Effective date: 16 September 2026
Verificient Technologies Inc.
300 Witherspoon Street, Suite 201, Princeton, New Jersey 08542
Contact: privacy@verificient.com
This Policy explains how long we keep information collected through Meritclaw, how it is destroyed, and what control you and the organization that invited you have over it. It supplements the Meritclaw Privacy Policy. Section 5 is our written retention schedule for biometric identifiers and biometric information under the Illinois Biometric Information Privacy Act (740 ILCS 14/15(a)) and comparable laws.
This Policy applies to you if you are a Candidate or Employee whose information is processed through Meritclaw, wherever you are located. Meritclaw is used for remote hiring, and our default retention periods are set to be defensible under the strictest data protection laws that may apply to you.
The Client Organization that invited you is the data controller. It decides what is collected, how long it is kept within the limits below, and how the results are used. Verificient is the data processor: we hold your information on the Client Organization's behalf and for no purpose of our own.
Meritclaw is not the employment record. Recordkeeping duties under employment law rest with the employer. We delete on the schedule below regardless of what the Client Organization may separately need to keep, and we give it the means to retrieve what it needs before we do.
| Term | Meaning |
|---|---|
| Client Organization | The employer, staffing agency, recruiter, or training provider that has engaged Verificient and invited you to use Meritclaw. The data controller. |
| Candidate / Employee | A Candidate uses Meritclaw as part of an application for employment. An Employee uses it as part of a training programme run by their existing employer. |
| Biometric Identifier | A record of face geometry. Meritclaw collects no other biometric identifier. |
| Biometric Information | Information based on a Biometric Identifier and used to identify an individual. |
| Verification Checkpoint | A point at which Meritclaw confirms your identity: enrollment, or the start of an assessment, interview, or training session. |
| Baseline Reference | The live facial image captured at a Verification Checkpoint, held so your identity can be confirmed at the next one. A new Baseline Reference is captured at each Verification Checkpoint. |
| Session | A single monitored assessment, interview, or training activity. |
| Session Media | Video, audio, screen, secondary-camera, and room-scan recordings from a Session. |
| Integrity Event Log | A record of integrity events detected during a Session, held against a session identifier rather than your name, email, or image. |
| Integrity Export | A package the Client Organization may retrieve before Session Media expires: the face captured during the Session, the list of integrity events, and the supporting image for each event. |
| Destroy | Permanent and irreversible deletion. |
Each period runs from the date the information was captured, or from your last activity, and does not depend on the Client Organization taking any action. Nothing is kept indefinitely.
| Category | Retention period | Measured from |
|---|---|---|
| Baseline References (face captures) | 30 days | Date of capture |
| Session Media | 30 days | Date of capture |
| Frames sampled during a Session for identity comparison | Not stored | — |
| Profile data (name, email, identifiers) | 30 days | Your last activity |
| Scores, transcripts, assessment responses, resume data | 30 days | Date of capture |
| Identity match results (score, verdict, timestamp) | 30 days | Date of capture |
| Integrity Event Log (no name, email, or image) | 12 months | Date of capture |
| Consent records | 3 years | Date given or withdrawn |
| Device and system telemetry | 90 days | Date of capture |
| Access and audit logs | 12 months | Log creation |
| Support tickets | 24 months | Ticket closure |
| Billing records | 7 years | Invoice date |
| Anonymized session statistics | Indefinitely; these identify no individual | — |
Meritclaw does not collect government-issued identity documents. If that changes, this schedule will be updated before collection begins.
Meritclaw is not intended for use by anyone under 16. If we learn that information has been collected through Meritclaw from someone under 16, we Destroy it and notify the Client Organization, regardless of the periods above.
A Client Organization may lengthen retention within these limits. Values outside them are rejected by the platform. An extension applies only to information captured after the change; information already collected keeps the period that applied when it was captured.
| Category | Minimum | Maximum |
|---|---|---|
| Baseline References (face captures) | 30 days | 3 months |
| Session Media | 30 days | 12 months |
| Profile data, scores, transcripts, assessment responses, resume data | 30 days | 12 months |
| Integrity Event Log | 3 months | 12 months |
Face captures are capped at 3 months regardless of any other setting. A face capture exists only to confirm your identity at the next Verification Checkpoint; no hiring process needs it held longer. Session recordings and records may be kept longer by a Client Organization that needs them for its own compliance or dispute-resolution purposes.
The 30-day defaults are designed to be lawful wherever you are, including under the GDPR's strict-necessity standard for biometric data. A Client Organization that extends retention does so as data controller, on its own responsibility, and is responsible for ensuring the extension is lawful for the candidates it invites.
5.1 What we collect and what is stored
At each Verification Checkpoint, Meritclaw captures a live image of your face — a Baseline Reference. During a Session, frames are sampled at intervals (by default every 10 seconds) and compared against the most recent Baseline Reference. The sole purpose is to confirm that the person at each checkpoint and throughout each Session is the person who was invited.
Only Baseline References are stored. Sampled frames, and any representation of face geometry derived from them, exist in memory for the duration of the comparison and are not written to storage, temporary files, logs, or backups. What is recorded is the outcome: a similarity score, a match verdict, and a timestamp. Face matching is performed entirely on infrastructure controlled by Verificient. No third-party service receives your image, the sampled frames, or any representation derived from them.
5.2 How long each Baseline Reference is kept
Each Baseline Reference is captured for one purpose: to confirm your identity at the next Verification Checkpoint. That purpose is satisfied when the next checkpoint occurs and a new Baseline Reference is captured, or it expires when no further checkpoint occurs within the retention period.
Each Baseline Reference is therefore Destroyed 30 days after capture, or at the end of any longer period the Client Organization has configured, and in no case later than 3 months after capture. A new capture at a later checkpoint starts a new period for that image only. If more than the retention period passes between checkpoints, you will be asked to complete a new enrollment capture before continuing.
5.3 Destruction schedule
We permanently Destroy Biometric Identifiers and Biometric Information on the earliest of:
Items 5 and 6 cannot be extended by any Client Organization configuration. Destruction is suspended only by a valid warrant, subpoena, or court order, or by a legal hold that specifically identifies biometric data.
5.4 What we do not do
We do not sell, lease, trade, or otherwise profit from Biometric Identifiers or Biometric Information. We do not use them to train, tune, or evaluate machine learning models. We disclose them only to the relevant Client Organization, to service providers that host our infrastructure, or where required by law. After a Baseline Reference is Destroyed, only the verification outcome remains — a score, a verdict, and a timestamp — and it contains no image or representation of face geometry.
Where you are an Employee using Meritclaw for internal training or upskilling:
Biometric verification is off by default. It is enabled per programme, only after the organization issuing the programme confirms to us that it produces a credential, attestation, or certification for which identity verification is required. Where enabled, Meritclaw issues a certificate confirming the Session was completed by the verified individual under integrity monitoring.
If you cannot complete facial verification, or object to it for a protected reason. Where you are unable to complete facial verification because of a disability, or object to it on religious or other legally protected grounds, your employer is responsible for providing an alternative means of completing and verifying the training. Contact your employer before beginning the programme. Meritclaw does not provide an in-session bypass. Declining biometric verification does not exempt you from training your employer requires; it changes how completion is verified, not whether it is required.
Where consent must be voluntary. Some states restrict whether an employer may require biometric consent as a condition of employment for training. Where you are in such a state, your employer must treat biometric verification as voluntary and may not penalize you for declining it.
Retention follows Section 3. A new Baseline Reference is captured at each training Session and Destroyed 30 days after capture. Completion records may be configured up to 12 months; where sector rules require longer, the record is exported to the employer's systems.
Access, correction, and deletion. The Client Organization that invited you is the data controller. Make requests about your information to it directly; it can delete your information from Meritclaw itself, immediately, without our involvement. If you contact us, we will tell you which Client Organization to approach.
Withdrawing biometric consent. You may withdraw consent at any time through the link provided at enrollment. Withdrawal takes effect from that moment forward: no new Baseline Reference will be captured without asking your consent again, and any Client Organization with an active process involving you is notified. Withdrawal is not retroactive; Baseline References already captured are Destroyed on the schedule in Section 5, and verification outcomes already recorded are not invalidated.
Illinois applicants. Where a recording of an interview has been captured through Meritclaw and analysed for integrity purposes, you may ask the Client Organization to have it Destroyed. On its instruction we Destroy the recording and all copies, including backups, within 30 days, and confirm in writing. Because Session Media is Destroyed 30 days after capture by default, this will often already have occurred.
What you are told at enrollment. Before your first Baseline Reference is captured, you are shown what Meritclaw collects, how long each category is kept, that the Client Organization may retrieve an Integrity Export before expiry, and how to withdraw consent.
We suspend scheduled Destruction where litigation is reasonably anticipated, or on receipt of a discrimination charge, subpoena, or regulatory inquiry, or during a security investigation. Holds are scoped to specific individuals, Sessions, or date ranges, never applied platform-wide, and reviewed quarterly. When a hold is released, the affected records are Destroyed within 30 days.
Your information is stored in encrypted cloud storage in categories matching the retention periods in Section 3, each configured to Destroy objects automatically at the end of its period. Destruction follows NIST SP 800-88 Rev. 1 guidance and covers primary storage, replicas, and backups; backups run on a rolling 35-day cycle and are not selectively restorable to recover Destroyed information. We confirm quarterly that information past its retention period is absent.
We do not use Session Media, Baseline References, sampled frames, transcripts, or assessment responses to train, fine-tune, or evaluate AI or machine learning models. We do not use your information for marketing, for profiling outside the authorized workflow, or for sale or disclosure to data brokers, and we do not attempt to re-identify anonymized information.
If we become aware of a security incident that may have compromised Baseline References or any other Biometric Information, we will: contain the incident and preserve evidence; identify the Client Organizations and individuals affected; invalidate affected Baseline References so they cannot be used for any subsequent identity match, requiring a fresh capture; and notify each affected Client Organization without undue delay, with the information it needs to meet its own obligations to notify affected individuals and regulators.
Because the Client Organization is the data controller, it is responsible for notifying you and any regulator where the law requires it. We support that notification and cooperate with the Client Organization's response. This Section is our protocol for responding to a data security incident involving biometric identifiers, as required by the Colorado Privacy Act and comparable laws.
Meritclaw is operated from the United States and your information is stored in United States cloud regions. Service providers that host our infrastructure are contractually bound to retention no longer than this Policy allows; none performs face matching or receives sampled frames or derived representations of face geometry. Where Meritclaw sends results to a Client Organization's applicant tracking system or operates alongside a conferencing platform, retention inside those systems is governed by that organization's own policies. Deleting information from Meritclaw does not delete copies held elsewhere.
Integrity Export. A Client Organization that needs a durable record of a Session may configure Meritclaw to deliver an Integrity Export before expiry — the face captured during the Session, the integrity events, and the supporting image for each — to an endpoint it designates or as a download. It does not contain the full Session recording. Once retrieved, the Integrity Export is held by the Client Organization under its own policies.
End of contract. A Client Organization's contract ends when its paid access period ends. We then Destroy all information associated with it on the schedule in Section 3, except records under legal hold, billing records, and anonymized statistics. A certificate of destruction is available on request.
We review this Policy at least annually and on any material change to Meritclaw or applicable law. Changes are published here with an updated effective date. A change that would extend retention does not apply to information already collected; that information remains governed by the Policy in effect when it was collected.
Questions about this Policy: privacy@verificient.com. For requests about information held about you, contact the Client Organization that invited you.