Privacy Policy
Last Updated: August 2026
Our Commitment to Biometric Privacy & Data Minimization
PalmPass operates on foundational mathematical irreversibility. We convert optical signals into irreversible vectors and discard all raw image data immediately.
1. Core Privacy Architecture
PalmPass is architected from the ground up on the principle of Privacy by Design. We do not store raw images, photographs, or reconstructable graphical representations of user palms. All optical data is converted in volatile memory into irreversible cryptographic vector embeddings (mathematical hashes) and the raw source image is destroyed immediately.
2. Data Minimization and Purpose Limitation
We collect only the minimal mathematical parameters necessary to execute identity verification and liveness detection. We do not collect or track user location, browsing activity, social media profiles, or unrelated personal identifiers. Authentication tokens issued by PalmPass are ephemeral and purpose-scoped strictly to the authorized requesting organization.
3. User Consent and Institutional Responsibility
Enrollment in PalmPass is consent-native. In institutional and enterprise deployments (such as universities or corporate workplaces), user enrollment is initiated with explicit consent and in accordance with institutional biometric governance policies.
4. Cryptographic Storage & Transmission
All biometric vector embeddings are encrypted at rest using AES-256-GCM encryption with isolated cryptographic key management. All communications between capture terminals, client systems, and the PalmPass verification engine are encrypted in transit via TLS 1.3 with strict forward secrecy cipher suites.
5. Right to Erasure & Revocation
Users and participating organizations retain full control over their biometric records. When an individual departs an institution or requests deletion, their cryptographic template and associated salts are permanently deleted from all active and backup databases.
6. No Commercial Sale or Third-Party Monetization
PalmPass never sells, rents, leases, or trades biometric representations, vector embeddings, or user identities to advertisers, data brokers, or third parties under any circumstances.