15:I[29256,["/_next/static/chunks/2gtn9n30x8_jh.js","/_next/static/chunks/3t8s-ha1rpxc0.js","/_next/static/chunks/3ebwcipe01-lm.js","/_next/static/chunks/1uq8pl6ira99w.js","/_next/static/chunks/43yecuo14zhh8.js","/_next/static/chunks/18-tnjfmxbb3w.js","/_next/static/chunks/1ib7flrxys4rf.js","/_next/static/chunks/3p7mqrdxpnbn9.js"],"default"] 16:T2716,

Third Factor AI ("we", "our", "us"), having its registered office at Lalitpur, Nepal. Email: information@thirdfactor.ai is committed to protecting the privacy of individuals whose information we process in the course of delivering our services.

This Privacy Policy describes how we collect, use, disclose, store, and protect your personal data in accordance with the Privacy Act 2075 (Nepal) and other applicable laws and regulations.

1. Scope of This Policy

This policy applies to:

Visitors to our website (thirdfactor.ai).
Users and Clients interacting with our APIs, SDKs, dashboards, and related services.
End Customers whose personal or biometric data is processed by us in connection with identity verification, KYC, fraud prevention, AML screening, and related use cases.

2. Definitions

Personal Data — Any data about an individual who is identifiable by or in relation to such data.

Sensitive Personal Data — Includes biometric data, government-issued identity information, financial information, and other categories defined under applicable laws.

Client — Any business or institution that integrates Third Factor AI's services into its own products or workflows.

End Customer — Any individual whose identity is verified, screened, or processed through the Service by a Client.

Data Controller — The entity that determines the purpose and means of processing personal data. Clients act as data controllers for their End Customers' data.

Data Processor — The entity that processes personal data on behalf of the data controller. Third Factor AI acts as a data processor when processing End Customer data on behalf of Clients.

3. How We Collect Information

Directly from you — via our website, contact forms, API sign-up, or customer support channels.
Through our Clients — when they integrate with our platform and submit End Customer data for verification, screening, or processing under a lawful basis.
From authorised third-party sources — such as government databases, watchlist providers, and sanctions databases, where required to deliver compliance and screening services.

4. Types of Data We Process

Identity Data — Name, date of birth, address, photograph, and government ID details including Citizenship Certificate, National ID Card, Passport, Driving License, PAN Card, Voter ID, and Disability Card.
Biometric Data — Facial captures, liveness detection outputs, and face match scores.
Contact Data — Email address and mobile number.
Document Data — Scanned or photographed copies of identity documents and supporting documents submitted for verification or extraction.
Behavioural and Device Data — Device identifiers, IP address, network signals, and session risk scores processed during fraud detection workflows.
Compliance Data — Screening results against sanctions lists, PEP databases, and adverse media sources.

We only collect data necessary for the stated purpose and limit retention in accordance with applicable law and Client-specific data processing agreements.

5. Purpose of Processing

We process personal data for purposes including but not limited to:

Identity verification and KYC for regulated institutions.
Biometric liveness detection and face matching.
Document OCR and data extraction.
Fraud detection and risk assessment.
AML screening, PEP checks, and sanctions monitoring.
Customer onboarding workflow orchestration.
Compliance with applicable legal and regulatory obligations.
Platform security, audit logging, and operational monitoring.
Product improvement and analytics (using anonymized or aggregated data only).

6. Legal Basis for Processing

Consent — Where required, we obtain explicit consent from End Customers directly or through our Clients on their behalf.
Legal obligation — Compliance with NRB KYC/AML directives, Financial Intelligence Unit requirements, and other applicable regulatory mandates.
Legitimate interests — Fraud prevention, platform security, and service improvement where these interests are not overridden by the rights of data subjects.
Contractual necessity — Processing required to deliver the Service as agreed with Clients under their commercial agreement.

We do not sell your data. We may share information only with:

Clients and authorized personnel within Client organizations, for the purpose of delivering the Service.
Government authorities, regulators, and law enforcement, where required by applicable law or regulatory directive.
Third-party vendors supporting identity verification, sanctions screening, or platform operations, under appropriate data processing agreements.

Third Factor AI does not share End Customer biometric data or identity data with any party not directly involved in delivering the requested Service.

8. On-Premise Deployment and Data Sovereignty

For Clients that deploy Third Factor AI on-premise, all personal data, biometric captures, document images, and verification results are processed and stored entirely within the Client's own infrastructure. Third Factor AI does not have access to, retain, or process this data.

The Client acts as the sole data controller and data processor for all End Customer data in on-premise deployments.

For SaaS and hybrid deployments, data handling is governed by the Data Processing Agreement ("DPA") executed between the Client and Third Factor AI at onboarding.

9. Data Security

Third Factor AI implements appropriate technical and organizational security measures including:

API authentication and JWT signing for all platform access.
Webhook signature verification to prevent unauthorized data interception.
Role-based access controls restricting data access to authorized personnel only.
Audit logging of all platform actions, access events, and data processing activities.
Encryption of data in transit and at rest across all managed deployments.

Clients are responsible for implementing equivalent security measures within their own infrastructure and for ensuring that End Customer data is protected in accordance with applicable laws.

10. Data Retention

Third Factor AI retains data only as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations.

For on-premise deployments, data retention is entirely within the Client's control and governed by the Client's own data retention policies.

For SaaS deployments, specific retention periods are defined in the Data Processing Agreement with each Client.

11. Your Rights

Individuals whose data is processed through Third Factor AI's platform have the following rights, subject to applicable law:

Right to access their personal data.
Right to correction of inaccurate data.
Right to erasure of personal data, where legally permissible.
Right to withdraw consent where processing is based on consent.
Right to lodge a complaint with the relevant data protection authority.

To exercise these rights, End Customers should contact the Client institution through which their data was submitted.

Clients may contact Third Factor AI at information@thirdfactor.ai to facilitate requests under applicable data protection law.

12. Cookies and Tracking

Our website uses cookies and similar technologies to enhance browsing experience and for analytics purposes.

You can manage cookie preferences through your browser settings.

We do not use cookies to track individuals across third-party websites or for targeted advertising.

13. Contact Us

For privacy-related questions, concerns, or to exercise your rights under this policy, please contact us at:

Email: information@thirdfactor.ai

Phone: +977 9705180020

Address: Lalitpur, Nepal

14. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last Updated" date.

We encourage you to review this policy periodically. Material changes will be communicated to Clients via email or dashboard notification.

a:["$","$L15",null,{"title":"Privacy Policy | Third Factor AI","htmlContent":"$16","lastUpdated":"Sep 2, 2026","initialTab":"privacy"}]