Overview
This notice explains how the Human Proof app, operated by DNIWallet SL (the data controller), handles your information. Human Proof verifies that a real, live person is present — not a photo, video or AI‑generated image. The verification runs entirely on your device; face data is never stored, transmitted or shared.
Face data & liveness verification
When you use a verification feature, the app captures images from your device's front camera and, on supported devices, depth information from the TrueDepth sensor. From these it derives a temporary liveness‑detection template and 3D facial geometry, used only to compute a liveness score — that is, to determine whether the face in front of the camera is real or spoofed. This face and depth data may constitute biometric data (a special category under Article 9 GDPR); because it is processed on‑device, ephemerally, and is never stored, the associated risk is minimised.
On‑device processing — no transmission
All camera images, TrueDepth depth maps and derived facial geometry are processed on your device only. They are held in memory strictly for the duration of the verification and discarded immediately once it completes. This data is never sent to our servers or to any third party.
On iPad, the operating system may automatically adjust the camera framing to keep you centred. This adjustment is performed entirely by the device, and no images leave it.
Verification result
When a website or an app asks you to prove that you are a real person, Human Proof sends the result of the check to that website. Your face is never sent. Together with the result go the model of your device and a security token issued by Google Play or by Apple. Our verification service signs that result and encrypts it before it reaches the website.
The website creates the key in your browser and the key never leaves your browser, so only that website can read the result. Nobody else can, and we cannot read it either. The result contains no name, no account and no identity. It is valid for two minutes. It is deleted as soon as the website collects it, and always within 24 hours.
TrueDepth
On supported devices, the Human Proof app uses the TrueDepth API to read the three‑dimensional shape of the face and distinguish a real, live person from a photo, a video or an AI‑generated image — this is the core of the liveness check. Your consent is requested beforehand. Data obtained from TrueDepth is not stored or shared with third parties. The check is always performed inside the iPhone.
How we use it
We use this data solely to provide you with a secure and accurate verification that you are a real person. We do not use it for any other purpose — in particular not for advertising, marketing, profiling, or identifying you.
Retention of face data
Face data is not stored or retained in any way. It exists only in device memory during the verification and is deleted as soon as the check finishes.
Sharing and disclosure
We do not share, sell, rent or disclose your face data to any third party. TrueDepth data is used exclusively for the app's core liveness feature and is not shared, consistent with Apple's requirements for use of the TrueDepth API.
Legal basis (GDPR)
Where the GDPR applies, we process this data on the basis of your explicit consent (Articles 6(1)(a) and 9(2)(a)), given by choosing to use the verification feature. You may withdraw at any time by not using the feature; because no face data is stored, there is no retained face data to erase.
Camera permission
The app requests access to your camera solely to perform the verification. You can manage this permission in your device settings; without it, the verification feature cannot function.
Security
We take the security and privacy of your face data seriously and use industry‑standard security measures to protect it against unauthorised access, disclosure, alteration or destruction.
Your choices
You may request access, correction or deletion by emailing info@dniwallet.com. Since Human Proof does not store face data, requests relating to that data will typically confirm that no such data is held.
Publisher and contact
DNIWallet SL
Plaza de Pablo Ruíz Picasso, planta 14ª, 28020 Madrid, Spain
Email: info@dniwallet.com
Changes
We will update this notice as the project and its services evolve, with material changes clearly dated.