This policy covers the face data used in phonebook.directory’s identity check. For Washington residents, it is also our consumer health data privacy policy.
What is collected. When you choose to verify, you give our identity provider, Didit, a photo of your government ID and a selfie. Didit measures the geometry of the face in each to compare them. Nothing is collected unless you start a check and agree first.
Why. Only to confirm that you are the person on the ID. We never sell, rent, trade, or otherwise profit from it, and never use it for advertising.
Who has it. Didit does the check for us under a written agreement. That agreement also lets Didit use information from checks, once it is anonymized, aggregated or pseudonymized, to prevent fraud and abuse across its service and to keep its service secure. We have switched off Didit’s use of it to train its models. We never receive your ID photo, selfie, or face data, only the result. We disclose it to no one else unless a court order, subpoena, or other law requires it.
How long. Didit permanently deletes your ID photo, selfie, and face data within a month of the check and does not keep a face template. We keep the result (verified or not, and the date) while your account exists, and delete it when the account is deleted.
How it’s protected. With at least the care we give our other confidential information: encrypted in transit and at rest, and open only to the people who need it.
Your rights. You can ask whether we or Didit hold your face data, get a copy, have it deleted, or withdraw your consent (your Verified badge comes off). Write to privacy@phonebook.directory. We answer within 45 days. If we say no, reply to ask us to reconsider; if we still say no, you can contact your state’s attorney general.