Biometric Consent Policy

1. Purpose

This Biometric Information Consent & Policy ("Biometric Policy") explains how Invent LLC ("Company") collects, uses, stores, and destroys biometric identifiers and biometric information in connection with Saha's face verification feature, and sets out the consent Company obtains before any such collection, as required by the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), Washington's biometric privacy law, and analogous requirements Company applies nationwide as its baseline standard.

2. What Biometric Data We Collect

• A facial geometric scan/faceprint generated from a live selfie or short video captured during onboarding and periodic re-verification, used to (a) confirm you are a real, live person (liveness detection) and (b) match your face to your profile photos to deter catfishing and duplicate/fraudulent accounts.
• If you use optional government ID verification, a comparison between your selfie and the photo on your ID (see ID Verification Disclosure).

We do not use facial recognition to identify you against any external database, social media, or public records -- matching is limited to comparing your own submitted selfie against your own profile photos and, optionally, your own ID.

3. Written Release and Consent

Before any biometric data is collected, we present this notice and require you to affirmatively tap "I Consent" (a discrete action, not bundled into general Terms acceptance). By doing so, you provide a written release under BIPA �15(b) and CUBI, acknowledging that:

• Company collects, stores, and may share (only with its verification vendor, strictly to perform the verification) your biometric identifiers/information;
• The specific purpose is identity/liveness verification for account safety and fraud prevention;
• The retention schedule in Section 5 below applies;
• You may withdraw consent by deleting your account, subject to Section 6.

4. How Biometric Data Is Used and Shared

• Used solely for liveness detection, duplicate-account detection, and (if opted in) ID-to-selfie match confirmation.
• Shared only with Company's verification processor(s) under a written contract prohibiting any use beyond providing the verification service to Company, prohibiting further disclosure, and requiring destruction consistent with Section 5.
• Never sold, leased, or traded. Never disclosed to advertisers.
• Not disclosed to law enforcement absent a valid subpoena, warrant, or court order, or your written consent.

5. Retention and Destruction Schedule

Company will develop and comply with a written, publicly available retention schedule (as BIPA requires) providing that biometric identifiers/information will be permanently destroyed the earlier of: (a) 3 years after your last interaction with Saha, or (b) satisfaction of the initial purpose for collection (e.g., promptly after account deletion, with no additional retention period).

6. Storage and Security

Biometric data is encrypted in transit and at rest, stored separately from other profile data, and subject to the same or a higher standard of care than Company uses for other confidential and sensitive information, as BIPA requires.

7. Vendor Disclosure

8. Your Rights

You have the following rights with respect to your biometric data:

• Right to refuse initial biometric collection. However, because Saha's core matching/messaging features currently require face verification as an anti-catfishing measure, declining biometric collection will prevent full use of the Service.
• Right to request deletion of your biometric data, honored immediately upon a verified request.
• Right to a copy of this policy at any time via Settings > Legal.

9. State-Specific Notes

For Illinois Residents (BIPA) Company requires your written release per Section 3 above before capture of your biometric data. Company will retain or destroy the collected biometric data according to the schedule set forth in Section 5. Company will not sell or share your biometric data for profit as set forth in Section 4. For Texas Residents (CUBI) Company requires your consent prior to capture of your biometric data. Company will only use your biometric data for verification purposes described herein. Company will destroy your collected biometric data within a reasonable time, not to exceed one year after the purpose for collection expires. For Washington Residents Company only uses biometric data for verification purposes. Company will not enroll your biometric data into a database accessible to third parties for unrelated purposes.

10. Contact

biometric-privacy@the-saha.com.