1. Who we are and our role
IDProval Inc. ("IDProval", "we", "us") operates the identity verification and age assurance platform at idproval.com.
Our role differs depending on the data. For business account data we are the controller. For verification session data we act as a processor on behalf of the business that asked for the verification — that business decides why the check happens and what it is used for, and is the controller for it. Where we decide how to operate and secure the platform itself, we are the controller for that limited purpose.
2. Data we collect
Account data. When a business registers we collect name, email address, company name, and the billing information needed to maintain the account and take payment.
Verification session data. During a session we may process images of an identity document, facial images and short video frames used to confirm a live person is present, and the fields read from the document — typically name, date of birth and document number.
Biometric data. Facial images processed to confirm that the person presenting a document is the person shown in it, or to estimate an age, are biometric data and are treated as a special category under Article 9 GDPR. Section 3 sets out the basis on which we process them.
Age estimates. Where a business uses age estimation, we derive an estimated age from a facial image. The estimate is an inference, not a reading from a document.
Session metadata. The country detected for the session, the purpose the business requested, consent flags, and timestamps.
Age assurance cookie. Where a site uses our age gate, a cookie named idp_age is set on that site recording that a check was passed and when it expires. It is a signed token: it does not contain a name, date of birth, document details or facial data. Its default lifetime is 90 days and the operating site may set it shorter.
Usage data. Log data, API request metadata and aggregated analytics used to run and improve the platform. This does not include identity document content.
What we keep is much less than what we process. Document images and the fields read from them are used to reach a decision and are then discarded. What persists against a completed verification is the outcome: whether the person met the age requirement, the verdict, the proven age where one was established, which requirements were checked, and timestamps. Our database has no field for a name, a date of birth or a document number on a verification result.
3. Legal bases for processing
Account data. Performance of a contract (Article 6(1)(b)) and our legitimate interest in running and securing the platform (Article 6(1)(f)).
Verification session data. We process it on the documented instructions of the business customer, who must have its own lawful basis. That is commonly its legal obligation to check age before granting access (Article 6(1)(c)) or its legitimate interests (Article 6(1)(f)).
Biometric data. We rely on the explicit consent of the person being verified (Article 9(2)(a)). Consent is asked for before a check begins, and refusing it stops the check. Because a business may also be under a statutory duty to verify age, a business may in addition rely on Article 9(2)(g) where its own law provides for it.
Where consent is the basis, it may be withdrawn at any time. Withdrawal does not affect processing already carried out, and a site may then refuse access where it is legally required to verify age first.
4. Automated decisions and human review
A verification is assessed automatically. Depending on what the business requires, the system compares the face presented against the document, checks that a live person is present, reads the date of birth, or estimates an age from a facial image. It then produces one of three outcomes: pass, refer for human review, or fail.
The logic, in plain terms. An automatic pass requires the estimated or established age to clear the required threshold by a safety margin, with consistent results across several frames and sufficient image quality. Anything short of that — a borderline age, disagreement between frames, poor lighting or an unclear document — is referred to a human reviewer rather than decided by the machine. An automatic fail is reserved for results clearly below the threshold or unusable input.
This can have a real effect on someone, because the outcome determines whether a site lets them in. Anyone subject to such a decision has the right to obtain human intervention, to express their point of view and to contest the outcome. Requests should go to the business that asked for the verification, which controls the decision; we support that business in carrying out the review.
We do not profile people, and we do not use verification data to make decisions about them beyond the age or identity question that was asked.
5. How we use personal data
Account data is used to provide the service, send transactional messages and handle billing. Verification session data is used only to carry out the check the business asked for, to return the result to that business, and to keep the records needed to show a check took place.
We do not use verification data to train, fine-tune or evaluate AI models. The models we run are fixed, pinned versions obtained from their publishers; they do not learn from the people they assess. We do not sell personal data, and we do not use it for advertising or for any purpose the business did not instruct.
6. Sharing and sub-processors
We share verification results with the business that requested the verification. Beyond that we disclose personal data only to sub-processors needed to run the service, and where we are compelled to by law.
The categories of sub-processor we use are: cloud hosting and managed databases; GPU compute used to run the verification models; object storage for session images; email delivery for transactional messages; and payment processing for business accounts. Each is bound by a data processing agreement. A current list naming each sub-processor is available to business customers on request at contact@idproval.com, and we give customers notice before adding a new one.
7. International transfers
Personal data may be processed outside the country where it was collected, including outside the European Economic Area and the United Kingdom. In particular, the compute that runs our verification models may be located in a different country from the storage holding session images.
Where data leaves the EEA or the UK we rely on the European Commission's Standard Contractual Clauses, together with the UK Addendum where the UK GDPR applies, and we assess the destination before using it. Images held in object storage are encrypted with keys we control and which the storage provider does not hold, so the provider cannot read their contents. Business customers can ask us where their sessions are processed at contact@idproval.com.
8. Data retention
Session images. Document and facial images are discarded once the check is complete. They are kept beyond that only where a session has been referred for human review, and only until that review is finished. Deletion is automatic: removing the session removes the images with it, and the stored objects are erased by a scheduled job rather than left for anyone to remember.
Verification sessions. A session and its credential are deleted within 24 hours of expiring. A job runs every hour to do this.
Verification results. The outcome of a completed verification — whether the age requirement was met, the verdict, the proven age where established, and timestamps — is retained so that the business can show a check took place, for as long as its agreement with us provides and as its own legal obligations require. As set out in section 2, this record contains no name, date of birth or document number.
Account data. Retained while the account is open and deleted within 90 days of closure, except where we must keep billing records for longer.
Logs. Operational logs are retained on a rolling basis for security and troubleshooting. Client IP addresses are truncated before being written.
9. Children's data
Our service exists partly to keep children out of places meant for adults, which means a person who fails a check may well be a child. We treat that data with particular care.
We do not knowingly retain the personal data of anyone found to be under the applicable age beyond what is needed to record that the check did not pass. Facial images and documents from a failed check are deleted on the same automatic schedule as any other session, and the result we keep says only that the requirement was not met. We do not build profiles of people who fail a check, do not use their data for any other purpose, and do not pass it to anyone other than the business that requested the check.
A parent or guardian who believes we hold data about their child can contact us at contact@idproval.com and we will act on it without needing a formal request.
10. Your rights
Subject to your jurisdiction, you may have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to receive it in a portable form, and to withdraw consent where consent is the basis for processing.
If you completed a verification, the business that asked for it is the controller, so the quickest route is to contact them. You may also write to us at contact@idproval.com and we will either act on it directly or pass it to that business and tell you we have done so. Note that sessions are deleted quickly by design, so there may be nothing left to retrieve.
If you hold a business account, contact us directly at the same address. We respond within one month, and will tell you if we need longer.
Complaints. You have the right to lodge a complaint with a data protection supervisory authority — in the EU, the authority in the country where you live, work, or where the issue arose; in the UK, the Information Commissioner's Office; in Australia, the Office of the Australian Information Commissioner. You do not have to raise it with us first, though we would like the chance to put it right.
11. Security
Data is encrypted in transit. Session images are encrypted at rest with keys held by us and not by the storage provider, so the provider cannot read them. The service that runs the verification models is not exposed to the public internet and is reachable only over an authenticated private channel.
Access to personal data is limited to staff who need it to deliver the service and is logged. Session credentials are short-lived and are deleted after they expire. We maintain an incident response process and will notify affected parties and regulators of a personal data breach as required by law.
12. Changes to this policy
We may update this policy to reflect changes in how we operate or in the law. Material changes are communicated by email to registered account holders at least 30 days before they take effect. The date at the top of this page shows when it was last revised.
13. Contact
Data protection questions, requests and complaints, and anything else about this policy: contact@idproval.com.