Straddle Identity Services

Latest Revision: September 10, 2026

1. Straddle Identity Services.

These terms (“Straddle Identity Terms”) supplement the General Terms and govern your use of the Straddle Identity Services and Verification Data.

2. Use of the Straddle Identity Services.

2.1 Permitted Uses.

You may use the Straddle Identity Services only:

(a) to verify the identity of Verifiable Individuals or Business Entities to the extent necessary to satisfy your compliance obligations under Law;

(b) to prevent fraud as related to your goods and services;

(d) to improve the safety or security of your business, operations and services

2.2 Restricted Uses.

You must not, and must not enable or allow any other party to:

(a) represent or imply that Straddle is acting as your agent or appointed by you for the purpose of conducting or meeting your Due Diligence Requirements;

(b) disclose the Straddle Data you receive in connection with the Straddle Identity Services to any third party, except as Law requires;

(c) use the Straddle Identity Services, any Straddle Data you receive in connection with the Straddle Identity Services, or any Verification Data to create or support a product that competes with the Straddle Identity Services;

(d) use the Straddle Identity Services, the Straddle Data you receive in connection with the Straddle Identity Services, or Verification Data in a manner that would violate any Law;

(e) reuse, sell, rent, transfer, make available, or communicate orally or through other means the Straddle Data you receive in connection with the Straddle Identity Services (including as the term “sell” is defined in the CCPA); or

(f) use the Straddle Identity Services to verify the identity of an individual who is under the age of 16

2.3 Further Obligations.

If an individual does not consent to you using the Straddle Identity Services, then Straddle is not obligated to perform the Straddle Identity Services and you are solely responsible for providing an alternative means of verifying that individual.

2.4 Other Services.

The onboarding process for the Straddle Identity Services does not entitle you to use other Straddle services. If you wish to use other Straddle services, Straddle may require you to complete a separate onboarding process.

3. Use of Data.

3.1 Straddle’s Use of Verification Data.

Verification Data is Protected Data for purposes of this Agreement.

3.2 Your Use of Verification Data and Straddle Data.

You may use the Straddle Data that Straddle makes available to you in connection with the Straddle Identity Services solely for the underlying purpose you disclosed to Straddle when you were onboarded to use the Straddle Identity Services. You may use Verification Data solely for the purposes described in your agreements with Verifiable Individuals.

4. Representations and Warranties; Disclaimers.

4.1 No Warranty.

Straddle does not represent or warrant that the Straddle Identity Services will enable you to fulfill your obligations under Law, including with respect to Due Diligence Requirements. You are solely responsible for complying with Law, including with respect to Due Diligence Requirements.

4.2 Disclaimer.

(a) Straddle does not guarantee that the Straddle Identity Services will detect or prevent all fraudulent activities or correctly verify the identity of any individual.

(b) Straddle makes no representation or warranty that the Straddle Identity Services will enable you to comply with Law, and you remain solely responsible for ensuring that you meet your legal obligations.

(c) You are responsible and liable for your actions and decisions in connection with the Straddle Identity Services, including your decisions to enter, or not enter, into business relationships with any persons.

(d) Straddle and its Affiliates are not liable for any losses, damages, or costs that you suffer in connection with any fraudulent activities that the Straddle Identity Services did not detect or prevent.

(e) Straddle and its Affiliates are not liable for any losses, damages, or costs caused by your failure to meet any of your Due Diligence Requirements, or by the Straddle Identity Services failing to correctly verify the identity of any individual.

5. Privacy and Data Protection

5.1 Disclosing Your Privacy Policy

Prior to each verification request that is submitted to the Straddle Identity Services, you must first disclose a version of your online Privacy Policy to each Verifiable Individual.

5.2 Requirements for Your Privacy Policy.

If you receive access to any Verification Data as part of the Straddle Identity Services, your Privacy Policy must, at a minimum:

(a) state that you and Straddle are each independent controllers of Verification Data, and that Straddle will process Verification Data in accordance with Straddle’s Privacy Policy and these Straddle Identity Terms, in addition to acting as a service provider to you;

(b) state the process through which Verifiable Individuals can submit data subject requests (including data deletion and data access) to you, and provide your contact information for this purpose;

(c) state the ways in which you will use Verification Data, including, if Law requires, whether you will sell or disclose Verification Data (including as the term “sell” is defined in the CCPA);

(d) if Law requires, (i) state the alternative verification methods that you make available to individuals who do not consent to be verified by the Straddle Identity Services; (ii) state that using the Straddle Identity Services may include transmitting Verification Data outside of your jurisdiction, including to the United States; and (iii) state that Verification Data may be submitted to third-party service providers, including Governmental Authorities, for the purpose of verifying the identity of the Verifiable Individual; and

(e) include all other information Law requires you to include.

5.3 Minimum Requirements.

If you do not receive access to any Verification Data as part of the Straddle Identity Services, your Privacy Policy must, at a minimum, satisfy the requirements of Section 5.2(a), (b) and (d) of these Straddle Identity Terms.

Depending upon your implementation of the Straddle Identity Services, Straddle may provide notice to or obtain consent from Verifiable Individuals as described in the Straddle Identity Services Documentation for the purpose of enabling Straddle to provide the Straddle Identity Services.

Where Straddle does not obtain consent from the Verifiable Individual under Section 5.4 of these Straddle Identity Terms, you must obtain the Verifiable Individual’s consent. You must obtain all consents from Verifiable Individuals that are required for your use of Verification Data. If you use Straddle Identity Services in conjunction with other Services, you must obtain all consents that are required to allow you to collect and share Verification Data with Straddle, and allow Straddle to use that data as this Agreement describes.

5.7 Security Controls.

You must implement and maintain safeguards and security controls that are reasonable for the size, nature and maturity of your business and industry to protect Verification Data and Straddle Data against unauthorized access, use and disclosure. If you fail to do so, in addition to all other remedies available to Straddle, Straddle may suspend or restrict your access to the Straddle Identity Services and Verification Data.

5.8 Assistance to Notify.

If Straddle is required to send a data subject notification to any Verifiable Individuals related to your use of the Straddle Identity Services, including a data breach or required notice about a Straddle Privacy Policy update, you must assist Straddle in notifying Verifiable Individuals, including by emailing those Verifiable Individuals on Straddle’s behalf and as Straddle directs.

5.9 Biometric Information.

Where Straddle or a provider Straddle engages generates biometric information from Verification Data — including a facial template used to compare a photograph to an identification document — and applicable Law requires notice, a written retention schedule, or written consent before that information is collected or generated, you must obtain that notice and consent, or enable Straddle to obtain it, before you submit the Verification Data. You must not submit Verification Data for a Verifiable Individual located in a jurisdiction whose Law requires a consent you have not obtained.

6. Audit.

6.1 Obligation to Provide Information.

You must provide information that Straddle requests for the purpose of ensuring that you comply with this Agreement, including information verifying:

(a) that your use of the Straddle Identity Services complies with these Straddle Identity Terms and Law;

(b) that your receipt and use of the Straddle Data and Verification Data complies with these Straddle Identity Terms and Law;

(d) your industry, business activities, licensing and regulatory standing; and

(e) your purpose for using the Straddle Identity Services.

6.2 Obligation to Respond Promptly.

You must respond to Straddle’s requests for information promptly, but no later than 14 days after Straddle’s request. Straddle may suspend or terminate your access to the Straddle Identity Services immediately if you fail to provide information Straddle requests under this Section 6.

7. Retention and Deletion of Data.

7.1 Data Straddle Stores on Your Behalf.

(a) You instruct Straddle to store on your behalf a copy of Verification Data for a period of 3 years following verification, or a shorter period as you may instruct according to the Straddle Identity Services Documentation. You are responsible for (i) determining how long Law requires you to store copies of Verification Data; and (ii) storing (either yourself or through Straddle) the Verification Data for the time period Law requires.

(b) Upon termination of these Straddle Identity Terms, Straddle may delete copies of Verification Data that Straddle has stored on your behalf.

7.2 Data Straddle Stores for its Own Purposes.

Notwithstanding Section 7.1 of these Straddle Identity Terms, Straddle may retain a copy of Verification Data as long as Law permits.

8. Representation and Warranty.

You represent as of the Effective Date, and warrant at all times during the Term, that you do not use the Straddle Identity Services for any “permissible purpose” under (and as defined in) the FCRA, or in a manner that would violate the GLBA, the United States Driver’s Privacy Protection Act, the United States Health Insurance Portability and Accountability Act, or other substantially similar Law.

Straddle Bridge Services

Data Processing Agreement