Privacy
Policy

The following data is stored exclusively on your device, encrypted with AES-256-GCM, protected by your biometric authentication. LifePassport's servers never receive or store this data:

• Passport data read from the NFC chip (name, date of birth, nationality, photo)
• Driving licence data (scanned via OCR and NFC)
• Face photos captured during liveness verification
• Liveness biometric data (see Section 7 for full details)
• Self-asserted identity profile (address, middle names)
• OAuth tokens from government services (HMRC, NHS Login, etc.)
• Verified identity claims and credentials

We store the following data on our servers to operate the service:

• Account data: Email address, phone number (E.164 format), hashed password, country of residence
• Device registration: FCM push token, device fingerprint hash, platform (Android/iOS)
• Cryptographic hashes: SHA-256 hashes of your verified claims — used to confirm verifications without storing the actual data
• Verification receipts: Digitally signed records of verification events (no PII — only hashes, timestamps, and outcomes)
• DID (Decentralised Identifier): Your public cryptographic identifier — contains no personal information

When a business requests your identity, you see exactly which claims they are requesting and choose whether to approve or reject the request. You can approve with full data, or use zero-knowledge proofs to confirm facts without revealing the underlying data.

You are always in control. No identity data is shared without your explicit, per-request approval via biometric authentication.

Children under 18 cannot create their own LifePassport account. A parent or legal guardian must create a Child Profile within their own account. The parent retains full control over:

• Which platforms can request the child's identity verification
• Which specific claims each platform can verify
• Granting and revoking consent for each platform individually
• Viewing all verification activity in the audit log

Children undergo liveness-based age estimation using on-device AI (the image never leaves the device). The system produces a multi-signal confidence score combining facial age estimation, declared age, parent-child plausibility, and document evidence where available.

Biometric processing for children: Any mathematical representation of the child's face used during liveness age estimation is transient — it is processed entirely within the device's secure enclave and destroyed immediately after the check completes. LifePassport does not create, transmit, or store a persistent biometric template for any child on its servers. See Section 7 for full biometric data details.

The system automatically schedules re-verification checks as children grow. When a child transitions between age brackets (e.g. turning 13 or 16), the system can automatically revoke consents that are no longer appropriate for the new age bracket. Parents are notified via push notification when re-verification is due.

Automated decision-making: Automatic consent revocation on age bracket transitions and automatic re-verification scheduling are necessary for the protection of the child (GDPR Article 22(2)(b) — processing necessary for reasons of substantial public interest under Article 9(2)(g)). Parents are notified of all automated actions and may contest any automated decision regarding their child's age verification or consent status by contacting our privacy team at privacy@lifepassport.id.

We apply strict data minimisation for children's profiles:

• No facial images are stored on our servers — liveness checks are processed entirely on-device
• Only the age bracket (e.g. "13–15") and a confidence score are stored, never the actual date of birth
• Businesses receive only the minimum claims needed (e.g. "under 18 = true") — never the child's full identity
• Child profiles can be deleted at any time by the parent, which immediately revokes all active consents

A primary parent can invite a secondary parent or guardian to co-manage a child's profile. Both parents have visibility of the child's consent status and verification history.

LifePassport is designed to comply with child privacy regulations across jurisdictions. The following table summarises how our architecture meets key requirements:

When a business registers on the LifePassport Consumer Portal, we collect:

• Business name, registered address, and company number
• Industry category (used to determine which claims the business can request)
• Contact email addresses for portal users (admin, manager, viewer roles)
• Hashed passwords for portal authentication
• Webhook URLs for receiving verification notifications

API keys are generated for authenticated API access. Key hashes are stored server-side; the raw key is shown only once at creation. Keys can be rotated or revoked at any time through the portal.

The data a business receives depends on their chosen data tier:

LifePassport's data governance service enforces which claims a business can request based on their industry category, country of operation, and applicable regulations. A gambling company cannot request medical data. A hotel cannot request credit scores. These restrictions are enforced programmatically and cannot be bypassed.

All API activity on the Consumer Portal is logged in an immutable audit trail, including verification requests, approvals, rejections, API key usage, and team member changes. This audit trail is available to the business through the portal and may be required for regulatory compliance.

LifePassport does not create, collect, store, or retain any biometric template, biometric identifier, or persistent mathematical representation of your face on its servers.

All biometric processing occurs exclusively on your device:

• Face photos captured for liveness verification are processed within the device's hardware-backed secure enclave (Android Keystore / iOS Secure Enclave)
• Any mathematical representation of your face used during liveness analysis is transient — it exists only in volatile memory during the check and is destroyed immediately upon completion
• No biometric data, template, or derived representation is transmitted to LifePassport's servers or any third party
• The only output sent to our server is a pass/fail liveness confidence score (a single number)

LifePassport uses your device's built-in biometric authentication (fingerprint or face recognition) to authorise sensitive operations such as identity sharing. This biometric check is handled entirely by the operating system (Android BiometricPrompt / iOS LocalAuthentication) — LifePassport never receives, processes, or stores the biometric data used for device unlock.

When you scan a passport or driving licence, the photo from the document is stored encrypted on your device for potential face-matching during verification. This photo is never uploaded to our servers. If you delete your profile or uninstall the app, this data is permanently destroyed.

You have the right to:

• Request confirmation of whether we hold any biometric data about you (we do not hold any on our servers)
• Delete all on-device biometric data at any time by deleting your profile or uninstalling the app
• Opt out of liveness verification (note: this may limit the assurance level of your identity)

Automated consent revocation and re-verification scheduling for children are necessary for the performance of the contract (providing a child-safe identity service) and for reasons of substantial public interest in the area of child protection (GDPR Article 9(2)(g), UK Data Protection Act 2018 Schedule 1 Part 2).

You may contest any automated decision by contacting our privacy team at privacy@lifepassport.id. We will:

• Review the decision with human oversight within 5 working days
• Provide a clear explanation of the automated logic and inputs
• Reverse or modify the decision if it is found to be incorrect
• Offer an alternative manual process if you object to automated decision-making

Parents may contest automated decisions affecting their children's profiles at any time. Identity Consumers may contest automated claim restriction decisions through the Consumer Portal or by contacting privacy@lifepassport.id.

Because LifePassport's architecture keeps personal identity data on your device, the data we hold on our servers is limited to:

• Your email address, phone number, and hashed password
• Your country of residence
• A device registration token (for push notifications)
• Your DID (a public cryptographic identifier — not personal data)
• SHA-256 hashes of your verified claims (one-way hashes — the original data cannot be recovered from these)
• Digitally signed verification receipts (containing no personal data — only hashes, timestamps, and outcomes)
• For children: an age bracket (e.g. "13–15") and a confidence score — never date of birth

We do not hold: your name, date of birth, address, passport data, driving licence data, face photos, biometric templates, or any verified identity claims. All of that data exists only on your device.

You have the following rights, with practical notes on what each means given our architecture:

• Right of access: You can request a copy of everything we hold. Because we do not store your personal identity data, the response will contain only the account and cryptographic data listed above. Your full identity data (documents, photos, credentials) is on your device — you already have it.
• Right to rectification: You can update your email address or phone number through the app. On-device identity data (name, address, etc.) can be edited directly on your device — we cannot correct it because we don't hold it.
• Right to erasure: You can delete your account from Settings, which permanently removes all server-side data within 30 days. To remove on-device data, delete your profile in the app or uninstall it.
• Right to restrict processing: You can limit how we process your data. In practice, you already control every instance of data sharing by approving or rejecting each verification request individually.
• Right to data portability: You can request your server-side data in a structured, machine-readable format (JSON). Note that this will contain only account data and hashes — not your identity credentials, which are already portable on your device.
• Right to object: You can object to processing based on our legitimate interests (security monitoring, fraud prevention). Contact privacy@lifepassport.id.
• Right to withdraw consent: You can withdraw consent for any specific identity sharing at any time. Since every verification requires your real-time biometric approval, no sharing continues without your active, ongoing consent.
• Right not to be subject to automated decisions: You may contest any automated decision (see Section 11). For children's profiles, parents may contest automated age bracket transitions or consent revocations at any time.

In addition to exercising the above rights on behalf of your child, you may:

• View all platforms that have requested your child's identity
• Revoke any active consent immediately
• Delete your child's profile entirely (all consents are automatically revoked)
• Contest any automated decision about your child's age bracket or consent status

• Access and export your business registration data and audit logs
• Close your Consumer Portal account (verification receipts are retained for regulatory purposes)
• Request deletion of portal user accounts

Contact us at privacy@lifepassport.id. We will respond within 30 days (or 72 hours for access requests, since we hold minimal data and the response is straightforward). There is no charge for exercising your rights.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

Because we don't store your personal identity data in the first place, there is very little to forget. Deleting your account removes your email, phone number, hashes, and receipts. Your identity credentials were never on our servers — they disappear when you remove them from your device.

In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA:

As a California resident, you have the right to:

• Right to know: Request disclosure of the categories and specific pieces of personal information we have collected, the sources, the business purposes, and the categories of third parties with whom we share it
• Right to delete: Request deletion of your personal information (subject to exceptions such as regulatory receipt retention)
• Right to correct: Request correction of inaccurate personal information
• Right to opt out of sale/sharing: We do not sell or share your personal information, so no opt-out is necessary
• Right to limit use of SPI: Request that we limit our use of sensitive personal information to what is necessary to provide the service
• Right to non-discrimination: We will not discriminate against you for exercising any of these rights

To submit a verifiable consumer request, contact us at privacy@lifepassport.id with "California Privacy Request" in the subject line. We will verify your identity before processing the request and respond within 45 days. You may designate an authorised agent to make a request on your behalf.

We do not offer any financial incentives or price differences in exchange for the retention or sale of personal information.