1. Who we are
IDProval Inc. ("IDProval", "we", "us") operates the identity verification platform available at idproval.com. This policy explains how we process personal data when you use our platform as a business customer or when your end-users complete a verification session initiated by one of our customers.
2. Data we collect
Account data. When a business registers, we collect name, email address, company name, and billing information necessary to maintain the account and process payments.
Verification session data. When an end-user completes a verification, we process identity documents, biometric images (facial photographs), and extracted data fields such as name, date of birth, and document number on behalf of the business that initiated the session.
Usage data. We collect log data, API request metadata, and aggregated analytics to operate and improve the platform. This data does not include personal identity document content.
3. How we use personal data
We use account data to provision services, send transactional communications, and process billing. We process verification session data solely on behalf of and under the instruction of the business customer who initiates the session. We do not use end-user verification data to train AI models or for any purpose beyond service delivery without explicit consent.
4. Data sharing
We do not sell personal data. We share data only with sub-processors necessary to deliver the service (cloud infrastructure, payment processors) and with the business customer who requested the verification. All sub-processors are bound by data processing agreements meeting applicable data protection standards.
5. Data retention
Verification session data is retained for the period specified in the relevant customer agreement and deleted upon expiry or upon a verified deletion request. Account data is retained for the duration of the account and deleted within 90 days of account closure.
6. Your rights
Depending on your jurisdiction, you may have the right to access, correct, delete, or port your personal data, and to object to or restrict certain processing. End-users wishing to exercise rights over verification data should contact the business that requested their verification. Account holders may contact us directly at legal@idproval.com.
7. Security
We encrypt data at rest and in transit. Access to personal data is restricted to personnel who require it for service delivery and is logged for audit purposes. We maintain an incident response process and will notify affected parties of data breaches as required by applicable law.
8. Changes to this policy
We may update this policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email to registered account holders at least 30 days before taking effect.
9. Contact
Questions about this policy or data protection matters can be directed to legal@idproval.com.