Privacy Policy

Last updated: 30 September 2026

This policy explains what verifyremotework.com collects, why, who else handles it, and how long it is kept. It is written to be read, not to be skimmed past.

1. Who is responsible

The Service is operated by Muhammad Hammad, a sole proprietor based in Lahore, Pakistan. You can reach us at support@verifyremotework.com.

2. Two kinds of people

Clients are companies that use the Service to verify people they have engaged.

Developers are the people being verified. A Developer does not sign up on their own; they are invited by a Client.

Most of this policy is about Developers, because that is where the sensitive data is.

The Client decides who is monitored and why. We provide the tool and hold the data. Both of us have obligations, and where a Developer's rights are concerned, both of us can be approached.

3. What we collect about Developers

Account details — name, email address, and a password that is stored only as a cryptographic hash. We cannot read your password.

A reference photograph — one photograph of your face, which you record yourself using your own camera, and which your Client approves as being you.

Check images — a photograph taken when the desktop application starts monitoring, and further photographs at regular intervals while it runs.

These photographs are not kept. Each one is compared against your reference photograph and then discarded. A photograph is stored only when several checks in a row fail — a single failed check is discarded like any other. In ordinary use, where the checks pass, no photograph of you from a work session is ever stored.

Face measurements — a set of numbers derived from those photographs that describes the geometry of your face. This is what the comparison actually runs on. It is biometric data, and section 4 deals with it separately.

Screenshots — periodic images of your screen, captured while the desktop application is running and monitoring.

Activity level — a figure between 0 and 100 showing what share of sampled moments showed recent keyboard or mouse input. It is derived from your operating system's idle timer. It does not record what you typed or clicked — the operating system reports only how long it has been since the last input, and never the input itself.

Session records — when a work session started and stopped, how long it ran, and the description of the work that you type yourself.

Consent records — which version of the monitoring terms you agreed to, when, and the IP address you agreed from.

Live view records — when a Client opens a live view of your screen, we store who watched, whom they watched, and the start and end time. The video itself is never recorded or stored — it passes between the two computers and is gone. Only the fact that it happened is kept.

Usage data — which pages and features are used inside the product, and when. This tells us where the product is confusing or broken.

Last sign-in time — a single timestamp, overwritten each time you sign in. We do not keep a history of sign-ins, and we do not store your browser or operating system.

4. Face data

Face measurements are treated in law as a special category of personal data in many countries, and we handle them accordingly.

• They are collected only after you have read the monitoring terms and agreed to them. Nothing is captured before that moment.
• They are used for one purpose only: comparing a later photograph of you against your reference photograph, to confirm it is the same person.
• They are never used to identify you outside your own account, never matched against any other person, never sold, never shared with advertisers, and never used to train any model.
• The comparison runs on our own servers. No outside face-recognition service is involved and no third party ever receives your photographs or your face measurements.
• You can withdraw your consent at any time. See section 11.

We want to be plain about one thing: agreeing is a condition of working through this platform. If that is not acceptable to you, tell the company that engaged you, before you enrol.

5. When capture happens

Capture runs while you are signed in to the desktop application. Signing out of it, or closing it, stops capture.

Nothing is captured from the website or the dashboard — only from the desktop application.

6. What we never collect

We do not record keystrokes or anything you type, beyond the session description you write yourself. We do not read the text of pages, documents or messages on your screen — a screenshot shows what was on screen at that instant, and nothing extracts text from it. We do not record the websites you visit. We do not record audio and we do not use your microphone. We do not collect your location.

If any of this changes, this policy will be updated before the change takes effect, and you will be asked to review and agree again.

7. What we collect about Clients

Company name, the name and email of each person with an account, billing email, the number of seats, and the state of the subscription.

We do not hold your card details. Payments are handled by Paddle, which is the merchant of record for this Service. Card numbers never reach our servers.

8. Why we are allowed to hold this

For Developers: your explicit consent, recorded before enrolment, for the face data; and the performance of the arrangement between you, your Client and us for everything else.

For Clients: the contract between us, and our legitimate interest in running, securing and improving the Service.

9. Who else handles the data

We run no hardware of our own. The following companies process data on our behalf, each under its own contract:

Face recognition runs on our own servers. No face-recognition vendor is involved.

We use no advertising, analytics or error-tracking service of any kind.

We do not sell personal data.

We will disclose data if we are legally required to, and we will tell the person affected unless we are forbidden from doing so.

10. Where the data goes

We operate from Pakistan. The providers above operate internationally, and data is stored and processed outside the country where you live.

If you are in a country that restricts transfers of personal data abroad, please raise it with the Client that engaged you before you enrol, and with us at support@verifyremotework.com.

11. How long we keep it

Most check images are never stored at all, as section 3 explains. The ones that are — where several checks in a row failed — are deleted automatically 90 days after capture, along with screenshots and activity records. This runs daily and needs nobody to remember it.

Usage data is not on that timer. It is kept for as long as the account it belongs to exists, and is deleted when that account is closed or when you use the deletion option in your own account.

Your reference photograph and face measurements are not on that clock. They are kept for as long as your engagement is active, because the comparison depends on them, and are deleted when your engagement ends, when your Client's account is closed, or when you ask for them to be deleted.

Session and hours records, and Client billing records, are kept for as long as we are required to keep business records.

Consent records are kept as proof that consent was given.

When a Client closes their account, the data of the Developers on it is deleted. We keep a record that the account existed and was deleted, including the Client's email address and a count of what was destroyed, because that record is what proves the deletion happened.

12. Your rights

You can ask us to:

• show you what we hold about you;
• correct anything wrong;
• delete your face data — your reference photograph, face measurements and check images. There is a button for this in your own account. Using it withdraws your consent and ends your ability to work through the platform;
• delete everything about you, subject to records we must keep;
• explain any flag raised against you.

Write to support@verifyremotework.com, or use the deletion option in your account.

Retrieving stored data for you is a manual process here, so it is not immediate. We acknowledge every request within 3 working days, and provide the data within 30 days of receiving it. If a request is unusually large or complex we may need longer; we will tell you so, with the reason, inside those first 30 days.

We can only provide what we still hold. Anything already deleted cannot be recovered.

If we need to check with your Client first — for example where a request touches records of work they have paid for — we will tell you that when we acknowledge it.

You can complain to the data protection authority in your country. Doing so does not affect anything else.

13. Security

Passwords are stored hashed and cannot be read by us. Connections are encrypted in transit. Changes to staff accounts and staff permissions are written to an append-only record that cannot be altered. Clients never receive a Developer's password.

No system is perfectly secure. If a breach affects your data, we will tell you.

14. Age

The Service is for people aged 18 and over. Clients must not invite anyone under 18, and by inviting someone a Client confirms that person is an adult. If you believe we hold data about a minor, write to us and we will delete it.

15. Changes

If we change this policy in a way that affects what is collected or how long it is kept, Developers are asked to review and agree again before their next session. The version you agreed to, and the date, is recorded.

16. Contact

support@verifyremotework.com