This privacy policy is published by Vuplicity LLC ("Vuplicity", "we"). It covers our website, our HR app, the pages candidates use to authorize and complete a screening, and our public catalog MCP server.
1. Information we collect
We collect information required to deliver background screening workflows, support compliance records, and maintain account security.
Depending on how you use Vuplicity, this can include:
- Candidate details for a screening: name, email address, phone number, address and address history, date of birth, and Social Security number.
- Details needed for the checks an employer orders, such as employment and education history, references' names and phone numbers, professional or driver's license numbers, military service, and, for international checks, identifiers such as a national ID number, citizenship, and mother's maiden name.
- Background check results and reports.
- If your screening includes the optional selfie identity check and you choose it: photos of your ID, a selfie, face geometry, document details and device information; video or audio depends on the Veriff flow. See section 9.
- Authorization records: the candidate's signature, when it was signed, and the disclosure text shown.
- Dispute records, including the description and any supporting documents.
- Employer user accounts: name, email address, phone number, job title, and role.
- Questions employer users type into the Compliance Officer assistant in our HR app.
- Billing records: amounts and Stripe payment references. Card numbers are entered on Stripe's payment page and are not stored by Vuplicity.
- Copies of the emails we send.
- Sign-in session details, such as IP address and browser type, and application logs.
- Website usage data from our public website, described in section 7.
- Details you enter when you book a consultation through our scheduling tool.
2. How we use information
Data is used to process checks, generate legally constrained reports, deliver authorized notifications, and maintain audit history.
3. Security controls
We apply operational and technical controls to protect data in transit and at rest, including access controls and workflow-level safeguards.
4. Who receives information
We share personal information with these categories of recipients:
- The employer or other organization that ordered a check, and its authorized users, who can view the report and its status in our HR app.
- A consumer reporting agency that uses Vuplicity to serve that organization.
- Systems the ordering organization connects: webhook addresses it sets up, which receive event updates about its checks, such as status changes and links to reports; its BambooHR account, which receives applicant status updates; and ChatGPT, when one of its users authorizes our custom GPT to read the organization's background checks.
- The person a check is about, when we send them authorization requests or notices.
- Background check data providers, and the researchers and record sources they use to run searches.
- A U.S. Census Bureau address-lookup service, which we use to find the county for an address.
- Service providers that host our systems and network traffic (Amazon Web Services, Supabase, Vercel, and Cloudflare), deliver email (Resend), verify a candidate's identity with a selfie and ID if the screening includes that option and the candidate chooses it (Veriff; see section 9), process payments (Stripe), provide the AI models behind the Compliance Officer assistant, measure website use (Google Analytics and Cloudflare Web Analytics), serve web fonts (Google Fonts), and run our consultation scheduler (GoHighLevel).
Our API servers and application logs run on Amazon Web Services in the United States (the us-east-1 region). For international checks, we send the candidate's information to our data provider, which uses researchers and official record sources in the countries being searched.
5. Data retention
Records are retained according to legal, contractual, and operational requirements tied to background screening services.
On September 2, 2026 we adopted the retention schedule below. When a period ends, we delete the record unless a legal hold or the law requires us to keep it longer. Where automatic deletion is not built yet, the entry says so and describes what happens today.
- Background checks and reports: five years after the report is delivered. Automatic deletion is planned; today we do not delete them automatically.
- Authorization and consent records: five years after the last report obtained under the authorization. Automatic deletion is planned; today we do not delete them automatically.
- Adverse-action notices: five years after the final notice or the case closes. Automatic deletion is planned; today we do not delete them automatically.
- Dispute records: five years after the dispute is finally resolved or the case closes, whichever is later. Automatic deletion is planned; today we do not delete them automatically.
- Raw data exchanged with our background check data providers: 90 days after reconciliation and dispute intake, then deleted or reduced to the result we keep. This is planned; today we do not delete it automatically.
- Account records: kept when an organization or user is deactivated. Deactivation does not delete them.
- Audit history: kept for seven years. Our database blocks deleting audit entries less than seven years old; automatic deletion after seven years is planned, and today we do not delete older entries automatically.
- Copies of emails we send, Compliance Officer conversations, and billing records: kept with no set end date. We do not delete them automatically.
- Webhook delivery records: deleted when the organization deletes the webhook subscription.
- Selfie identity check data, if your screening includes that check: Veriff deletes the photos, video and biometric data from the verification session automatically three months after the check, under our account's 3-month retention period. The full schedule is in section 9.6.
- Application logs: deleted automatically after 30 days.
- Requests to our public catalog API and MCP server: not stored by our application (see section 8).
6. Your choices and controls
A summary of consumer rights under the Fair Credit Reporting Act is at https://www.vuplicity.com/fcra-rights.
On Vuplicity's hosted screening form, a candidate can check "I choose not to provide my Personal Data." Vuplicity then pauses the screening.
Employer users can update the name, email address, and phone number on their profile. Users with access to reports can download them and export their organization's background-check records. Users who manage API keys or webhooks can revoke keys and delete webhook subscriptions. Organization admins can disconnect BambooHR, deactivate team members, and deactivate the organization. Deactivation does not delete records.
If your screening includes the optional selfie identity check, you can decline and contact your employer for another way to verify your identity. To withdraw consent after starting, email [email protected] (section 9.4).
7. Website analytics and cookies
Our public website uses Google Analytics to count visits to its pages and clicks on buttons such as "Start screening." Before sending a page address to Google Analytics, we remove every query parameter except campaign (utm_) tags. Our Google Analytics settings turn off Google signals and ad personalization. Google Analytics does not run in our HR app or on candidate pages. Cloudflare Web Analytics also measures page performance on our website.
Our HR app uses cookies to keep users signed in and to protect against cross-site request forgery.
8. Public catalog MCP server
Vuplicity's public MCP server is at https://api.vuplicity.com/api/v1/mcp. It has one read-only tool, getVuplicityPublicProductsCatalog, which returns our public package and add-on descriptions. It needs no account or credentials, takes no input, and returns no personal data.
Our application does not store requests to this server or to our public catalog API. It uses the caller's IP address, kept only in server memory, to limit each caller to 60 requests per minute.
9. Biometric identity verification
This section applies only if your screening includes the optional selfie identity check, which Veriff provides. If it does, you can choose whether to use it. This section describes the information involved, its purpose, recipients, retention and your choices. It is our public biometric retention schedule and description of the destruction process.
9.1 What we collect
After you agree, Veriff uses your government ID photos and selfie to compare your face with your ID photo and check that a live person is taking part. Face geometry, the measurements used for that comparison, is biometric data. Veriff also processes document details and device and connection information. Video or audio capture depends on the Veriff flow.
Vuplicity stores the verification result, individual check outcomes, session references and dates, and the consent record. This integration does not store your ID images, selfie, video or face template.
9.2 How we use it
We use the verification result to confirm the identity of the person named in the employer's background check and to detect identity fraud in that check. The check evaluates the document, selfie, liveness and face match. An identity result is not an employment decision. Contact your employer about the next step if the check does not confirm your identity.
9.3 Who receives it
- Veriff and its service providers. Veriff processes the identity check and uses hosting and other service providers. Its privacy notice describes its processing, including uses for its own purposes and differences by location. Read it together with our notice before continuing.
- The ordering employer and its screening agency. They can receive the verification status through the screening service. This integration does not provide them with your images or face template.
- Disclosure limits. We authorize processing for the check with your consent. Any other disclosure of biometric data requires your consent or a legal requirement, such as a valid warrant or subpoena, and must be permitted by applicable law.
- No sale. Vuplicity does not sell, lease, trade or otherwise profit from biometric data, or use it for advertising.
9.4 Your choices
- Written consent before the check. We show a separate biometric notice and ask you to check a box, type your full name and select I agree. We record that electronic signature and the exact notice text before starting a Veriff session. You can download the notice text.
- Another way to verify. You can decline before starting and contact your employer for another way to verify your identity or for an accommodation. Your employer decides the next step. Declining here does not create a Veriff session and is not recorded as a failed identity check.
- Withdrawal. To withdraw consent after starting, email [email protected]. Closing the Veriff page does not itself withdraw consent or delete an existing session. A request does not automatically cancel a check or remove an already recorded result.
9.5 How we protect it
Vuplicity sends requests to Veriff over encrypted HTTPS connections and restricts access to stored consent and verification records. Section 3 describes our screening-record controls. Veriff describes its own security and storage practices in its privacy notice linked above.
9.6 Retention schedule and destruction guidelines
- The Veriff session. Veriff deletes the photos, video and biometric data from each verification session automatically three months after the check, under our account's 3-month retention period. That keeps the data for the identity check and a short period to resolve questions about it, and within the outer limit of this schedule: deletion once the purpose is satisfied, and never later than three years after the candidate's last interaction with us.
- Destruction process. Veriff performs the deletion on that schedule. Vuplicity does not store the photos, video or face template, so no copy remains with us.
- Provider retention. Veriff describes its retention of session data, backups and data it uses for its own purposes in its data retention policy.
- Our verification and consent records. The result, check metadata and consent record remain with your screening records under section 5. They follow the section 5 schedule for background checks and consent records.
9.7 Your rights
Email [email protected] to ask about access to, correction of, or deletion of your verification information, or to withdraw consent. Available rights depend on the law that applies to your request. You can also dispute information in your background check. A summary of your rights under the Fair Credit Reporting Act is at https://www.vuplicity.com/fcra-rights.
9.8 Changes to this section
The candidate notice has a version and a fingerprint of its exact text. We record those with your consent so that the notice you agreed to can be identified. The current notice version is 2026-09-27-sample-aligned-v1.
9.9 Information for residents of specific states
Illinois. The written notice identifies face geometry, its purpose, the retention schedule and recipients before we ask for an electronic written release. Sections 9.3 and 9.6 state our disclosure limits and destruction process.
Texas. We ask for consent before starting the Veriff check involving face geometry. Our purpose-based retention schedule is in section 9.6.
Washington. We ask for consent to the identity check. Vuplicity does not use biometric data for advertising or sell it. Veriff's uses are described in its own notice.
Colorado: Biometric Identifier Notice. Face geometry is used for identity verification and fraud detection in the screening. Sections 9.1 through 9.6 identify the data, recipients, choices, safeguards and current retention schedule.
California: notice at collection for the selfie check. The categories processed by Veriff include identifiers and document details, biometric information, visual information and any recorded audio, and device and network information. Government ID numbers and biometrics used to identify you are sensitive personal information. They are used for identity verification and fraud detection. Vuplicity does not sell biometric data or share it for advertising. See section 9.3 for recipients and Veriff's notice, section 9.6 for retention, and section 9.7 for requests.
Other states. This notice also describes our process for candidates in Virginia, Connecticut, Utah, Oregon, Montana, Iowa, Indiana, Tennessee, Delaware, New Jersey, New Hampshire, Kentucky, Nebraska, Minnesota, Maryland and Rhode Island. It does not change the rights provided by applicable law.
10. Contact
For privacy questions, contact [email protected].