Raw biometric data never leaves a user’s device
All encryption happens directly on the smartphone before transit.
Privacy is a fundamental human right
Very is designed to be privacy-first. We were born to create an authentic internet without sacrificing your most sensitive data.
Keeping user data safe
We believe that you should not have to sacrifice your privacy or share governmental information to prove you’re a real person.
All biometric data is encrypted using AES-256, both at rest and in transit
Palm Models are irreversible and they cannot be reverse-engineered back into a palm image.
The fight against deepfakes never ends
Very works with frontier researchers to stay ahead of the latest deepfakes and generative scams.
How Very handles your (limited) data
When a new user registers and scans their palm, Very converts their features into an encrypted Palm Model directly on the user’s smartphone.
What Very never collects
- Government-issued credentials like a driver’s license or passport
- Name
- Date of birth
- Physical address
- Face scans
- Fingerprint scans
- Data for marketing or targeting purposes
What Very uses
- Full resolution palm image does not leave smartphone
- Raw scan video does not leave smartphone
- Low-res palm images held for 90 days on encrypted server for auditing fraud and malicious accounts
- Palm Model, encrypted at registration
- Pseudonymous VeryIDs
- Activity signals (like session ID or recent logins)
Our position
Very provides biometric authentication rather than KYC checks and does not require users to submit government IDs
Biometrics, not KYC.
Upload a government ID
Not required
Palm check
Verified human
FAQs on Very’s trust and safety policies
At registration, users scan their palm multiple times either within a platform through the Very SDK or within the Very app. That scan is converted into a mathematical Palm Model and stored on encrypted servers. When a user is asked to reverify their palm, it is once again converted into a Palm Model and compared against the original version.
All biometric data is encrypted using AES-256, both at rest and in transit.
The data Very collects can be permanently deleted by the user in the “Settings” menu of the Very app.
Platforms never receive raw biometric data or the Palm Model. Instead, they get a pass or fail state from Very, as well as a platform-specific VeryID.
Yes, Very follows the EU General Data Protection Regulation (GDPR) for all personal data we process:
- • We ask for your permission before we collect your palm scan or other biometric data.
- • We keep data only as long as we need it, and our Privacy Policy lists exactly how long.
- • You can ask to see, correct, or delete your data at any time, and we respond within the time GDPR requires.
- • We have appointed Rickert Rechtsanwaltsgesellschaft mbH in Bonn, Germany as our official GDPR representative in the EU.
- • We only work with vendors that meet GDPR standards. You can see the full list at trust.very.org/subprocessors.
Business customers can also sign our Data Processing Agreement (DPA). For more details, read our Privacy Policy or email legal@very.org. We have also appointed a Data Protection Officer, reachable at dpo@very.org.
In the event of a security incident, we will notify you in accordance with Article 34 GDPR, UK GDPR, and applicable state notification laws. Where legally required, we will also notify the relevant supervisory authority.
The only data stored on the device is the local biometric template. Raw, high-resolution palm images are deleted immediately. Only encrypted data is stored on Very’s servers: the encrypted Palm Model, the VeryID user identifier, last-activity signals like recent logins, session ID, and other session artifacts, and low-resolution copies of palm images, which are held for 90 days for audit purposes.
For users, the same user VeryID can be used across multiple platforms that use Very. A user’s VeryID is linked to their palm, not any specific account.
To protect privacy, client-side IDs that are sent to platforms change every session.
