevention signals that are not biometric.
- How long: video frames are automatically deleted within 24 hours. The session record that remains (the result, the scores, and the device and connection information above, never any images) is kept for the duration of our contract with the organization you verified with. The full schedule, including the optional opt-in face template, is published in our Biometric Data Policy.
We never collect your name, government ID, or address during a liveness check, we do not compare your face against any database unless you explicitly opt in to re-recognition, and we never sell personal data.
This website
If you join the waitlist we store what you submit (name, work email, phone if you give one, company, company size, and sector) together with the IP address and browser user-agent of the submission, and we use it only to contact you about Cognau.
Analytics and cookies. This site uses a self-hosted, cookie-free analytics service to count page views, and Google Analytics, which sets cookies in your browser and shares aggregate usage measurement with Google. Neither is used on the verification screen itself, and neither receives biometric data. You can block both with any standard tracker-blocking extension or browser setting.
Who processes data for us
We use a small number of infrastructure providers (hosting, databases) and, for this website only, analytics providers including Google, under contracts that require confidentiality and compliance with applicable data-protection law. A current list of sub-processors is available on request at [email protected].
Your rights
Depending on where you live (including under GDPR and US state biometric-privacy laws), you can: access the data we hold about you, correct it, delete it, object to or restrict processing, receive a portable copy, and withdraw consent at any time. Withdrawing is as easy as giving it and doesn't affect completed verifications. To exercise any of these, email [email protected] or contact the organization you verified with. You also have the right to complain to your data-protection authority.
Changes
We'll update this page and its “last updated” date before any material change takes effect.