Privacy Architecture
How Cardless ID collects, processes, and protects your identity data — and why we are designed to know as little about you as possible.
1. What data is collected
Verification requires three pieces of data, all of which are processed transiently and never stored long-term on our servers:
| Data | Purpose | Stored? |
|---|---|---|
| Government ID photo (front & back) | Extract identity fields; fraud detection | Deleted immediately after processing |
| Selfie photo | Face matching against ID photo; liveness check | Deleted immediately after processing |
| Extracted identity fields (name, date of birth, document number, address) | Returned to your device for credential creation; HMAC hash kept for integrity verification | Fields deleted after 48 hours; only an HMAC hash is retained |
We collect only what is necessary to issue a credential. Once issuance is complete, the original identity data is not needed and is not kept.
2. How long data is retained
ID & selfie photos — deleted immediately
Photos are saved to a temporary directory only for the duration of processing (typically a few seconds). They are deleted in both the success and error paths. A background sweep runs every 5 minutes and deletes any files older than 15 minutes, protecting against data being left behind by a server crash.
Verification session records — deleted after 48 hours
Firebase stores a session record while your verification is in progress (status, timestamps, HMAC hash). This record is automatically deleted 48 hours after creation. Sessions are valid for 30 minutes; the 48-hour window exists only as a grace period for credential issuance to complete.
Age verification sessions — deleted after 1 hour
Age verification nonce records are deleted after 1 hour, or immediately when the session reaches a terminal state (approved or rejected) — whichever comes first.
Credential (on-chain) — permanent
The Algorand NFT credential is permanent by design — it is what you use to prove your age. It contains only a cryptographic hash and your wallet address. No personally identifiable information is stored on the blockchain.
3. Where data is processed
| System | What it processes | Region | Retains data? |
|---|---|---|---|
| AWS Rekognition | Face comparison, liveness detection | EU (Ireland) by default | No |
| AWS Textract | ID document text extraction | EU (Ireland) by default | No |
| Google Document AI | Document fraud detection | Google Cloud (varies by region config) | No |
| Firebase Realtime Database | Ephemeral session state only (no PII) | Per your Firebase project region | 48h TTL |
| Algorand blockchain | Credential NFT issuance | Decentralised | Permanent (no PII) |
4. What is stored permanently
The only data stored permanently is on the Algorand blockchain:
- Your wallet address (issued at the time of verification)
- A cryptographic hash of your identity data (not reversible to PII)
- The credential issuance date
5. Third-party processors
Amazon Web Services (AWS)
- Services used: Rekognition (face match, liveness), Textract (ID extraction)
- Data sent: ID photo and selfie as base64 images, per verification request
- Retention by AWS: None — images are processed in-memory and not stored
- Data processing agreement: Covered by AWS standard DPA (included in Customer Agreement)
- Transfer mechanism (if applicable): EU–US Data Privacy Framework; default region is EU (Ireland)
Google Cloud (Document AI)
- Services used: Document AI for ID fraud detection
- Data sent: ID photo per verification request
- Retention by Google: None — processed transiently
- Data processing agreement: Covered by Google Cloud DPA
Google Firebase
- Services used: Realtime Database for ephemeral session state
- Data stored: Session ID, status, timestamps, HMAC hash — no PII
- Retention: 48 hours maximum, then automatically deleted
- Data processing agreement: Covered by Google Cloud DPA
6. Zero-knowledge credential design
Once your credential is issued, Cardless ID does not need to know anything about you to verify your age. The verification flow works as follows:
- A website or service presents a QR code asking: "Is this person born before [date]?"
- Your mobile wallet reads the QR code and evaluates the question locally against your stored credential.
- Your wallet responds with true or false plus your wallet address — nothing else.
- The website verifies the response against the Algorand blockchain. No PII is transmitted at any point.
7. Your rights and how to exercise them
Deletion of session data
Verification session records are automatically deleted within 48 hours. If you would like earlier deletion, contact us at [email protected] with your session ID (shown on your receipt screen after verification).
On-chain credential
The Algorand blockchain is immutable — once issued, the credential NFT cannot be deleted. However, it contains no PII. You can abandon the associated wallet at any time, and the on-chain record becomes effectively orphaned.
Photos and identity fields
Photos are deleted immediately after processing and are not accessible after the verification session ends. Extracted identity fields exist only transiently in session state and are deleted with the session.
Contact
For any privacy questions or requests: [email protected]
8. Geographic scope
US users only (currently)
Cardless ID currently supports US-issued identity documents only. Users in the EU and EEA are not able to use the verification service at this time.
This is a deliberate scoping decision while we focus on the US market. See the non-US deployment guide for details on what would be required to extend support to other jurisdictions.
Support
- 📧 Email: [email protected]
- 🐛 Issues: GitHub Issues
- 💬 Community: Discord (coming soon)