Privacy

Privacy by design

Human Confirmed does not store the readable contents of your email as part of the verification record. Instead, it stores cryptographic fingerprints that allow a recipient to determine whether the message they received still matches the message the sender approved.

Human Confirmed does not sell biometric information, use it for advertising, or use customer facial images or face templates to train general-purpose facial-recognition or artificial-intelligence models.

This Privacy Notice describes the Human Confirmed product and the public Human Confirmed website. Biometric enrollment also requires a separate, affirmative Biometric Enrollment Consent and Release.

Information Human Confirmed uses

Human Confirmed may process your name and business email address; the identity assigned by your organization’s Microsoft Entra ID or Google Workspace account; facial images captured during enrollment and verification; mathematical face templates created from enrollment images; facial match, liveness, and spoof-detection scores; organization or tenant information; consent records; cryptographic fingerprints associated with an approved email; and audit and security information needed to operate and protect the service.

How enrollment works

The first time you use Human Confirmed to approve an email, your phone browser asks you to capture two selfie JPEG images. Those images are securely transmitted to Human Confirmed. Outlook and Gmail do not receive the camera images.

Our facial-verification service creates a mathematical face template from each image. The two templates become your enrollment and are used to compare future verification attempts. The enrollment is associated with your organization and with the identity supplied by Microsoft Entra ID or Google Workspace.

After successful enrollment, both enrollment JPEGs are permanently discarded. Human Confirmed does not retain an enrollment photograph.

Human Confirmed retains the two encrypted enrollment face templates, enrollment liveness and spoof-detection scores, your mailbox address, organization and identity identifier, and the version of the biometric consent you accepted.

Persistent face templates are encrypted using authenticated AES-GCM encryption. Encryption keys are protected using AWS Key Management Service.

How a later verification works

When you approve another email, your phone browser captures one or more JPEG still images. Human Confirmed creates a temporary face template from the current capture and compares it with the two enrolled templates.

The temporary challenge template exists only in memory while the comparison is performed. It is not written to your enrollment record or to the email attestation and is not retained after the verification operation.

Video is not uploaded or stored. If a verification attempt fails, Human Confirmed does not retain the facial image or temporary face template from that failed attempt.

The image associated with an approved email

When verification succeeds, the JPEG used for the successful face check is encrypted and stored with the email attestation. This allows a recipient who possesses a matching email to see the face image associated with that approval.

The facial image by itself is not proof that a person approved an email. Human Confirmed also verifies that the message presented by the recipient matches the message that was approved by the sender. Human Confirmed does not disclose enrolled face templates to email recipients.

What Human Confirmed stores about the email

Human Confirmed does not need to store the readable email message in the attestation service. Instead, it creates cryptographic fingerprints of information such as the approved message body and recipients. Those fingerprints can later be compared with the recipient’s copy of the message to determine whether it still matches what the sender approved.

Human Confirmed does not store email attachments as part of the facial attestation.

How long an email can be verified

The default attestation lifetime is 90 days. An organization may configure a different period.

After an attestation expires, its verification link no longer confirms the message. A scheduled process deletes expired attestations, including the facial JPEG stored with each attestation, and records an audit entry showing that expired records were removed.

How long an enrollment lasts

The default enrollment period is 180 days without a successful face verification. An organization may configure a different inactivity period. Each successful facial verification resets this inactivity period.

When an enrollment expires because of inactivity, its stored face templates are deleted. The user must enroll again before using Human Confirmed to approve another message. Deleting an inactive enrollment does not invalidate an email attestation that is still within its own verification period.

Revoking or replacing an enrollment

An organization administrator may revoke an enrollment so that it can no longer be used to approve new messages. An enrollment can also be superseded when, for example, a mailbox is reassigned and a new enrollment is created.

Revoked or superseded enrollments immediately become unavailable for future facial comparisons. The biometric information associated with a revoked or superseded enrollment, including its face templates, is permanently deleted within 30 days.

Deleting an enrollment does not automatically remove a still-valid email attestation. Attestations are records of past approvals and remain available until their individual expiration dates unless an authorized deletion request requires them to be removed sooner.

Deleting biometric information

An organization administrator may request deletion of a user’s Human Confirmed information. Information is also deleted when a customer’s Human Confirmed service is terminated.

A biometric deletion removes, as applicable, enrolled face templates, facial JPEGs held on email attestations, session-level facial verification scores, and related biometric data associated with that user or organization. Human Confirmed records an audit entry documenting the deletion. Deletion is a data removal operation, not merely a revocation of access.

Where information is processed and stored

Human Confirmed is hosted on Amazon Web Services infrastructure located in the United States. Facial images and biometric information may therefore be transmitted to, processed in, and stored in the United States.

The camera operates in the user’s phone browser. JPEG still images are securely transmitted to Human Confirmed for facial verification. The facial model processes those images within the Human Confirmed service and does not independently save them.

Microsoft Outlook, Microsoft Entra ID, Gmail, and Google Workspace do not receive camera frames or face templates through Human Confirmed’s facial-verification process. Amazon Web Services is Human Confirmed’s hosting provider and processes information on our behalf as necessary to provide the service.

Security

Stored attestation JPEGs and persistent face templates are encrypted using authenticated AES-GCM encryption, with encryption keys protected through AWS Key Management Service. Human Confirmed databases and underlying AWS storage are also encrypted at rest.

Access to production systems and biometric information is restricted to authorized personnel and services that require access to operate, secure, or support the system. Human Confirmed maintains audit records for important administrative and deletion events.

Your organization

Human Confirmed is primarily provided to organizations. In many deployments, your employer or organization determines who may enroll, how long Human Confirmed records are retained within configurable limits, and when an enrollment should be revoked or deleted.

Applied Recognition Corp. processes information necessary to provide Human Confirmed and to operate and secure the service. Questions about your organization’s use of Human Confirmed may also be directed to your organization’s administrator or privacy contact.

Your choices and rights

Depending on where you live, you may have rights concerning your personal information, including the ability to ask whether Human Confirmed holds information about you; request access or correction; withdraw consent to future biometric verification; ask your organization to revoke your enrollment; request deletion of biometric information; and raise a concern about how your information is handled.

Withdrawing biometric consent prevents the use of your biometric information for future Human Confirmed facial verification. Where applicable law requires a non-biometric alternative, your organization is responsible for providing the applicable alternative.

The Human Confirmed website

The public Human Confirmed website is separate from the Human Confirmed email-verification service.

The website does not use third-party analytics, advertising trackers, or externally hosted font services during normal visits. Human Confirmed does not retain visitor IP addresses or website request logs.

If you submit the website contact or request-a-demo form, the information you provide is sent by email to Applied Recognition Corp. so that we can respond to your inquiry. Information submitted through the website is not used for facial verification or added to a marketing mailing list solely because you submitted an inquiry.

Changes to this notice

We may update this Privacy Notice as Human Confirmed evolves. When changes materially affect how biometric information is collected, used, disclosed, or retained, we will update the notice and, where appropriate, request renewed consent.

Effective date: September 22, 2026

Contact us

Questions or requests concerning privacy or biometric information may be directed to:

Privacy Officer
Applied Recognition Corp.
700 Third Line
Oakville ON Canada
L6L 4B1
privacy@appliedrec.com