Terms of Service

These Terms of Service (the "Terms") govern the use of the services provided by Klyrix/document through the fastdocument.net domain and the subdomains assigned to brands. By opening an account as a business customer (a "Brand") or by using the services, you agree to be bound by these Terms.

Individuals who upload documents or complete an identity verification flow on behalf of a Brand ("End Users") do not enter into a customer relationship with Klyrix/document under these Terms; an End User’s primary legal relationship is with the relevant Brand. The rules in the Acceptable Use section nevertheless apply to everyone who uses the platform.

If you do not agree to these Terms, please do not use the services. Details on how personal data is processed are set out in the Privacy Policy and the KVKK / GDPR Privacy Notice.

The key terms used in these Terms have the following meanings.

• Platform: the software and services offered via fastdocument.net and the brand-specific subdomains.
• Brand: the business that opens an account to receive services through the Platform; Klyrix/document’s customer.
• End User: the natural person who uploads documents or completes an identity verification process in a flow created on behalf of a Brand.
• Services: the secure document collection service and the remote identity verification (KYC) service.

Klyrix/document provides Brands with two core services.

• Secure document collection: files are collected from End Users through an upload form published on a brand-specific subdomain. Uploaded files pass through automated security processing (sanitisation/CDR — content disarm and reconstruction) and are then delivered to the Brand in a secure manner.
• Remote identity verification (KYC): includes live scanning of the front and back of an identity document, a selfie and a short liveness check, OCR/MRZ reading with checksum validation, face matching, and anti-spoofing analysis.

The scope of the Services and the steps in each flow may vary depending on the Brand’s configuration. Klyrix/document may modify technical components to improve how the Services operate; material changes to the detriment of the Brand are subject to the procedure in the Changes section.

You are responsible for ensuring that the information you provide when opening an account is accurate and up to date, for keeping your account credentials confidential, and for all activity carried out under your account. If you suspect unauthorised use, you must notify us without delay using the contact details at the bottom of this page.

As a Brand, you undertake in particular the following obligations.

• You are solely responsible for establishing the legal basis for collecting data from End Users and for providing End Users with the required privacy information under the data protection laws applicable to you (such as the GDPR or Turkish Law No. 6698 (KVKK)).
• You will use the Services, and any data obtained through them, only for lawful and legitimate business purposes; you must not use KYC results in a manner that leads to unlawful discrimination.
• Compliance with any sector-specific regulations that apply to your business remains your responsibility; Klyrix/document does not assume those obligations on your behalf.
• You are responsible for configuring your upload and verification flows (including form fields and brand assets) accurately and lawfully. Klyrix/document may rely on the configuration and instructions you provide through the backoffice.
• When you enable the identity verification (KYC) service, you define your name (legal name) as data controller and a link to your own privacy notice in the administration panel; this information is shown on End User screens and you are responsible for keeping it accurate and up to date.

In End User flows, personal data is processed on behalf of the Brand; in this context the Brand acts as the data controller and Klyrix/document as the data processor. For visitors of the apex website, backoffice users, and Brand account and billing data, Klyrix/document is the data controller. The biometric security pool is an exception to this rule: based on the explicit consent obtained separately from the End User in the KYC flow, Klyrix/document processes the biometric face template, one facial photograph, ID number and (if provided) username of the End User, as data controller, in a security pool shared across all Brands for the purpose of fraud prevention and retains them for 90 days. The Brand accepts this processing; in the event of a match, the Brand is shown only that a verification was previously performed.

The selfie photograph and the facial imagery in the liveness video processed in the KYC flow may qualify as biometric data; such data is treated as special-category personal data under Article 6 of the KVKK, and its processing relies on the End User’s explicit consent, which is obtained separately within the flow.

[AVUKAT METNİ BEKLENİYOR — lawyer text pending] Data Processing Agreement: a clause stating that the processing relationship between the Brand (controller) and Klyrix/document (processor) is governed by a separate agreement and how it relates to these Terms.

The core retention rules are as follows.

• Raw images and videos captured during identity verification (document images, selfie, liveness video) and the face-comparison and profile-photo crops derived from them: automatically deleted 7 days after submission.
• Data in the biometric security pool (biometric face template, one facial photograph, ID number and, if provided, username): automatically deleted 90 days after the record is created. Deletion of its own record by the Brand does not affect this period; if explicit consent is withdrawn, the data is deleted before the period expires.
• Files uploaded through the document collection flow are automatically deleted from both of the platform’s stores 7 days after delivery to the Brand (8 days after processing completes if no delivery takes place).
• The verification decision (approved/rejected) and the explicit consent record are retained for audit purposes. Personal data such as the fields read from the document, form answers, contact details (e-mail, telephone) and IP address is deleted at the same time as the files (7 days after the decision for standalone identity verification); for records still under review, this period starts at the decision. Only transaction information that contains no personal data (time, status, fee) is kept.
• Files that could not be safely processed (rejected) or could not be processed are kept for at most 7 days for manual review; files held unprocessed because the Brand’s balance was insufficient or its account was suspended are held for at most 7 days. In both cases they are deleted at the end of the period.
• Brand account and billing data: kept for the duration of the contractual relationship and for the statutory retention periods required by commercial and tax legislation.

These periods are the same for all Brands and cannot be extended by a Brand. Data whose period has expired is deleted, destroyed or anonymised.

Data is hosted primarily within the EU region; transfers abroad may occur due to the providers used to deliver the service. Details on sub-processors, transfers and security measures are set out in the Privacy Policy and the KVKK / GDPR Privacy Notice.

The output of the KYC service is decision-support in nature. The final decision to accept or reject an End User belongs to the Brand, and human review is part of the process.

End Users have the right to object to a verification result and to request human intervention (Article 11(g) of the KVKK and Article 22 of the GDPR). Details on exercising these rights are provided in the KVKK / GDPR Privacy Notice.

Verification technologies such as OCR/MRZ reading, face matching and anti-spoofing analysis are probabilistic; false positives and false negatives can occur. The Brand is responsible for designing its own decision processes with this in mind.

The following activities are prohibited for everyone who uses the Platform.

• Uploading unlawful content, content that infringes the rights of third parties, or malicious software (malware).
• Attempting identity verification with a document belonging to another person or with a forged or altered document; impersonating another person or misrepresenting your identity.
• Attempting to circumvent security measures; sharing or misusing signed, single-use upload links beyond their intended purpose.
• Placing excessive load on the Platform, probing systems with automated tools, or reverse engineering the software, subject to any rights granted under open-source licences.
• Reselling or sublicensing the Services to third parties without Klyrix/document’s written permission.

Automated security processing may block or quarantine files assessed as harmful. Violation of these rules may result in suspension or termination of the account; Klyrix/document reserves the right to pursue legal remedies.

Service fees are payable by Brands and are determined under the offer in effect at the time of purchase — on a prepaid balance and/or subscription basis. Applicable fees are displayed in the backoffice before purchase.

Card top-ups are collected through Stripe; your card details are not stored on Klyrix/document’s systems, and payment transactions are processed by Stripe. Payments made by bank transfer are credited to your balance by Klyrix/document once the payment is received.

No fees of any kind are charged to End Users. Any request for payment from an End User made in Klyrix/document’s name should be treated as an attempted fraud.

Taxes required by law may be added to the fees. If payment obligations are not met, the Services may be suspended following notice. Prepaid balances are subject to the conditions stated at the time of purchase.

All intellectual property rights in the Platform, including its software, design, interfaces and trademarks, belong to Klyrix/document or its licensors. These Terms do not transfer any ownership rights to you.

As a Brand, you are granted a limited, non-exclusive, non-transferable licence, valid for the duration of your subscription, solely to use the Services within your own business processes.

Brand materials you upload to the Platform, such as your logo, colours and form content, remain yours; you grant Klyrix/document a limited right to host and display those materials for the purpose of providing the Services. You warrant that you hold the necessary rights in the materials you upload.

The software includes open-source components made available under licences such as MIT and Apache; those components are governed by their own licence terms. For details, please refer to the Intellectual Property and Copyright Notice.

The Services are provided "as is" and "as available". Klyrix/document gives no service level (SLA) or uninterrupted availability commitment; it does not warrant that the Services will be uninterrupted, error-free or fit for every purpose.

Security technologies, including sanitisation/CDR, are designed to reduce risk; no security technology provides absolute protection. Likewise, the outputs of verification technologies may contain errors; the explanations in the Nature of KYC Results section remain applicable.

Your rights under mandatory provisions of applicable law remain unaffected.

To the maximum extent permitted by law, Klyrix/document shall not be liable for loss of profit, loss of reputation, loss of business, or any indirect or incidental damages.

Klyrix/document’s total liability arising out of these Terms is limited to the total fees paid by the relevant Brand in the 12 months preceding the event giving rise to the liability.

Liability arising from wilful misconduct or gross negligence, and any liability that cannot be limited under mandatory law, fall outside the scope of this section.

Klyrix/document may suspend the Services in whole or in part in the following cases; where circumstances allow, prior notice will be given.

• Material breach of these Terms, in particular the Acceptable Use rules.
• A situation threatening the security of the Platform or other users, or suspected abuse.
• Failure to meet payment obligations.
• An order of a competent authority or a requirement arising from applicable law.

A Brand may close its account at any time. Klyrix/document may terminate the agreement with reasonable notice; the right to terminate immediately in cases of material breach is reserved. Upon termination, access to the Platform ends.

After termination, data is deleted in accordance with the retention rules described in the Privacy Policy; statutory retention obligations remain unaffected. We recommend retrieving any deliverables you need before closing your account.

Klyrix/document may update these Terms; the current version and the date of the last update are published on this page. Material changes will be announced through the Platform or by e-mail to account holders. Continuing to use the Services after changes take effect constitutes acceptance of the updated Terms.

The Services may evolve over time, and certain features may be discontinued. Where the removal of a feature materially affects a Brand, reasonable notice will be given.

These Terms are governed by the laws of the United Arab Emirates as applied in the Emirate of Dubai. Disputes arising from these Terms are subject to the jurisdiction of the courts of Dubai.

If any provision of these Terms is held invalid, the remaining provisions remain in effect. Failure to exercise a right does not constitute a waiver of that right. The Brand may not assign its rights and obligations under these Terms without Klyrix/document’s written consent; Klyrix/document may assign the agreement in the event of a corporate restructuring.

These Terms, together with the Privacy Policy, the Cookie Policy, the KVKK / GDPR Privacy Notice and the Intellectual Property and Copyright Notice, form the entire framework governing the use of the Services. For any questions, please use the contact details at the bottom of this page.