Privacy Policy

This is a working draft written to reflect how the product is built. It is not yet a final legal document and should be reviewed by qualified counsel before launch.

Kiauth provides passwordless, biometric identity verification for people and AI agents. Under India's Digital Personal Data Protection Act, 2023 (DPDP), Kiauth generally acts as a Data Processor on behalf of the businesses that use us; those businesses remain the Data Fiduciary for their users. For your Kiauth account itself, we are the fiduciary.

• A one-way, keyed hash (HMAC-SHA256) of your phone number — never the raw number.
• A one-way, keyed hash of your Aadhaar number — the raw number is verified, then discarded and never stored.
• Your device's public key (the private key never leaves your device).
• Session metadata and consent records (which app, when, what you approved).
• Audit logs referenced by ID, so you can review and revoke.

• Your raw Aadhaar or phone number.
• Your biometric — it stays in your device's secure hardware.
• Your private key.
• Passwords or personal data belonging to the apps you sign into.

Under the DPDP Act you can, in respect of data we hold as fiduciary:

• Access a summary of the personal data we process about you.
• Request correction or erasure.
• Withdraw consent and revoke any connected app or agent at any time.
• Nominate another individual to exercise your rights.
• Raise a grievance with our Data Protection Officer.

Personal data is stored and processed within India. We retain consent and audit records for as long as your account is active and as required by law, and delete or anonymize them thereafter.

Kiauth is not affiliated with UIDAI. Aadhaar verification is performed through licensed aggregator partners under applicable UIDAI guidelines.

Privacy questions or requests: privacy@kiauth.com. Security reports: security@kiauth.com.