Request a demo

IDVAR Privacy Policy

Last updated: October 15, 2026

IDVerifier S.L., Spanish tax ID B23929896, registered at Calle Cronos, 63, 28037 Madrid, Spain, provides the IDVAR application and related services. For privacy matters, contact privacy@idvar.ai; for technical support, contact support@idvar.ai.

1. Scope

This policy describes how personal data is processed when using IDVAR, a mobile application for completing identity checks requested by participating organizations through compatible links or QR codes. The operations performed depend on the requesting organization.

This policy covers processing associated with IDVerifier S.L.'s application and platform. Organizations requesting checks may receive and use verification results for their own purposes and are responsible for explaining that processing in their own privacy notices.

2. Roles and responsibilities

IDVerifier S.L. acts as controller for processing it determines for account administration, platform operation, security and support. Where it processes information on documented instructions from an organization requesting a verification, it acts as processor to the extent applicable.

The requesting organization determines the purpose of a check, the information required and subsequent use of results. It must explain the applicable legal basis, retention and available rights regarding its processing.

3. Information processed

Depending on the requested flow, IDVAR may process:

  • Identity document data: document images, names, dates of birth, nationalities, document numbers and other supported attributes.
  • Facial data: captured images and information derived for facial comparison, liveness detection and age estimation.
  • Fingerprint data: images and associated information where the relevant capture feature is requested.
  • Verification results: authenticity checks, matching results, estimates, selected attributes and requested document information.
  • Account and authentication data: email addresses, account identifiers, WebAuthn (passkey) credential identifiers and public keys, and technical session information.
  • Operations and security data: device, application, session and transaction identifiers, timestamps, processing statuses, errors and other data needed to protect and operate the service.
  • Support and beta feedback: support communications and, where Apple TestFlight is used, crash reports, technical information and voluntary feedback.

Not every verification uses all these data categories.

4. Purposes and legal bases

Information is processed to perform requested and approved checks, protect and deliver results to the appropriate recipient, manage accounts and passkeys, maintain platform security and availability, investigate errors and incidents, and handle support requests. During beta testing, feedback is used to identify and correct issues.

For processing determined by IDVerifier S.L., applicable legal bases may include performance of a contract or steps requested by an individual, compliance with legal obligations, or legitimate interests in service security, abuse prevention and support, as relevant to the operation. Where consent is legally required for an activity, it will be sought accordingly.

Biometric data processed to uniquely identify a person may be special-category data under Article 9 of the GDPR. The requesting organization must establish the appropriate legal basis and additional condition for its processing. Approving the operations displayed in IDVAR enables a user to decide whether to participate, but does not replace the requesting organization's legal responsibilities.

IDVerifier S.L. does not use images or biometric data collected during identity verification for behavioral advertising.

5. On-device checks and sharing results

A participating organization starts a session and provides a compatible link or QR code. IDVAR displays the requested checks and asks the user to approve them before proceeding. Users may decline.

Document and biometric analysis operations are performed locally on the device. IDVAR integrates specialized third-party technology components for these operations. Their local execution does not involve sending document images, facial images, fingerprints or verification results to the technology providers' servers.

Depending on the authorized flow, a requesting organization may receive personal attributes, authorized images or technical verification results. Sensitive results are cryptographically protected for their intended recipient before traveling through IDVAR's intermediary infrastructure.

6. Retention and deletion

Verification data and temporary messaging. IDVAR’s secure intermediary infrastructure relays protected verification messages and holds them only temporarily for the duration of the relevant session, using automatic expiration (time-to-live). This infrastructure does not retain persistent copies in databases or storage. Requesting organizations may separately retain results they receive under their own privacy notices.

Security logs. IDVAR’s technical and security logging system records technical events, such as session or transaction identifiers, timestamps, statuses and errors. It does not retain identity document images, biometric templates or verification results. Logs are retained for at least 12 months to support security, traceability and incident investigations. During beta testing, authorized staff review and delete logs through a manual process; automation is planned for production. Records are reviewed to determine whether continued retention is necessary in light of applicable obligations and ongoing security investigations.

Account and authentication. Account information and public authentication credentials are retained while an account is active and needed to provide the service. Users may initiate account deletion in IDVAR, which removes corresponding account records and credentials from the active authentication system. Data may remain temporarily in provider backups or records governed by applicable retention requirements and provider terms.

Local history. IDVAR may display a locally stored verification history. This is not a centralized platform repository of identity documents or biometric data; it is managed on the device, subject to the local information retained by the app.

Support and beta. Support communications and beta feedback are kept for as long as needed to handle a request, diagnose an issue and meet applicable obligations. Users may request deletion where applicable.

7. Service providers and recipients

IDVAR uses infrastructure and security services to operate the platform, including:

  • A third-party managed authentication provider for account management, passkeys and sessions. IDVAR's instance is hosted in Ireland (European Union) and may process email addresses, identifiers, session data and public WebAuthn credentials.
  • Specialized document and biometric verification technology providers, whose components run locally within the application. These providers do not receive document images, biometric images or verification results from those IDVAR operations on their servers.
  • Requesting organizations, which receive information and results intended for them as part of an approved flow.
  • Cloud infrastructure and operations providers, which deliver technical hosting, security and observability services.
  • Apple, which may provide technical reports and beta feedback submitted through TestFlight.

8. International data transfers

The managed authentication instance used by IDVAR is hosted in Ireland, within the European Economic Area. Hosting location alone does not rule out certain access or processing by a provider or subprocessor from another country. Where an international transfer of personal data takes place, it must be subject to an applicable transfer mechanism and safeguards required by law. You may request additional information about service providers and applicable safeguards at privacy@idvar.ai.

9. Security and passkeys

IDVAR applies authentication, encryption, access control, integrity checks and security event monitoring. The intermediary messaging infrastructure does not need plaintext access to sensitive verification results.

For optional user accounts, IDVAR uses WebAuthn-based passkeys. Private keys remain under the user's authenticator's control and are not transmitted to IDVerifier or the managed authentication provider. If a device uses Face ID, Touch ID or another local method to authorize a passkey, the biometric images or templates used for that local step are not sent to the authentication service.

10. Account deletion and individual rights

Users can delete their account within the IDVAR application. They may also contact privacy@idvar.ai to exercise applicable rights of access, correction, erasure, objection, restriction, portability and withdrawal of consent. Withdrawal does not affect processing lawfully carried out beforehand.

For results retained by the organization that initiated a verification, users should contact that organization. IDVerifier S.L. will assist where required in its role as processor.

Individuals may lodge complaints with the Spanish Data Protection Agency (AEPD): https://www.aepd.es.

11. Children and age-related checks

IDVAR may be used to check whether an individual meets an age threshold set by an external service. IDVAR does not itself grant access to those services or replace their age restrictions. The requesting organization is responsible for providing appropriate notices and meeting requirements relating to children, including parental authorization where applicable.

12. Apple TestFlight beta testing

When an IDVAR beta is distributed using Apple TestFlight, Apple may share crash and usage information and, if a tester supplies it, feedback and screenshots with the developer. IDVerifier S.L. uses this information to investigate issues and improve the app. Testers should avoid including identity documents or biometric images in feedback or screenshots sent to support.

13. Changes to this policy

We may update this policy to reflect changes in the service, processing activities or legal requirements. The current version will show its latest revision date.

14. Contact

IDVerifier S.L. — Spanish tax ID B23929896
Calle Cronos, 63, 28037 Madrid, Spain
Privacy: privacy@idvar.ai
Support: support@idvar.ai
Website: https://idvar.ai