1. Parties and roles
Bitora/Meinivo decides why verification is required, which workflow is used and how the result affects a payout. Didit Identity Spain, S.L., Calle Nápoles 227, P. 1, 08013 Barcelona, Spain, and Didit Identity, Inc., 1111B S Governors Ave STE 34855, Dover, Delaware 19904, USA, provide the verification. Didit normally acts as processor/service provider and as a limited independent controller for security, abuse prevention, legal compliance, audit and claims.
2. Workflow and data
The published “Meinivo First Payout KYC” workflow (UUID e6127c95-eaea-44cb-8417-cece72c3167d, provider version 1) processes the identity-document image, extracted identity/age data, a selfie/passive-liveness capture, derived facial biometric characteristics and match/liveness results. It enforces age 16 and declines below it. AML/monitoring, NFC, proof of address, the additional Document AI module, email, phone and optional device/IP-analysis module are disabled, although essential IP, browser and hosted-session data may still arise. Meinivo stores no document images, selfies, video, document numbers or full decisions, only the account/session link, workflow and notice version, status/timestamps and an integrity hash.
3. Purpose, legal basis and consent
The one-time check prevents identity misuse, duplicate accounts and payout fraud. Depending on governing law, ordinary document, status and security processing relies on contract, legitimate interests or legal duties. Special-category biometric processing additionally requires an applicable legal condition; Meinivo uses separate, explicit, unchecked consent. Whether that consent can be freely given despite the payout condition, and whether the flow is necessary and proportionate, must be reviewed before release in each jurisdiction.
Version meinivo-didit-kyc-v2 expressly states consent to Didit's processing of the selfie/liveness capture and derived facial biometric characteristics for the one-time identity and face match before first payout. Version v2 records the changed mandatory payout context; earlier v1 evidence is not reinterpreted as consent to that context. Without consent, you may abort the payout request. Withdrawal operates prospectively and does not affect the lawfulness of completed processing.
4. Contract, recipients and transfers
Didit Identity Spain, S.L. is the contracting entity for EU/EEA clients. The published Business Terms state that registration, acceptance or use binds the client and that Annex 2 is an integral data-processing agreement. Didit remains an independent controller for limited security, abuse, legal, audit and claims purposes and the described anonymized/pseudonymized improvement purposes.
Didit may engage necessary group entities and hosting/cloud, communications, identity/document, fraud, analytics, audit, security and professional providers. The DPA provides general subprocessor authorization, change notice and objection rights; detailed safeguards are available on written request and under NDA according to Didit. Didit states primary EEA hosting and adequacy decisions, EU Standard Contractual Clauses or another recognized mechanism for third-country transfers.
5. Retention and deletion
The dedicated “Meinivo” Didit application is configured to one month for verification and feature data. Separate Didit control-plane audit logs are retained for 365 days according to the provider. Biometric data is destroyed earlier where governing law requires it. Meinivo clears short-lived hosted URLs at terminal status and normally deletes its webhook-deduplication markers after 180 days.
Account deletion first instructs deletion of every known Didit session. Didit documents HTTP 204 as immediate and irreversible deletion of the session, decision, extracted data, related feature records and stored session media; a repeated request may return 404 for an unknown or already-deleted session. Separately created blocklist entries, issued hosted-flow share tokens, queued webhooks and a separate parent Didit user/business entity are not included according to the provider. Meinivo does not use the optional blocklist modules. Local KYC rows are removed only after confirmed 204 or an already-deleted 404. A provider failure remains visibly retryable and is not falsely reported as completed deletion.
6. Automation, rights and contact
Didit automates document-integrity, age, liveness and face-match checks and may route cases to human review. The API creates no payout or balance reservation until an authenticated Approved status exists. Meinivo remains responsible for its payout decision. Request access, correction, deletion, restriction, objection, withdrawal or human review at colin-mario.koese@bitora.de. Contact Didit at privacy@didit.me or dpo@didit.me.
Didit Business Terms and DPA · Didit Verification Privacy Notice · Didit identity-verification terms