This Privacy Policy explains how Tools for Humanity Corporation (“We”, “TFH”) processes your data when you use our websites, services and apps – such as World App, World ID and World Money, as may be updated from time to time (“Apps”) – (collectively, our “Services”). We’ve tried to keep this policy simple, and We never sell your personal information.

If you use any TFH Service or an Orb built by TFH to verify your World ID, the first section of this Privacy Policy is relevant to you. Other companies can build apps (“Compatible Applications”) and or Orbs to enable people to create, store, verify, or use their World ID.

We collect your personal data when you provide it to us and when you use our Services. In limited cases, We also receive personal data from third parties. As explained further below, you can access, correct, or delete your personal data at any time.

In some circumstances, and depending on the App functionality, we may request data from you, or you may provide data to us on your own initiative. You can change your mind and modify or delete it at any time in the settings of our Apps.

Within TFH, only team members who need to access or see personal data to perform their tasks can do so, and We have strict access controls in place to ensure this. We only outsource data processing to trusted and secure vendors and service providers. These service providers include certified cloud service providers, software as a service providers, and IT security firms. Please find here the complete list of our outsourced processors.

We may share your data to comply with legal requirements or respond to lawful requests from Law Enforcement authorities. If your actions violate our Terms and Conditions, or pose a risk to our or other’s rights, we may give your information to relevant authorities. We will share your personal information with your consent or at your direction.

TFH and the World ID protocol are designed to minimize the personal data shared with those parties. When you use World ID with third-party applications, websites, or services (“Relying Parties”), Relying Parties do not receive your face or eye images, iris code, World ID Secret, or other underlying biometric data. Instead, they receive cryptographic proofs or verification outputs generated using zero-knowledge proof technologies, that are designed to confirm specific facts — such as that you are a unique human, hold a valid credential, or have not previously performed a specific action — without revealing your identity or underlying biometric information. Depending on the context and applicable law, certain verification signals, identifiers, or related metadata may constitute personal data. Relying Parties are generally independent controllers of any personal data they process in connection with their own services, and their processing is governed by their respective privacy notices.

Generally, We retain your personal data as follows:

If required by law, We will retain your personal data as necessary to comply with our legal and regulatory obligations, including fraud monitoring, detection, and prevention, as well as tax, accounting, and financial reporting obligations.

For detailed information regarding the specific legal grounds and purposes for our data processing activities, please refer to the chart below, which explains the data We collect, what We use it for, and how long it is retained.

Your data is your data, and We believe you should be able to easily exercise your rights at any time. When you use our Services you can always:

You can exercise these rights in our Apps by clicking on “Privacy & Legal” under “Settings”; for more information on deletion, see this help center article.

We comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. We have certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DP. We have certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit Data privacy framework website.

You must be at least the age of majority in your country (and a minimum of 18 years old) to use our Services. We take the protection of minors seriously—if you believe someone under 18 years of age is using our Services, please contact us immediately via our Privacy Portal or the channels above.

We can update this Privacy Policy any time, but if the changes affect your rights we’ll notify you in advance. If you use our Services after that, you accept the updated Privacy Policy.

If you have questions about this Privacy Policy or other data related questions, you can contact us at any time. You can always contact our Office of Data Protection and Data Protection Officer, Marc Placzek, at [email protected] or by sending a letter to: DPO, Tools For Humanity Corporation, 650 7th St, San Francisco, CA 94103, USA.

If you live in the United States or any other country outside of the European Union, EFTA States, or the United Kingdom, the data controller responsible for your personal data is Tools For Humanity Corporation, with an address of 650 7th St, San Francisco, CA 94103, USA.

If you live in the European Union, EFTA States, or the United Kingdom, the data controller responsible for your personal data is Tools for Humanity GmbH, with an address of August-Everding-Straße 25, 81671 München, Germany.

If you wish to raise a concern about data practices, you have the right to do so with your local supervisory authority or TFH GmbH’s lead supervisory authority, the Bavarian Data Protection Authority (“BayLDA”) using the contact details listed on their website.

TFHPS20260701