Terms of Service

1. Agreement and scope

These Terms govern access to and use of Noviqent IdCheck by a business, organisation or professional customer (Customer). By signing an order form, accepting these Terms electronically, creating a paid account or otherwise purchasing the Service, the Customer agrees to be bound by them.

The Service provides configurable identity, facial comparison, proof-of-address, OCR/extraction and related verification functionality through a hosted application and/or API. The applicable order form, subscription page or quotation may specify plan limits, fees, usage allowances and additional services.

2. Business use only

The Customer confirms that it acquires the Service wholly or mainly for business purposes. It must not represent itself as Noviqent's agent or make the Service available as a consumer product in Noviqent's name unless separately authorised in writing.

3. Customer responsibilities and lawful use

The Customer determines why an individual is checked, which checks are enabled, how results are used and, subject to platform controls, appropriate retention settings. The Customer is responsible for ensuring its use is lawful, fair, necessary and proportionate.

Where applicable, the Customer must identify an Article 6 UK GDPR lawful basis and any Article 9/Data Protection Act 2018 condition required for biometric recognition; provide appropriate privacy information; conduct its own DPIA or legitimate-interests assessment where required; respond to data-subject requests; and ensure decisions using verification results comply with applicable law.

The Customer must not use IdCheck for unlawful discrimination, covert surveillance, harassment, impersonation, fraud, unlawful profiling or another unlawful purpose.

4. Verification limitations and human review

IdCheck is an automated verification aid and does not guarantee that an individual, document, address or transaction is genuine. Facial comparison, OCR, document-quality checks and age estimation can produce false accepts, false rejects, extraction errors or inconclusive results.

Unless expressly agreed otherwise in writing, the Service is not represented as a government identity scheme, qualified trust service, accredited identity provider, credit-reference service or substitute for sector-specific verification that the Customer is legally required to obtain.

The Customer must use appropriate human review and escalation where a result is disputed, borderline, inconsistent or may produce a legal or similarly significant effect. Proof-of-address capture or legibility must not be described as independent authentication of an address unless an additional validation mechanism actually performs that function.

Age estimation alone should not be relied upon as the sole compliance control for high-risk age-restricted goods or services unless the Customer has separately validated that use and accepted the associated risk.

5. Service architecture and security

The core IdCheck service is hosted on Noviqent-controlled on-premises infrastructure in the United Kingdom. Private AI/OCR/biometric processing is performed locally. The private verification AI environment is designed without outbound internet access for processing identity documents and facial data.

Noviqent will maintain technical and organisational measures appropriate to the nature and risk of processing, including access controls, encryption, network segregation, logging/monitoring, vulnerability management, backup/recovery controls and retention/deletion mechanisms.

No online service can be guaranteed completely secure or uninterrupted. The Customer must protect its accounts, API credentials, endpoints and systems and promptly notify Noviqent of suspected compromise.

6. Data protection

Where the Customer determines the purposes and essential means of verification processing and Noviqent processes personal data on the Customer's behalf, the Customer is the Controller and Noviqent is the Processor. The Noviqent IdCheck Data Processing Agreement (DPA), Version 2.0 or its successor, forms part of these Terms.

Where Noviqent processes limited data for purposes it determines independently, such as its own service security, fraud/abuse prevention, account administration or compliance with law, Noviqent may act as an independent controller for that processing.

If there is a conflict concerning processing of Customer Personal Data, the DPA prevails over these Terms to that extent.

7. Retention and deletion

Raw selfie images are not retained as stored verification records. Face embeddings used for matching are transient and not persisted. Raw identity-document and proof-of-address retention is off by default and may be enabled only where the Customer has a justified need and lawful retention period.

The platform may enforce a maximum raw-document retention configuration of 1,825 days. This is a technical ceiling and is not a statement that five years is lawful or necessary for every Customer.

When raw-document retention is disabled, the Service may create a document hash for audit purposes and discard the underlying image following processing. Results, OCR-extracted fields and audit/hash records are retained according to Customer configuration, agreement and lawful instructions.

8. Transactional email and sub-processors

Noviqent may use a transactional SMTP/email provider to send verification invitations, authentication messages or service notifications. Such provider should receive only minimum contact and delivery information and must not intentionally receive identity-document images, proof-of-address images, selfies, biometric templates or OCR-extracted identity fields.

Noviqent may appoint other sub-processors in accordance with the DPA. Current production sub-processors are recorded in the IdCheck Sub-Processor Register.

9. Accounts, API access and credentials

The Customer is responsible for activity through its authorised accounts and API credentials. Credentials must be kept confidential, must not be embedded in publicly accessible code and must be revoked or rotated when compromise is suspected.

Noviqent may apply rate limits, attempt limits, session expiry and security restrictions reasonably required to protect the Service, individuals or other customers.

10. Fees, subscriptions and taxes

Fees, billing frequency, usage allowances and subscription term are those shown in the applicable order form, quotation or subscription checkout. Unless expressly stated otherwise, fees are exclusive of VAT and other applicable taxes.

Recurring subscriptions renew for the period stated at purchase unless cancelled in accordance with the applicable order. The Customer remains responsible for charges properly incurred before cancellation becomes effective.

Late or failed payment may result in suspension after reasonable notice, except where immediate suspension is reasonably required to prevent fraud, security risk or unlawful use.

11. Availability, maintenance and support

Noviqent will use reasonable skill and care in operating the Service. Planned maintenance may temporarily affect availability. Unless an order form contains a separately agreed service-level commitment, no guaranteed uptime percentage or service credit applies.

Noviqent may modify the Service to improve security, compliance, performance or functionality, provided it does not materially remove paid core functionality during an active committed term without reasonable justification or an appropriate remedy.

12. Intellectual property

Noviqent and its licensors retain all intellectual-property rights in IdCheck, its software, models, APIs, documentation, branding and service improvements. No ownership transfers to the Customer.

Noviqent grants the Customer a limited, non-exclusive, non-transferable right during the subscription term to access and use the Service for its internal business purposes and approved integrations.

The Customer must not reverse engineer, copy, resell, sublicense, scrape, circumvent security controls, attempt to extract model components, or use the Service to develop a materially competing identity-verification service except to the extent such restriction is prohibited by law.

13. Customer data

As between the parties, the Customer retains its rights in Customer Data. The Customer grants Noviqent the limited rights necessary to host, process, transmit and otherwise handle Customer Data solely to provide, secure and support the Service and meet legal obligations.

Noviqent will not use Customer identity documents, selfies or biometric data to train general-purpose AI models unless a separate explicit written agreement and lawful basis applies.

14. Confidentiality

Each party must keep the other party's non-public business, technical, security and commercial information confidential and use it only for the agreement. This does not apply to information that is public through no breach, was lawfully known, is independently developed or must be disclosed by law.

15. Suspension

Noviqent may suspend access where reasonably necessary because of a material security threat, suspected unlawful use, material breach, non-payment, risk to other customers/data subjects, or a legal/regulatory requirement. Where practicable, Noviqent will give notice and work with the Customer to restore access after resolution.

16. Term and termination

These Terms apply for the subscription or order term. Either party may terminate for material breach not remedied within a reasonable written cure period where capable of remedy. Immediate termination may apply to insolvency, serious unlawful use or a breach creating an unacceptable security/data-protection risk.

On termination, access ends. Customer Personal Data will be returned or deleted in accordance with the DPA, documented instructions, applicable retention requirements and backup lifecycle.

17. Warranties and disclaimers

Each party warrants that it has authority to enter into the agreement. Noviqent warrants that it will provide the Service with reasonable skill and care.

Except as expressly stated and to the maximum extent permitted by law, the Service is provided without implied warranties as to uninterrupted operation, absolute accuracy, fitness for a particular regulated purpose or that every fraudulent identity/document will be detected.

18. Liability

Nothing in these Terms excludes or limits liability where it cannot lawfully be excluded or limited, including liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation.

Subject to the preceding sentence, neither party will be liable for indirect or consequential loss, loss of profit, revenue, business, anticipated savings or goodwill, except to the extent such exclusion is prohibited by law.

Subject to any different limit expressly agreed in an order form, each party's aggregate liability arising out of or in connection with the Service during any twelve-month period will be limited to the fees paid or payable by the Customer for the Service during the twelve months immediately preceding the event giving rise to the claim.

19. Indemnity for unlawful customer use

To the extent permitted by law, the Customer will be responsible for losses, claims and reasonable costs arising from its unlawful use of the Service, unlawful verification instructions, material breach of data-protection obligations, or content/data supplied without necessary rights or authority, except to the extent caused by Noviqent's breach, negligence or unlawful processing.

20. Changes to these Terms

Noviqent may update these Terms for legal, regulatory, security or service reasons. For material changes affecting an active paid subscription, Noviqent will provide reasonable notice. Changes will not retrospectively remove accrued rights.

21. Notices

Contractual notices may be sent using contact details recorded in the Customer account/order form, or to hello@noviqent.co.uk.

22. Governing law and jurisdiction

These Terms and any non-contractual obligations arising from them are governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction, unless the parties expressly agree otherwise in writing.

23. Order of precedence

If documents conflict, the following order applies unless an order form expressly states otherwise: (1) a signed Order Form or negotiated addendum; (2) the Data Processing Agreement for matters concerning Customer Personal Data; (3) these Terms; and (4) service documentation.

24. Entire agreement and general terms

The agreement constitutes the entire agreement between the parties concerning the Service and supersedes prior proposals or representations on the same subject, except for fraud or fraudulent misrepresentation. Failure to enforce a right is not a waiver. If a provision is unenforceable, the remaining provisions continue.

25. IdCheck compliance framework

The following documents support these Terms where applicable: Data Processing Agreement; Privacy Notice; Data Retention and Deletion Policy; Information Security Policy; Sub-Processor Register; and Data Protection Impact Assessment. Internal governance documents do not automatically become contractual commitments unless expressly incorporated into an order or agreement.

26. Acceptance

For self-serve subscribers, these Terms (and the DPA they incorporate) are accepted electronically at account creation - this is treated as an equally valid path to being bound as a signed order form (see Section 1). A negotiated Order Form may instead record signature by both parties for larger or bespoke arrangements.