Biometric Data Policy

Identity verification on BeyondSwipe involves a one-time biometric step: a live selfie is compared against the photograph on your government-issued document to confirm you are the person that document belongs to. Biometric information is among the most sensitive categories of personal data, so we publish this separate policy setting out exactly what is collected, by whom, why, how long it is kept, and how it is destroyed.

The biometric processing is performed by Stripe, Inc. through Stripe Identity, acting as our service provider. Stripe captures the selfie and the document image, derives facial geometry from each, and compares them.

BeyondSwipe does not collect, receive, possess, or store biometric identifiers or biometric information at any point. The images and the facial geometry derived from them are transmitted directly to Stripe and are never sent to, routed through, or held on BeyondSwipe systems. What we receive is a single result indicating whether the comparison succeeded.

We do not use facial recognition to identify members, we do not run one-to-many searches against any database, and we do not apply biometric processing to profile photos or to any other content you upload. The only comparison performed is one-to-one, between your selfie and your own document.

Biometric information is used for one purpose only: confirming that the person completing verification is the person shown on the identity document presented. It is used to prevent impersonation, stolen-identity signups, underage access, and the operation of fraudulent or duplicate accounts. It is not used for advertising, profiling, matching, ranking, training machine-learning models, or any secondary purpose.

Before any capture takes place, we display a written notice explaining that biometric information will be collected and processed by Stripe, the specific purpose, and the retention period. Verification proceeds only if you consent. You may decline, in which case you will not be able to complete verification, and an unverified account cannot connect with other members. We record the fact, version, and timestamp of consent.

This is our permanent retention and destruction schedule for biometric data:

• Held by BeyondSwipe: none, at any time. There is nothing for us to destroy because we never hold it.
• Held by Stripe: destroyed on completion. Immediately after a verification returns a successful result, our systems automatically instruct Stripe to redact the verification session. Redaction permanently removes the document images, the selfie, and the personal data extracted from them from Stripe records, including from the Stripe dashboard.
• Stripe outer limit: one year. Stripe retains biometric identifiers for no longer than one year, or until consent is withdrawn, whichever is earlier. In practice our redaction step occurs far sooner than this.
• What survives. After destruction we retain only a non-biometric record: a verification session reference, the outcome, and the date. This record contains no images and no biometric information, and is kept for the life of the account plus a limited period afterwards for fraud prevention and to enforce removals.

We do not sell, lease, trade, or otherwise profit from biometric information, and we do not disclose it to any third party. We could not do so in any case, since we never hold it. Stripe processes it solely on our instructions as our service provider, subject to its own published privacy commitments.

You may withdraw consent to Stripe's retention of biometric identifiers by contacting Stripe directly at privacy@stripe.com. You may request deletion of your BeyondSwipe account and its verification record at any time by writing to privacy@beyondswipe.app. See our Privacy Policy for the full set of rights available to you and our response times.

Privacy Officer, 15748666 Canada Inc.
privacy@beyondswipe.app

See also: How verification works and Regional notices.