Privacy Policy & Notice

1. Introduction

1.1 We are Seventh Sense Artificial Intelligence Private Limited, a company incorporated in Singapore with our registered office at 36 Robinson Road, #20-01, Singapore 068877 (“Seventh Sense AI”, “we”, “us” or “our”). We develop and operate the SenseCrypt Authenticator — a biometric authentication platform consisting of:

• A consumer mobile application (“App”) available on Android and iOS;
• A cloud-hosted SaaS portal (“Portal”) available at https://app.sensecrypt.com/ through which users register and manage their OIDC and SAML authentication clients; and
• A Face-Token Minter (“Minter”) that can be hosted by Seventh Sense AI.

1.2 This Privacy Policy and Notice (“Policy”) explains how we collect, use, store, share, and protect personal data when you use the App or the Portal, and sets out your rights under applicable data protection law.

1.3 By downloading, installing, registering for, or using the App or the Portal, you acknowledge that you have read and understood this Policy. If you do not agree, you must cease using our services and, where applicable, delete your account and uninstall the App.

1.4 This Policy is accessible at any time from the Settings screen of the App. It covers Seventh Sense AI's own processing of your personal data. Where you sign in to a Relying Party's service through the App, that Relying Party's own privacy notice governs how the Relying Party processes your data as data controller.

2. Legal and regulatory framework

2.1 This Policy has been adopted in accordance with our obligations under applicable privacy and data protection law, including:

• EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”);
• UK General Data Protection Regulation and UK Data Protection Act 2018 (“UK GDPR”);
• Singapore Personal Data Protection Act 2012 (“PDPA”);
• California Consumer Privacy Act 2018 as amended by the California Privacy Rights Act 2020 (“CCPA/CPRA”), for California residents; and
• Other applicable national and regional data protection laws in jurisdictions where the App is made available.

3. Your regulatory responsibilities

3.1 If you integrate SenseCrypt Authenticator to authenticate others (a “Relying Party” or “RP”), you are the data controller for all personal data processed through your integration. Seventh Sense AI acts solely as your data processor, whether or not self sign-up is enabled and whether your users are employees or consumers.

3.2 Whether an end-user privacy notice is required depends on whether you enable self sign-up for your application, not on whether your users are employees or consumers:

3.3 In all configurations, you remain the data controller and are responsible for obtaining any required consents or establishing another valid legal basis under applicable data protection law, including for biometric processing, before enabling authentication for your users.

4. Eligibility and age restriction

4.1 The App is intended for users who are 16 years of age or older. By registering for and using the App, you represent and warrant that you are at least 16 years old. We do not knowingly collect personal data from individuals under the age of 16.

4.2 If we become aware that we have inadvertently collected personal data from a person under the applicable minimum age, we will take immediate steps to delete that data and disable the relevant account. Please contact dpo@seventhsense.ai if you believe a minor has registered without proper consent.

5. Personal data we collect

We process only what is necessary to provide and secure authentication services.

A. Mobile App — end-user authentication data

B. Mobile App — registration and self sign-up data

The App collects your email address to create and identify your account. Email is the only profile field the App requires for its own purposes.

Where a Relying Party enables self sign-up, the App may present additional registration fields and a consent step. Those fields are configured, determined, and governed by the Relying Party as data controller — not by Seventh Sense AI. The App displays the Relying Party's own terms of service and privacy notice at the consent step, records your acceptance on the Relying Party's behalf, and transmits the information you provide to the SaaS for the Relying Party. What is collected in that flow, and how it is used, is described in the Relying Party's privacy notice, which is shown to you before you provide any such information. We act only as a processor for that data.

6. Special notice: biometric data

6.1 The SenseCrypt Authenticator uses facial biometrics as the authentication factor. This section explains how face data is handled at every stage.

How the App processes your face

When you authenticate, the App activates your device camera to capture a live facial image. This image is processed entirely in memory on your device by the SenseCrypt mobile SDK, which performs liveness detection and uses the image as a cryptographic decryption key to unlock a sealed authentication token (the face_token) fetched from the Portal. Once the decryption attempt is complete — whether successful or not — the live face image is immediately discarded from device memory. It is never written to disk, never stored, and never transmitted to Seventh Sense AI or any third party.

The face_token is an AEAD-encrypted opaque ciphertext. It flows from the Portal to your device — your face is used to open it on-device, not to generate something sent to a server. No biometric data, biometric template, facial geometry, or facial feature vector is transmitted in any direction.

Where your face image is processed depends on how you enrol

SenseCrypt converts a face image into a sealed authentication token (the face_token) using the Face-Token Minter, a firewalled service operated by Seventh Sense AI. The Minter detects a single face in the image and generates the sealed token, which is cryptographically bound to the relevant organisation and contains no reconstructable biometric data. The Minter keeps no database of its own.

In both cases, Seventh Sense AI stores no face image, biometric template, or facial-feature data — only the sealed token, which cannot be reversed to reconstruct a face.

Summary

6.2 Seventh Sense AI does not sell, lease, trade, or otherwise profit from biometric data.

6.3 Where biometric data is processed, the RP as data controller is responsible for obtaining valid consent or establishing an appropriate legal basis under applicable data protection law before enabling authentication for their end-users.

7. How we use personal data

We process personal data only for the purposes below and only to the extent necessary to provide authentication services.

8. App permissions

The App requests only the permissions strictly necessary to provide authentication services:

No other device permissions are requested. You may manage permissions at any time through your device operating system settings.

9. Data retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy. All personal data tied to an account is deleted upon the controlling organisation actioning your erasure request on your behalf.

The organisation that provides your SenseCrypt access is the data controller for your account. To have your data erased, submit your request to that organisation. As its processor, Seventh Sense AI will action the deletion on its instruction, removing your identity, device, device-key, push token, self sign-up, consent, and sign-in records.

10. Third-party sub-processors

We engage the following third-party sub-processors, each bound by appropriate data processing agreements. No biometric data is shared with any sub-processor.

We do not share personal data with third parties for advertising or data brokerage purposes. We do not sell personal data.

11. Cross-border data transfers

11.1 Our SaaS infrastructure is hosted on Amazon Web Services (AWS) in the European Union ([specify region — e.g. eu-central-1, Frankfurt]). Personal data you provide is processed and stored in the EU, including transactional email via Amazon SES. Certain limited personal data is also processed by the following sub-processors, which may process it in the United States or globally:

• Google LLC — Firebase Cloud Messaging: sign-in push notifications; processes your device push token.

11.2 Because our infrastructure is in the EU, personal data of EEA and UK users is not transferred outside the EEA or UK for hosting. Where limited data is transferred to a sub-processor in the United States (Google), we rely on the EU Standard Contractual Clauses and, for UK data, the UK IDTA or Addendum. For users outside the EEA or UK (for example, Singapore), personal data is processed and stored in the EU under contractual safeguards consistent with PDPA transfer-limitation obligations. Device-integrity checks (Apple App Attest and Google Play Integrity) transmit limited technical signals to Apple and Google as platform providers solely for anti-fraud verification; these are not used for tracking or advertising.

11.3 You may request details of the relevant transfer mechanism from the organisation that provides your SenseCrypt access, or from dpo@seventhsense.ai.

12. Your rights

SenseCrypt Authenticator verifies you on behalf of the organisation that provides your access — your employer, or the service where you signed up. For your personal data, that organisation is the data controller and Seventh Sense AI acts as its data processor. You therefore exercise your rights with that organisation, and we support it in fulfilling your request. Its privacy notice — shown to you at sign-up where self-registration is used — tells you how to contact it.

If you are unsure who your controller is, or you have a question about how Seventh Sense AI processes data as a processor, contact dpo@seventhsense.ai and we will direct your request to the right organisation.

13. Security of personal data

Key technical safeguards include:

• AEAD encryption of the face_token with AAD binding to the recipient — the token cannot be re-used for a different identity;
• ES256 signed ID tokens; Argon2id hashing for client secrets and Portal User passwords;
• No face image or biometric template is stored by the SaaS; only the sealed face_token is retained;
• We verify that the App is genuine and unmodified before processing authentication requests, to prevent abuse. This check does not retain a device identifier and is not used to track you;
• All data in transit is protected by TLS 1.2 or higher; and
• Exact redirect_uri matching to prevent OAuth redirect attacks.

We have procedures in place to detect, investigate, and report personal data breaches. Where required by law we will notify the relevant supervisory authority and affected data subjects within the legally required timeframe.

15. Cookies

The Portal uses a signed HTTP-only cookie for session management (HS256 JWT, TTL 1 800 s). This is a strictly necessary cookie required for Portal login. The mobile App does not use browser cookies.

16. Children's privacy

The App and Portal are not directed to children under the age of 16. We do not knowingly collect personal data from children. Contact dpo@seventhsense.ai if you believe a minor has registered without proper parental consent.

17. Changes to this privacy policy

We may update this Policy from time to time. When we make material changes we will notify you by displaying a prominent notice within the App and updating the Effective Date. Continued use of the App or Portal after a revised Policy comes into effect constitutes acceptance of the changes.

18. Contact information and complaints

For any queries, rights requests, or complaints, please contact our Data Protection Officer:

• EEA and UK Users: you may lodge a complaint with your local supervisory authority. The UK supervisory authority is the ICO at ico.org.uk (telephone: 0303 123 1113).
• Singapore Users: you may lodge a complaint with the PDPC at pdpc.gov.sg.
• California Users: you may contact the CPPA at cppa.ca.gov or email dpo@seventhsense.ai.

Google Play Store — data safety disclosure summary

All data is collected solely to provide biometric authentication services. No data is collected for advertising or sold to third parties. No biometric data is shared with any third party.

Apple App Store — privacy nutrition label summary

Data used to track you

None. SenseCrypt Authenticator does not track you across applications or websites owned by other companies and does not use personal data for targeted advertising. No advertising identifiers are collected.

Data linked to you