Privacy Policy

1 Introduction

BIOPIA ("we," "us," or "our") operates a palm vein biometric authentication and digital loyalty platform accessible through our mobile application (the "App") and associated physical terminals. This Privacy Policy explains how we collect, use, store, protect, and share information about you when you use BIOPIA services.

We are committed to protecting your privacy and handling your personal data — including sensitive biometric information — with the highest standards of security and transparency. This policy is designed to comply with applicable data protection laws, including GDPR principles, Kuwait Law No. 20 of 2014 on Electronic Transactions, and Apple's App Store privacy requirements.

By downloading, installing, or using the BIOPIA App, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of the App immediately.

2 Information We Collect

2.1 Personal Information

• Identity data: Full name, display name, and username
• Contact data: Email address and, where provided, phone number
• Account credentials: Encrypted password hash (never stored in plain text)
• Profile data: Optional profile picture uploaded by you
• Transaction data: Loyalty card redemptions, QR code scans, and payment interactions at BIOPIA-enabled terminals

2.2 Biometric Information

• Palm scan data: Captured via the device camera or a dedicated BIOPIA terminal scanner during enrollment and authentication
• Biometric feature vectors: Mathematical representations derived from your palm scan (raw images are not retained after feature extraction)
• Enrollment metadata: Timestamp, device identifier, and software version used during biometric enrollment

Biometric feature vectors are stored in isolated, access-controlled database partitions, encrypted using AES-256 at rest and TLS 1.3 in transit. Biometric data is never used for advertising, profiling, or any purpose other than authentication within BIOPIA services.

2.3 Camera Permission

2.4 Device and Technical Data

• Device identifiers: Device model, OS version, and unique device ID
• Network data: IP address and connection type
• App usage data: Session timestamps, feature interactions, and error logs
• Terminal interaction data: Records of which physical BIOPIA terminals you have interacted with and when

3 How We Use Your Information

4 Legal Basis for Processing

• Contractual necessity: Processing required to provide the BIOPIA service you have requested.
• Explicit consent: For the collection and processing of biometric data. You provide explicit, informed consent during enrollment and may withdraw it at any time.
• Legitimate interests: Security monitoring, fraud prevention, and service improvement.
• Legal obligation: Retaining transaction records and audit logs as required by applicable financial and electronic transaction regulations in Kuwait and the GCC.

5 Data Sharing & Third Parties

BIOPIA does not sell, rent, or trade your personal or biometric data. We share data only in the following limited circumstances:

5.1 Service Providers

• Cloud infrastructure: Neon (PostgreSQL database hosting) — stores encrypted user and transaction data under a Data Processing Agreement
• Application hosting: Vercel Inc. — hosts the BIOPIA API and web services
• Email delivery: Resend Inc. — used solely to send transactional emails; no marketing use

5.2 Business Partners (Merchants)

When you use BIOPIA at a merchant terminal, the merchant receives only a pseudonymous user identifier and the transaction result. Merchants do not receive your biometric data, email address, or full name unless you have explicitly consented.

5.3 Legal Disclosure

We may disclose your information if required by law, court order, or governmental authority in Kuwait or other applicable jurisdictions.

6 International Data Transfers

BIOPIA is operated from Kuwait. Your data may be processed on servers located in the United States (via Neon and Vercel infrastructure). We ensure appropriate safeguards are in place, including encryption of all data in transit (TLS 1.3) and at rest (AES-256), and contractual data processing agreements with all sub-processors.

7 Data Retention

8 Security & Encryption Measures

• Data in transit: All communications are encrypted using TLS 1.3.
• Data at rest: All database records, including biometric feature vectors, are encrypted using AES-256.
• Passwords: Hashed using bcrypt — plain-text passwords are never stored or logged.
• Biometric templates: Stored in a separate, isolated database partition, never co-located with personally identifiable information.
• Access controls: Multi-factor authentication required for all internal system access; all administrative access is logged.

9 Your Rights

You have the following rights with respect to your personal data. To exercise any right, contact us at support@biopia.ai. We will respond to all verified requests within 30 days.

10 Children's Privacy

BIOPIA is intended exclusively for individuals who are 18 years of age or older. We do not knowingly collect personal data or biometric information from individuals under the age of 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at support@biopia.ai.

11 Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date and send an in-app notification and/or email to registered users at least 14 days before the changes take effect.

Your continued use of BIOPIA after the effective date constitutes acceptance of the updated policy.

12 Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us: