Privacy Policy

This Privacy Policy explains how VerifyU ("we", "us", "our") collects, uses, shares, and protects information about you when you use the VerifyU platform. By registering and using the platform you agree to the practices described below.

1. Who We Are

VerifyU is a digital credential management platform that enables educational institutions to issue Open Badge 3.0-compliant credentials, certificates, and achievements to their students. We act as a data processor on behalf of your institution (the data controller). Your institution determines what data is collected and for what purpose; we process it under their instructions.

2. Information We Collect

We collect the following categories of personal data:

Category	Examples	Source
Identity & Contact	First name, last name, student ID, school email, personal email, phone number	Provided by your institution; supplemented by you during registration
Account Credentials	Hashed password, session tokens	Created by you during registration
Profile Data	Profile photo, wallet address	Optionally provided by you
Credential Data	Issued badges, achievement records, course completions, VC IDs	Generated by your institution on the platform
Usage Data	Login timestamps, pages visited, browser type, IP address	Automatically collected when you use the platform

We do not collect sensitive categories of data (e.g., health information, biometrics, financial account numbers) except where explicitly required and separately disclosed.

3. How We Use Your Information

We use your information to:

• Operate the platform — authenticate your identity, display your credentials, and process your registration.
• Issue & verify credentials — create, store, and allow verification of your digital badges and certificates.
• Communicate with you — send registration invitations, credential notifications, and important platform updates.
• Ensure security — detect, investigate, and prevent fraud, abuse, and unauthorised access.
• Improve the platform — analyse aggregated, anonymised usage patterns to improve performance and features.
• Comply with legal obligations — respond to lawful requests from regulators or law enforcement.

4. How We Share Your Information

We do not sell your personal data. We share it only in these circumstances:

• Your institution — administrators at your institution have access to your profile and credential records as data controllers.
• Third-party credential verifiers — when you choose to share a credential, the recipient can verify its authenticity via our public verification endpoint. Only credential metadata (not your full profile) is exposed.
• Cloud service providers — we use trusted cloud infrastructure (e.g., AWS) for hosting and file storage. These providers process data under strict data-processing agreements.
• Email delivery services — used solely to send you transactional emails.
• Legal requirements — we may disclose data if required to do so by law or in response to valid legal process (e.g., court orders, government requests).
• Business transfers — if VerifyU is acquired or merges with another entity, your data may be transferred as part of that transaction, subject to equivalent privacy protections.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services to your institution. Credential records may be retained longer to support lifetime verification. When data is no longer needed, we securely delete or anonymise it.

You may request deletion of your account by contacting your institution's administrator. Note that issued credentials may remain verifiable on the public ledger as required by the Open Badge standard.

6. Data Security

We implement industry-standard safeguards to protect your data, including:

• HTTPS / TLS encryption in transit.
• AES-256 encryption at rest for sensitive fields.
• Bcrypt hashing for passwords — we never store plaintext passwords.
• Role-based access controls limiting staff access to data on a need-to-know basis.
• Regular security reviews and penetration testing.

No system is 100% secure. If you believe your account has been compromised, contact us immediately at privacy@dvlt.ai.

7. Your Rights

Depending on your location you may have the following rights regarding your personal data. To exercise them, contact your institution's administrator or email us directly.

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your data subject to legal retention requirements.
• Portability — receive your credential data in a machine-readable format.
• Restriction — ask us to limit processing of your data in certain circumstances.
• Objection — object to processing based on legitimate interests.
• FERPA (US students) — if you are a student at a US institution, the Family Educational Rights and Privacy Act may give you additional rights over your educational records. Contact your institution's registrar for FERPA requests.

We will respond to verifiable requests within 30 days.

8. Cookies & Tracking

We use a small number of cookies essential to platform operation:

• Session cookie — maintains your authenticated session. Expires when you log out or after a period of inactivity.
• Language preference cookie — stores your selected display language for up to one year.

We do not use advertising cookies, cross-site tracking, or analytics that identify you personally. No third-party cookies are set by the platform itself.

9. Children's Privacy

The platform is not directed to children under the age of 13. If we learn that we have collected personal data from a child under 13 without verified parental consent, we will delete that data promptly. If you believe a child has registered without consent, please contact us.

10. International Transfers

VerifyU is based in the United States. If you are located outside the US, your data may be transferred to and processed in the US or other countries. Where required by law, we rely on approved transfer mechanisms (e.g., Standard Contractual Clauses) to ensure equivalent protection for your data.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The effective date at the top of this page will reflect the date of the most recent revision. For material changes we will provide notice via email or a prominent in-platform notice. Your continued use of the platform after the effective date constitutes acceptance of the updated policy.

12. Contact Us

For privacy questions, data requests, or concerns, please contact our Privacy team:

• Email: privacy@dvlt.ai
• Address: One Commerce Square, 2005 Market Street, Suite 2400, Philadelphia, PA 19103

If you are located in the European Economic Area and have an unresolved complaint, you may contact your local data protection authority.

© 2026 VerifyU. All rights reserved.