End users (people completing an age check)
Document and selfie captures are processed in volatile memory only. They are never written to disk, queues, logs, or the application database. DOB and expiry exist only long enough to compute age and document validity, then are discarded.
We may retain: session identifiers, status, required age, boolean age-threshold result, document type, timestamps, redacted audit events, and callback delivery metadata.
We do not retain: images, video, names, document numbers, MRZ, biometrics, or face galleries.
How long: photos and video are processed in memory and discarded once the checks finish. The face template made from the document photo is held in memory for at most 5 minutes and deleted after the face comparison. Session records are deleted automatically 7 days after the check, or sooner if you ask through Delete my data.
Relying parties receive only an encrypted or outcome-only result for that session - never identity attributes.
Developers (portal accounts)
When you create a developer account we store your email, password hash, email verification state, Terms version accepted, organization and plan details, Stripe billing identifiers when you subscribe, API key hashes, encrypted API secrets, callback URL allow-lists, and monthly usage counters.
Developer age checks (16+) use the same volatile capture pipeline. We store only whether you passed the age threshold and when - not your document images or date of birth.
Admins can see operational metadata (organization, plan, usage, status). They cannot view media or identity fields from verifications.
Your choices
End users may request deletion of matching session records via Delete my data. Developers may export account metadata and delete their account from the portal when Terms change, or by contacting support.
Portal login uses httpOnly session cookies. Transactional email (verification, password reset, billing notices) is sent through the configured SMTP server.