1. Who we are
VenaPass (“we”, “us”) provides palm-vein identity for payment providers and organizations. We confirm that a person is who they say they are when they hold out their palm. We never hold or move money.
Questions about this policy or your data: privacy@venapass.com.
2. The short version
- We store an encrypted reading of your palm veins, not a photo of your hand.
- We do not collect your name, phone number, ID number, card details or photos.
- Each business you register with knows you only by its own reference, and cannot see your references at other businesses.
- You can leave any business, or ask us to erase you everywhere, at any time.
- We never sell personal data.
3. If you use your palm
What we hold.
- An encrypted reading of the vein pattern in your palm (biometric data). It is encrypted on the scanner’s device before it is sent to us, and stored encrypted.
- The reference each business uses for you (for example its customer number), linked to that reading.
- A log of each check: when, on which device, and whether it matched. The log uses a random identifier, not your name.
Why. To confirm it is you when you choose to pay, enter or prove your identity, to stop one person registering twice, and to prevent fraud.
Our legal basis. Your explicit consent, which the business asks for before your palm is registered, and our legitimate interest in preventing fraud. You can withdraw consent at any time by asking to be erased.
Who sees what. When you use your palm, the business gets a signed yes or no and its own reference for you. Nothing else. Payment providers use that to charge the account they already hold for you; VenaPass never sees your account or card details.
How long. Until you leave. When no business links your palm any more, or when you ask us to erase you, your palm reading is deleted. Check logs are kept for up to six years for disputes, fraud investigations and legal obligations, with no palm data in them.
Children. Where a business registers a child (for example a school), it must first get consent from a parent or guardian where the law requires it.
4. If you are a business customer or visit our website
Accounts. When your organization uses the VenaPass console we hold your work email, name and role, your organization’s details, and sign-in and security records (including IP addresses), to run your account and keep it secure.
Enquiries. If you contact us, we keep what you send so we can reply and follow up. You can ask us to stop at any time.
Email. We send service email (sign-in codes, security notices, invoices) because you need it. Product and follow-up email to business contacts includes an unsubscribe link.
Cookies. The website sets no cookies. The console uses only essential cookies to keep you signed in and secure. Your language choice may be remembered in your browser.
5. Sharing
We share personal data only:
- with the business you use, as described above;
- with service providers who run our infrastructure and email, under contracts that limit them to our instructions;
- when the law requires it, and only what is required.
We never sell personal data or use it for advertising.
6. Security
Palm readings are encrypted on the device with a key unique to that device, sealed with our own key when stored, and never sent to a business. Every check is logged. Our staff access systems with strong, phishing-resistant sign-in, and only when their role needs it.
7. Where your data is stored
We store data on servers operated for us under data-protection terms. As VenaPass grows, we keep palm data in the region where it was registered. If data leaves your country, we use the safeguards your law requires.
8. Your rights
Depending on where you live, you can ask to access, correct, erase or restrict your data, object to its use, or withdraw consent. To leave one business, ask that business. To be erased everywhere, or for anything else, see our Support page or email privacy@venapass.com. We reply within 30 days.
You can also complain to your data protection authority, for example the Nigeria Data Protection Commission, the UK Information Commissioner’s Office, or your EU supervisory authority.
9. Changes to this policy
If we make a material change, we will update the date and version above and tell business customers by email before it takes effect.