Privacy Policy - Identity SDK
Updated on: October 28, 2026
IDmission LLC (“IDmission”) is concerned about privacy issues and respects the privacy of our users. This Privacy Policy (“Policy”) describes our privacy practices concerning information collected in connection with IDmission’s IDentity Solution, including self-service registration, and all associated validation, enrollment and verification services available through the IDentity SDK Toolkit (the “Services”). A separate policy describes our privacy practices in connection with our online website, located at www.idmission.com/privacy.
IDmission makes the Services available to third parties for integration into those third parties’ websites, applications, and online services. IDmission collects, uses, and discloses individual users’ information only as directed by these third parties and, accordingly, IDmission is a mere processor of user information with respect to the Services and not a controller.
However, in certain cases IDmission may determine the purposes and means of processing certain personal information — for example, for security, fraud prevention, service improvement, meeting the requirements of applicable certification or trust frameworks, or complying with our own legal obligations — and in those cases IDmission acts as a controller. Where IDmission acts as a controller, this Privacy Policy governs that processing directly.
Further, some features of the Services may be disabled or altered by the data controller, or the controller may require IDmission to collect, use, disclose, or otherwise process data in ways that differ from those described below. Thus, to fully understand how your information will be handled when you use the Services, you must review not just this Policy, but also the privacy policy of the third party with whom you are dealing directly (the “Third-Party Data Controller”).
Notwithstanding the above, IDmission may process certain individual users’ information in anonymized form for its own purposes.
IDmission is headquartered in the United States at 8445 Baseline Road, Boulder, CO 80303.
1. What personal and other information IDmission collects about you
IDmission collects “personal information” about users of the Services. “Personal information” is information such as name, email address, or identification card image, which refers to an identified or identifiable person. IDmission processes personal information on behalf of the Third-Party Data Controller. For its own purposes, IDmission processes only anonymized information. “Anonymized information” is information which does not relate to an identified or identifiable person or is rendered anonymous in such a manner that the person is no longer identifiable.
IDmission collects a wide range of personal information through the Services. This information varies depending on the IDentity application and the Third-Party Data Controller in question, but may include such information as name, physical address, email address, telephone number, social security number, driver’s license number, state or national ID card number, passport number, other ID card number, credit or debit card number, CVV, expiration date, and/or date of birth.
In some cases, IDmission may collect a visually scanned or photographed image of your face and/or your identification card, driver’s license, passport, utility bill, bank account statement, or credit/debit card. This image may include your photograph and other information from the imaged document, such as your eye color, weight, height, and organ donor status.
If you agree to use our Facial Biometric Service, IDmission will collect an image of your face that you provide through a mobile app and a photo or scan of your face as it appears on an identification document. IDmission will use facial recognition technology only for the purpose of verifying your identity as the person who appears on the identification document.
IDmission may share the facial scans with the IDmission customer through which you used IDmission’s identity verification service. IDmission will retain your facial recognition information, including the photo of your face and photo or scan of your identification document, for the amount of time requested by the IDmission customer through which you used IDmission’s identity verification service.
In no event will IDmission store your facial recognition information after IDmission ceases to have a customer relationship with the customer through which you used IDmission’s identity verification service.
If you agree to use our Fingerprint Biometric Service, IDmission will collect images of your fingerprints that you provide through a mobile app or integrated fingerprint capture device. IDmission will use biometric enrollment and verification technology only for the purpose of verifying your identity as the person who has enrolled.
IDmission may share the fingerprint images with the IDmission customer through which you used IDmission’s identity verification service. IDmission will retain your fingerprint images, for the amount of time requested by the IDmission customer through which you used IDmission’s identity verification service.
In no event will IDmission store your fingerprint information after IDmission ceases to have a customer relationship with the customer through which you used IDmission’s identity verification service.
If you agree to use our Voice Biometric Service, IDmission will collect a recording of your voice that you provide through a mobile app. IDmission will use biometric enrollment and verification technology only for the purpose of verifying your identity as the person who has enrolled.
IDmission may share the voice recording with the IDmission customer through which you used IDmission’s identity verification service. IDmission will retain your voice recording, for the amount of time requested by the IDmission customer through which you used IDmission’s identity verification service.
In no event will IDmission store your voice information after IDmission ceases to have a customer relationship with the customer through which you used IDmission’s identity verification service.
We may receive personal or anonymized information about you from the Third-Party Data Controller that integrates the Services into its website, application, or other online service. This information includes a unique ID, selected by the Third-Party Data Controller, that uniquely identifies you in the third party’s database. For additional information, review the privacy policy of the Third-Party Data Controller.
At the direction of the Third-Party Data Controller, IDmission also might obtain information about you from other third parties, such as consumer reporting agencies and fraud-prevention services.
When you use the Services, we automatically receive and record certain information from your computer (or other device) and/or your web browser. This may include such information as the third-party website or application into which the Services are integrated, the date and time that you use the Services, your IP address and domain name, your software and hardware attributes (including operating system, device model, and hashed device fingerprint information), and your general geographic location (e.g., your city, state, or metropolitan region). We will process such data only as instructed by the Third-Party Data Controller.
We also use cookies in connection with the Services. For further information please refer to the section entitled “Cookies” below.
2. Cookies
3. How IDmission uses the personal and anonymized information that we collect
In general, IDmission uses the personal and anonymized information that we collect in connection with the Services as discussed in this section of the Policy.
Personal information is used by IDmission only as directed by the Third-Party Data Controller that integrates the Services into its website, application, or other online service. Subject to the privacy policy of the Third-Party Data Controller, we use your personal information as follows on behalf of the Third-Party Data Controller:
IDmission may use your personal information to provide the Services. For example, we might use your credit card information or ID card information to populate an online form, or to verify your identity in connection with your use of another online service. We also may use your personal information to fulfill the terms of any agreement between us and the Third-Party Data Controller; to complete a transaction that you initiate; to deliver account information, notifications, and similar operational communications; and to comply with legal and/or regulatory requirements.
IDmission Analytics & Research
Anonymized information that we collect in connection with the Services is used by IDmission for its own purposes to perform analytics and research concerning the Services.
4. How IDmission shares personal and anonymized information with third parties
In general, IDmission shares the personal and anonymized information that we collect in connection with the Services as discussed below.
However, IDmission shares personal information only as directed by the Third-Party Data Controller, and thus the following language is subject to the privacy policy of the Third-Party Data Controller.
We share the personal and pseudonymized information that we collect on behalf of a particular Third-Party Data Controller with that Third-Party Data Controller.
IDmission also uses third-party service providers to help us deliver, manage, and improve the Services. These service providers may collect and/or use your personal information or anonymized information to assist us in achieving the purposes discussed above in the section entitled “How we use the personal and non-personal information that we collect.” For example, we use a third party to help us translate the information contained in scanned images of identification cards.
We also may share your personal information with other third parties when necessary to fulfill your requests for services; to complete a transaction that you initiate; or to meet the terms of any agreement that you have with us or our partners.
We partner with certain other third parties to collect anonymized information and engage in analysis, auditing, research, and reporting.
We also may use or share your personal information with third parties when we have reason to believe that doing so is necessary:
- to comply with applicable law or a court order, subpoena, or other legal process;
- to investigate, prevent, or take action regarding illegal activities, suspected fraud, violations of our terms and conditions, or situations involving threats to our property or the property or physical safety of any person or third party;
- to establish, protect, or exercise our legal rights or defend against legal claims; or
- to facilitate the financing, securitization, insuring, sale, assignment, bankruptcy, or other disposal of all or part of our business or assets.
From time to time, IDmission may also share anonymized and aggregated information about users of the Services, such as by publishing a report on trends in the usage of the Services.
5. Security
IDmission uses commercially reasonable physical, electronic, and procedural safeguards to protect your personal information against loss or unauthorized access, use, modification, or deletion. Among other things, IDmission encrypts sensitive information both in transit and at rest.
Compliance & Auditing
IDmission is PCI Level 3 compliant and regularly conducts security audits, vulnerability scans, and penetration tests to ensure compliance with security best practices and standards.
However, no security program is foolproof, and thus we cannot guarantee the absolute security of your personal or other information. Moreover, we cannot guarantee the safety of your information when in the possession of other parties, such as the Third-Party Data Controller.
6. What Are Your Data Subject Rights?
Depending on applicable data protection laws and the circumstances of the processing, individuals may have the following rights in relation to their personal information:
You have the right to receive clear and transparent information about how we collect, use, retain, disclose, and otherwise process your personal information. This Privacy Policy provides information about our processing activities.
You may request access to the personal information we hold about you and information about how that information is processed, subject to applicable legal requirements and exemptions.
You may request that inaccurate or incomplete personal information held by us be corrected or updated.
In certain circumstances, you may request that your personal information be deleted or removed. This right is not absolute and may not apply where we are required or permitted to retain or process the information under applicable law, including where the information is required for legal claims or other lawful purposes.
In certain circumstances, you may request that we restrict the processing of your personal information. Where processing is restricted, we may retain the information but will generally not process it further except as permitted by applicable law.
Where applicable, you may request to receive personal information that you have provided to us in a structured, commonly used, and machine-readable format. Where technically feasible and required by applicable law, you may also request that the information be transmitted directly to another organization.
In certain circumstances, you may object to the processing of your personal information, including where processing is based on legitimate interests or is otherwise permitted under applicable law.
Where applicable, you may have rights relating to decisions based solely on automated processing, including profiling, where such decisions produce legal effects or similarly significantly affect you. These rights are subject to applicable legal requirements and exceptions.
How to Exercise Your Rights
If you wish to exercise any of the rights described above, or if you have a question or concern regarding the processing of your personal information, you may contact IDmission using the contact details provided in the Grievance Officer section of this Privacy Policy.
We may need to verify your identity before processing a request in order to protect your personal information from unauthorized disclosure.
We will process and respond to valid requests in accordance with applicable data protection laws and within one calendar month of receiving a verified request. Where permitted by applicable law, the time required to respond may be extended where a request is complex or where multiple requests are received. Where an extension applies, we will inform you of the reason for the delay.
Where we determine that we cannot fulfil a request, we will provide an explanation where required by applicable law and inform you of any applicable right to lodge a complaint with the relevant supervisory or regulatory authority.
7. Reviewing and updating your information
IDmission will grant you access to your personal information as directed by the Third-Party Data Controller that integrates the Services into its website, application, or online service. IDmission also will retain your personal information as directed by the Third-Party Data Controller and, accordingly, we may retain your personal information for as short as a few minutes or as long as five years.
Thus, if you want to learn more about the personal information that IDmission has about you, or you would like to submit a request to update or change that information, please contact the Third-Party Data Controller. You also may reach us by email at privacyteam@idmission.com.
8. Changes to this Policy
Technology and the Internet are rapidly changing. IDmission therefore is likely to make changes to the Services in the future and as a consequence will need to revise this Policy to reflect those changes. When we revise the Policy, IDmission will post the new Policy on the IDmission website’s home page (www.idmission.com) and also on the IDentity Service website (https://identity.idmission.com), so you should review that page periodically.
If we make a material change to the Policy, you will be provided with appropriate notice. If we maintain your email address, we also may email you a copy of the revised Policy at your most recently provided email address. It is therefore important that you update your email address if it changes.
9. Questions or comments
If you have any questions or comments regarding our Policy, please email us at: privacyteam@idmission.com