Verifast Privacy Policy 

Who this covers: rental applicants (and co-applicants/occupants/guarantors). Your consumer-report rights are referenced where relevant. 

1. Our role, and two categories of data

Verifast is an identity, income, and background screening platform. We are engaged by property owners, managers, and their representatives ("Housing Providers" / "Clients") to collect, verify, and screen applicant information on their behalf, and we share the information we collect and the screening results with the Housing Provider to which the applicant applied. In doing so we act as a consumer reporting agency ("CRA").

Your information falls into two categories, which have different rules:

• Consumer-report data — information we collect and use to prepare a consumer report (credit, criminal/eviction, income and identity verification feeding the report). This is regulated by the federal Fair Credit Reporting Act (FCRA) and similar state/provincial laws, and many general privacy-law rights are handled through those laws instead.

• Other data — website/marketing data, account data, and any information used outside the consumer-reporting purpose. General privacy-law rights apply to this data. 

2. Information we collect

• Identity & government ID: name, date of birth, address, ID number, and images of your government ID.

• Biometric / facial information: one or more selfie/face images, and the numeric results of comparing your face to your ID (a face-geometry match used to confirm it is you — not just the photos themselves). See Section 6. 

• Financial / bank data: account information and up to two years of transaction history when you connect a bank account; or the contents of bank statements you upload. We do not receive your online-banking credentials.

• Income & employment: from payroll connections and/or documents.

• Consumer-report data: credit report information, and criminal/eviction records, from consumer- reporting sources, when the Housing Provider's screening includes them.

• Documents: pay stubs, bank statements, tax and benefit documents, offer letters, and similar.

• Contact & application data: email, phone, application answers, household/guarantor details.

• Device, network & location data: IP address, device and browser information, and approximate location, collected during your session. 

• Usage & analytics data: how you interact with the application, including via session-analytics tools (Section 7).

3. Where we get it

From you; from your bank through a third-party data provider (MX, Plaid); from your payroll provider through an employment-verification provider (Atomic), if you connect payroll; from the identity provider (Persona); from consumer-reporting sources (for example TransUnion for credit, and Cleara for criminal/eviction records); from documents you upload and the services that extract data from them; and from the Housing Provider that invited you.

4. How we use it

To verify your identity, income, and history; to prepare and deliver screening results to the Housing Provider; to operate, secure, and improve the platform; and to comply with law. We do not sell the information you provide for tenant screening, and we do not use your screening information to serve you advertising. 

5. Who we share it with

• The Housing Provider (Client) you applied to, and its authorized representatives — this is the core of the service: your information and screening results are shared with them so they can evaluate your application. This may include delivery of your report to the Housing Provider's property-management system (for example Yardi, Entrata, RealPage, or Knock), and — where the Housing Provider has configured it — automated delivery of your verification results to the Housing Provider's own systems. The information shared with your Housing Provider can include identifying information such as your Social Security number and date of birth, and the images of your ID and selfie, depending on the Housing Provider's configuration and screening. 

• Service providers who process data on our behalf. These include, depending on your Housing Provider's screening:  bank-data providers (MX, Plaid); the identity-verification provider (Persona, which receives your ID photo and selfie); the SSN-verification provider (Persona); the employment/payroll-verification provider (Atomic); consumer-reporting sources (TransUnion for credit; Cleara for criminal/eviction); document-processing services that convert, extract, and fraud-check your documents (ConvertAPI, Google (Gemini), Resistant AI); face-comparison (AWS Rekognition); our screening-enrichment service (Veribots, our in-house service, which uses OpenAI and Google for AI analysis, and Render, Inngest, Mastra Cloud, and Braintrust to host, run, and monitor these services); our document-generation/PDF provider (apitemplate.io); address verification (Smarty); analytics/error monitoring (Google Analytics/Ads on the marketing site; Microsoft Clarity, PostHog, Segment, Sentry in the application); data warehousing (Snowflake, via Estuary replication); support (Zendesk); and communications (AWS SES email, Twilio SMS). 

• Legal and safety: to comply with law, respond to lawful requests, and protect rights and safety.

• Corporate transactions: in a merger, acquisition, or similar event. We share consumer-report information only for permissible purposes under the FCRA.

6. Biometric information

When you complete identity verification, we collect and store facial images and the results of comparing your face to your ID (a face-geometry match). We use this only to verify your identity for your application. We do not sell it or use it to train AI models.  Our retention of this information is described in Section 8, and how to contact us about it is in Section 14; your consent to it is addressed in this Section and in the Terms & Conditions (Section 5). Depending on your Housing Provider's configuration, the images of your ID and selfie may be viewable by the Housing Provider along with your verification result; some Housing Providers restrict this for their staff under local law.  Where required (for example under the Illinois Biometric Information Privacy Act), we obtain your consent before collection and publish our retention and destruction schedule. If you choose not to consent, contact your Housing Provider about alternatives they may offer under their own policies. 

7. Cookies, analytics, and session tools

We use cookies and analytics, and session-analytics/replay tools (for example Microsoft Clarity, PostHog, and Segment), to understand and improve how the application works.  We also use an error-monitoring tool. You can control cookies through your browser settings. 

8. How long we keep it

We retain personal information for as long as necessary to provide the screening service, to comply with legal and consumer-reporting obligations, and as otherwise permitted by law. Some of the raw technical data we receive from verification sources is automatically cleared on a short cycle. Other information — including your identity-check images and the results of comparing your face to your ID — together with the verified records we produce (such as income, credit and criminal/eviction results, and identity details) is kept for as long as the purposes above require and as the law requires; we do not delete this information on a fixed schedule.  You may ask us to deactivate your record at any time (Section 11); we retain the underlying data as described here and as required by law. 

9. How we protect it

We use administrative, technical, and physical safeguards designed to protect your information. No method of transmission or storage is completely secure. 

10. Where we process it (cross-border)

Verifast, Inc. is headquartered in Belleville, Ontario, Canada. We process and store applicant information in the United States, on Amazon Web Services. If you apply from outside the US, your information is transferred to and processed in the US. 

11. Your rights

• US state privacy rights (California and other states): depending on your state, you may have rights to know, access, correct, and delete personal information, and to opt out of sale/sharing. Many of these rights do not apply to information governed by the FCRA, which is handled through your consumer-report rights (below). 

• Sensitive personal information: we collect information treated as "sensitive" under some state laws — your Social Security number, government-ID and biometric/facial data, and financial account information. Where the law provides it, you may request that we limit the use of this information to what is necessary to provide the service. 

• Opt out of sale/sharing: we do not sell your screening information, and we do not share it for advertising (§4). We honor Global Privacy Control (GPC) browser signals. 

• Consumer-report (FCRA) rights: you may request a copy of your file and dispute inaccurate information by contacting us (Section 14). 

• Canada: you may request access to and correction of your personal information (PIPEDA and provincial law). You can unsubscribe from our commercial electronic messages at any time. 

• How to exercise: contact us at the address/email in Section 14. We will verify your identity before acting on a request and respond within the time the law requires (for example, 45 days under the CCPA/CPRA, extendable once by 45 days; other states' and Canada's timelines as applicable). 

12. Automated decisions

Our platform generates screening results and, depending on the Housing Provider's configuration, an automated recommendation about your application. The leasing decision is made by the Housing Provider or, where a Housing Provider has engaged us to apply its criteria, by Verifast on the Housing Provider's behalf. You always have the right to dispute the accuracy of information in your file (Section 11), and where the result leads to an adverse action you will receive the notices required by the FCRA and applicable law. 

13. Children

The application is intended for adults. We do not knowingly collect personal information from children: household members under 18 are recorded only as a count, without names or other personal details, and credit/criminal screening requires the applicant to be at least 18. 

14. Changes and contact

We will post changes here and update the effective date; material changes will be communicated as required. Contact: Verifast, Inc., 1 Bridge Street East, Suite 400, Belleville, Ontario K8N 5N9, Canada; support@verifast.com.