Lets break this abysmal post down into what appears to be the point:
Privacy.com flagged you for some unknown reason and asked you to verify your identity. You learned that Onfido exists and googled the name and (LOL) decided you would spend 45s on Wikipedia and then read a privacy policy written not-for-you, and then post yourself on HN so you can "inform others."
Lets not even bother with the fact that flagging for further identification happens at every financial company that exists. People are flagged all the time for a number of reasons dictated by ML/AI that is not always right. "I've never had this happen before." That's not how math works.
As I am not a lawyer, I probably missed some more bits as well.
We can tell. And you did. You missed the part where you have to read and comprehend more than three or four words at a time. That or you intentionally excluded the pieces that invalidated everything that got you to the front page of HN. I'd wager it's the former. Allow me to do the research you pretended to do:
First and foremost, there are regulations on how PCI/PII data can be stored. I'll assume you read about reading about or pretended to read about PCI so I won't go into the details you don't care to understand (but should).
Each of Onfido’s and/or Provider’s third-party vendors may have access to the facial scan data
When a company hosts with providers like AWS, GCP, etc, those are considered "third party." If you curl the onfido website you can see that it's hosted on S3 (or at least parts of it are). It's very likely that onfido is storing data in S3 which
means a third party has access to store the data, make backups, etc. You also excluded THE IMPORTANT PART on previous line that said
Onfido securely stores all selfies, videos, photos of identity documents, and facial scan data in an encrypted format. Onfido may disclose your personal information to an actual or potential buyer (note "potential")
I'm going to go out on a limb here and assume you've never owned a company who's had an offer to exit. When company A purchases company B they first have to evaluate that business and decide if they want to buy it. Since you think like Twitter I'll clear something up for you: acquisitions don't happen by posting on twitter "I want to buy Twitter." This is a standard bullet point in every privacy policy. When you are approached by a potential buyer you sign a slew of NDA's and other
legally binding documentation that prevents any party from sharing the details of the agreement.
Believe it or not, startups don't have enough time, money, energy, resources to rewrite every little feature required to run a business. Visa and Mastercard also have their own ways of sharing your private information. Does that also mean to start a privacy focused fintech company you need to write the entire american payment system?
Onfido may disclose your personal information... or other third party where we believe disclosure is necessary... to protect your vital interests or those of any other person
Jesus Christ. I don't even know how you pieced that together so I'll _actually quote_ the document:
To comply with laws. Onfido may disclose your personal information to any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person;
This is American and guess what: you have to comply with the law. I know in your fantasy world of impotence masquerading as activism you think you can "privacy" your way around it, but guess what? You can't. Any company operating in has to comply with the laws. "I use Proton and they are privacy." I'm sure you do, and they're privacy because the laws permit it until they don't.
So what do you do? You try to deprive a company who's actively trying to do what you pretend to do with your useless tantrum.