Privacy Policy

1. Who we are

Identity Entry is an identity verification service. Businesses use it to confirm that a person is who they say they are, that the person is present at the time of the check, and, where the business turns them on, that additional checks come back clear.

This policy explains what information Identity Entry handles, why it handles it, how long it keeps it, who it shares it with, and the choices and rights available to you. It applies to our website, the Identity Entry business account, the capture pages people use to complete a check, our API and our MCP server.

2. Our role

Identity Entry plays two different roles depending on whose information it is.

• For the people being checked: the business that asked you to verify your identity decides why the check is needed and what happens with the result. That business is the controller of your information. Identity Entry is its processor and handles your information only to run the check the business requested.
• For our own customers: when a business creates an account, signs in, buys checks or contacts us, Identity Entry decides how that account information is used and acts as the controller for it.

If you were asked to complete a check, the business that sent you the link is usually the best first contact for questions about why the check was requested and how the result is used.

3. Information we collect from businesses

• Account details: the name of the organization, the names and email addresses of the people on its team, and the password each person chooses. Passwords are stored only as salted hashes.
• Account settings: which checks are turned on, how long photos are kept within the allowed range, policy choices for checks that cannot finish, webhook addresses and API keys.
• Purchase records: the checks bought, amounts and dates. Card and bank details are entered with our payment provider and are not stored by Identity Entry.
• Decisions and notes: the decisions a team records on a check and the reasons given, kept as an audit log.
• Messages: anything a business sends us through the contact page.

4. Information we collect from people being checked

What is collected depends on which checks the business turned on. It can include:

• ID document: photos of the front and back of the ID and the details printed on it, such as name, date of birth, document number and expiry date.
• Selfie: a photo of your face, compared with the portrait on the ID.
• Movement check: a few camera frames from a short head movement, used to confirm that a real person is present right now.
• Additional details: where the business turns on extra checks, details such as your contact information, the result of a public records background search, a watchlist search, a records check or a bank check.
• Consent records: the consent notices you were shown and when you accepted them.

Identity Entry does not ask for your Social Security number.

5. Information collected automatically

When you use the website, your business account or a capture page, our systems receive standard technical information such as your IP address, browser type, device type and the time of each request. This is used to deliver pages, keep the service secure and investigate problems.

Signing in to your account sets one session cookie. Identity Entry does not use advertising or tracking cookies. The Cookie Policy explains this in full.

6. How we use information

• To run the checks a business requests and return a result of Pass, Caution or Fail, together with the reasons.
• To show results, photos and history to the account that requested the check, and to no one else.
• To create and secure accounts, sign people in and keep business accounts separate from one another.
• To process purchases and keep accurate billing records.
• To detect and prevent fraud, abuse and security incidents.
• To answer questions sent through the contact page.
• To meet legal obligations.

Face data is not sold and is not used to train models. Photos are used only to complete the check the business asked for.

7. Legal bases

Where the law requires a legal basis for processing, Identity Entry relies on the following:

• Contract: to provide the service to the businesses that use it.
• Consent: for biometric comparison and for background searches, which a person accepts before they run.
• Legitimate interests: to keep the service secure, prevent fraud and improve how it works, balanced against your rights.
• Legal obligation: where a law requires us to keep or disclose information.

For checks, the business that requested the check is responsible for its own legal basis, and Identity Entry processes the information on its instructions.

8. How we share information

Identity Entry does not sell personal information and does not share it for advertising. It shares information only in these cases:

• With the requesting business: results, reasons, photos and details go to the account that requested the check.
• With subprocessors: companies that host and run parts of the service on our behalf, listed on the Subprocessors page.
• For legal reasons: where disclosure is required by law, court order or valid legal process, or is needed to protect the safety of people or the service.
• In a business transfer: if Identity Entry is involved in a merger, acquisition or sale of assets, information may transfer as part of that transaction under the same protections described here.

9. International processing

Identity Entry runs on infrastructure that operates in many countries. Your information may be processed outside the country where you live. Where that happens, we rely on the safeguards our subprocessors provide for international transfers and apply the protections described in this policy wherever the information is handled.

10. How long we keep information

• ID photos, selfies and movement-check frames are kept encrypted with the account of the business that requested the check.
• The business has 7 days to review the results of each check.
• Capture links close after 30 minutes.
• Check results, reasons and decisions stay in the business's account so a decision can be explained later.
• A person's identity profile, including ID photos, selfies and the face record made from them, is kept for up to 10 years after the person's most recent check, so a returning person can be confirmed without starting over. A person can have it deleted sooner at any time by emailing team@identityentry.com or by deleting their Identity Entry account. Where a state law sets a shorter period for biometric information, such as Illinois, Identity Entry follows that shorter period for residents of that state.

The full schedule is on the Data Retention page.

11. How we protect information

Photos are encrypted before they are stored and can be retrieved only by the account that requested the check. Capture links are signed and short-lived. Passwords are stored as salted hashes. Each account is kept separate from every other account. The Security page describes these measures in more detail.

No system is perfectly secure, and we cannot promise that information will never be accessed without permission. If we learn of a security incident affecting your information, we will act to contain it and notify those affected as the law requires.

12. Your rights

Depending on where you live, you may have the right to:

• Know what personal information is held about you and receive a copy.
• Correct information that is inaccurate.
• Ask for information to be deleted.
• Object to or restrict certain processing.
• Withdraw consent you have given, without affecting processing that already took place.
• Receive your information in a portable format.
• Complain to a data protection authority.

To make a request, use the contact page. We may need to confirm your identity before acting on it. We will not treat you differently for exercising your rights.

13. Requests about a check

If your request is about a check a business asked you to complete, that business controls the information. Contact the business first. If you contact us instead, we will pass your request to the business and help it respond, as its processor.

14. Children

Identity Entry is intended for businesses and is not directed to children. Businesses may not use it to check children under 13. If you believe a child's information was submitted, use the contact page and we will work with the business to remove it.

15. United States state privacy and biometric laws

Several US states give residents specific rights over personal information, including California under the California Consumer Privacy Act as amended. Those rights include knowing what is collected, asking for deletion and correction, and limiting the use of sensitive information. Identity Entry does not sell or share personal information for cross-context advertising.

Some states also regulate biometric information, including requirements for notice, written consent, a published retention schedule and destruction. The Biometric Information Notice explains how Identity Entry handles face data, and the businesses that use Identity Entry are responsible for meeting the notice and consent rules that apply to them.

16. Changes and contact

We may update this policy as the service changes. The effective date at the top shows when it last changed. If a change materially affects how information is handled, we will tell businesses in advance through the console or by email.

For any privacy question or request, use the contact page.