Privacy Policy

This Privacy Policy describes how IT Brains SASU (a company registered in France, operating under the brand "ProofAge", "we", "us") processes personal data in connection with our age verification and identity verification (KYC) services.

ProofAge provides its services to businesses ("Service Providers") who integrate our API into their own platforms. When end users complete a verification, they interact with ProofAge's technology on behalf of that Service Provider.

This policy covers two groups of people whose data ProofAge processes:

• Business customers who integrate the ProofAge API
• End users who complete a verification through a Service Provider's platform

This policy is governed by Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (Loi n° 78-17 du 6 janvier 1978 modifiée, "Loi Informatique et Libertés").

When you register for and use the ProofAge API as a business, we process the following data for which ProofAge acts as a Data Controller in its own right:

Data collected

• Company name, registered address, and business contact details
• Account credentials (email, hashed password)
• API keys and workspace configuration
• Billing and payment information (processed by our payment processor)
• API usage data and request logs
• Support communications

Legal basis and purpose

• Contract performance (GDPR Art. 6(1)(b)) — to provide the ProofAge service, manage your account, and process billing
• Legal obligation (GDPR Art. 6(1)(c)) — to comply with tax, financial, and regulatory obligations
• Legitimate interest (GDPR Art. 6(1)(f)) — to maintain API security, prevent abuse, and improve our service

Retention

Account data is retained while your account is active and for up to 5 years after closure to satisfy legal and contractual obligations. API logs are retained for 12 months.

When you complete a face-based age verification through a Service Provider's platform, ProofAge acts as a Data Processor on behalf of that Service Provider.

Data collected

• A live facial photograph captured via your device camera
• A face embedding — a mathematical vector representing your facial geometry (see Section 5)
• Age verification result: whether the 18+ threshold is met
• IP address and approximate geolocation (country / city)
• User-Agent string (browser and device information)
• Device fingerprint hash (a pseudonymous identifier for fraud prevention)
• Timestamps of session events
• Consent record: version accepted, date, and time

Purpose and legal basis

Retention

After each retention period, data is permanently and irreversibly deleted. The Service Provider's own retention practices are governed by their privacy policy.

KYC verification is either initiated directly by the Service Provider or triggered as an escalation from face-based age verification when confidence is insufficient. It requires a separate explicit consent, additional to any age verification consent.

Data collected

Images:

• Live selfie photograph
• Identity document — front image (all document types)
• Identity document — back image (ID cards and driver's licences)

Biometric data (special category, GDPR Art. 9):

• Face embedding from selfie (see Section 5)
• Face embedding from document photo
• Face matching result: similarity score, threshold, decision (matched / not matched)

Identity document data extracted automatically:

• Full legal name, date of birth, nationality, gender
• Document type, number, issuing country, issue and expiry dates
• Machine Readable Zone (MRZ) data

Document validation and technical data:

• MRZ checksum, field format and consistency validation, expiry status
• IP address, geolocation, User-Agent, device fingerprint hash, timestamps
• Consent record: version, date, time

Retention

A face embedding is a mathematical vector derived from a facial image. It represents the relative distances between facial landmarks as a series of numbers. A face embedding cannot be used to reconstruct or display a photograph.

ProofAge retains face embeddings for 12 months after each verification session for the following fraud prevention purposes:

• Comparing a new verification attempt against a list of previously blocked profiles
• Detecting repeated attempts by the same person under different identities
• Protecting Service Providers and their users from identity fraud

Face embeddings are stored in encrypted form within the EEA. They are not shared with Service Providers or any third party. After 12 months they are permanently and irreversibly deleted.

The retention of face embeddings is covered by the explicit consent you provide before each verification. If you withdraw consent, your face embedding will be deleted within 30 days of your request.

All verification data — photographs, face embeddings, identity document data, and session metadata — is stored and processed exclusively within the European Economic Area (EEA), on Google Cloud Platform infrastructure in EU regions.

ProofAge implements appropriate technical and organisational measures (TOMs) to protect personal data against unauthorised access, accidental loss, destruction, or alteration. Measures include, but are not limited to:

• Encryption in transit (TLS) and at rest
• Role-based access controls and authentication
• Regular security assessments
• Data minimisation — only data necessary for each purpose is collected
• Sub-processors operating under binding data processing agreements

ProofAge does not sell, rent, or otherwise commercially exploit biometric data or identity document information. Data is disclosed only to:

• The Service Provider (Data Controller) — verification result only (approved / declined)
• Cloud infrastructure sub-processors — operating within the EEA under data processing agreements
• Competent authorities or courts — when required by applicable law

If you have undergone a verification through a Service Provider's platform, you have the following rights with respect to data processed by ProofAge:

ProofAge verification processes involve fully automated decision-making as defined by GDPR Article 22. No human routinely reviews your photograph, face embedding, or identity document.

The automated system produces a binary outcome (approved / declined) which is communicated to the Service Provider. The Service Provider then determines whether to grant you access to their service.

In accordance with Art. 22 GDPR, you have the right to:

• Request human review of the decision by contacting the Service Provider
• Express your point of view
• Contest the decision

You also have the right to contact ProofAge at privacy@proofage.xyz if you believe the automated result was technically incorrect.

We may update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or other factors. When we do, we will update the "Last updated" date at the top of this page.

Material changes that affect end users will be reflected in an updated consent version presented at the next verification. Business customers will be notified by email.