Tulu Identity Privacy Policy

At Tulu Identity, your privacy and the security of your personal data are fundamental to our operations and trust model. This Privacy Policy explains how we collect, use, store, disclose, and protect your information when you use our platform to provide identity verification services, including the collection and processing of personal identification data in compliance with applicable data protection laws.

Tulu Identity is fully committed to complying with the provisions of all international, regional, and national data protection laws and privacy standards applicable in each circumstance.

By accessing or using Tulu Identity's services, whether through our mobile app or web platform, you consent to the practices described in this Privacy Policy. If you do not agree with any part of this Policy, you should desist from using the Tulu Identity platform.

This Privacy Policy governs the collection, use, processing, storage, disclosure, and safeguarding of personal information — including sensitive identity and biometric data — by Tulu Identity in connection with:

• User registration and identity verification (KYC)
• Our web and mobile applications
• APIs and SDKs integrated into third-party client platforms
• Communication channels such as email, phone, and support
• Any digital forms, portals, or other tools through which identity data is submitted or processed

This policy does not apply to third-party websites or services that may be linked to or integrated with Tulu Identity products but are operated by independent organizations under their own privacy policies.

3.1 Personal Data

To verify your identity, we collect personal data including but not limited to:

• Full legal name, date of birth, email address, and phone number
• Photograph (recent passport or scanned ID)
• Gender and nationality
• Government identity document information (e.g., passport, driver's license, national ID)
• Biometric data such as facial images or liveness detection data
• Device information such as IP address and device identifiers

3.2 Non-Personal Data

• Device & Technical Data: IP address, browser type, operating system, device identifiers
• Usage Data: Session duration, authentication logs, failed verification attempts
• Cookies & Tracking Technologies: used for security and analytics

Tulu Identity processes personal data only when there is a lawful basis to do so, including:

• Consent — explicit consent before collecting your personal data
• Contractual Necessity — processing necessary to perform a contract with you
• Legal Obligations — compliance with AML, KYC, and other regulatory requirements
• Legitimate Interests — ensuring platform security, preventing fraud, and improving services
• Vital Interests — protecting your vital interests or those of another person

• Identity Verification & Authentication — confirming user identity and securing access
• Fraud & Forgery Prevention — detecting fake IDs, spoofing, and illegal activities
• Regulatory Compliance — meeting KYC/AML and other legal obligations
• Service Improvement — enhancing accuracy and efficiency of verification processes
• Customer Support — resolving issues related to identity verification
• Decentralized Identity (Web3) — creating self-sovereign identity (SSI) solutions

Tulu Identity does not sell or rent your personal information. We may share your data with:

• Regulated third parties (e.g., government authorities) where legally required
• Service providers for cloud storage and identity validation, under strict confidentiality agreements
• Blockchain networks for decentralized identity solutions (data stored on-chain is immutable and pseudonymous)
• Third parties with your explicit consent

Tulu Identity retains personal data only as long as necessary to fulfill the purposes outlined in this policy or as required by law. To request deletion of your account and personal data, email privacy@tulupay.com. Some data (e.g., KYC, transactions) may be retained for regulatory or legal obligations.

We employ robust technical and organizational measures including:

• TLS 1.2+ encryption (HTTPS) for all data in transit
• AES-256 encryption within an ISO 27001-certified cloud environment (AWS)
• Multi-factor authentication (MFA) and role-based access control
• Mandatory privacy and security training for staff and contractors
• Incident response plans with 72-hour breach notification as required by law

You have the following rights regarding your personal data:

• Right to be Informed — clear information about how your data is used
• Right of Access — obtain a copy of your personal data
• Right to Rectification — correct inaccurate or incomplete data
• Right to Erasure — request deletion of your data
• Right to Restrict Processing — limit how your data is used
• Right to Data Portability — receive your data in a machine-readable format
• Right to Withdraw Consent — withdraw consent at any time
• Right to Lodge a Complaint — file a complaint with your country's Data Protection Authority

To exercise any of these rights, contact our Data Protection Officer at privacy@tulupay.com. We will respond within 30 calendar days.

We use cookies for session management, security monitoring, and analytics. You can set your browser to reject cookies, but some features may become unavailable. Types of cookies we use:

• Essential Cookies — required for platform functionality
• Performance & Analytics Cookies — monitor site performance and usage
• Security Cookies — detect abusive behavior and protect accounts
• Preference Cookies — store language and UI preferences

We do not use advertising or behavioral profiling cookies at this time.

We may update this Privacy Policy periodically to reflect changes in legal obligations, data handling practices, or platform features. We will notify users of material changes via email, in-app messaging, or platform notifications. Continued use of the platform after changes constitutes acceptance of the updated policy.

If you have questions or concerns about this Privacy Policy or our data practices, please contact:

Tulu Identity
Email: privacy@tulupay.com