Privacy policy

You are about to hand a stranger a photograph of your face so you can apply for a government document. That is a serious thing to ask for, and a leak is not a password you can change. This page says exactly what we take, why, who else touches it, how long it stays and what we have decided never to do with it.

Who is responsible for your photograph

The controller for everything you upload and for the order record attached to it is the company that operates IDPhoto.now: BEO TECHNOLOGY SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ. The photograph is ours to look after, and we do not pass that responsibility to anyone else. Our payment provider, Dodo Payments, is a separate controller for the payment data it handles. See who processes your data.

To reach the controller about your data, use the contact page. Include your order reference if you have one.

What we collect, and why

The browser detail we keep, and the one we do not

Against a browser session we may store a coarse browser family, for investigating abuse. It is not a user-agent string and not a fingerprint. It is one of exactly four words: mobile, desktop, automated or unknown.

We do not put IP addresses in our session rows or in our audit trail. That is a deliberate design decision, written into the data model rather than into a promise. Our hosting and platform providers keep their own request logs, which contain IP addresses on their own retention schedules. Those are theirs, not ours, and we will not describe them as if we controlled them.

On what basis we process it

For the photograph, the measurements and the order record: performing the contract you entered into when you asked us to check a photo, and taking steps at your request before that contract. For the audit trail and the fraud and abuse controls: our legitimate interest in running a service that can account for who touched a customer’s face photograph. For the accounting record: our legal obligations.

Two honest qualifications. First, the lawful-basis analysis is one of the things the pending legal review has to settle; we have set it out as we understand it rather than leaving the section blank. Second, a facial photograph becomes biometric data under Article 9 of the GDPR when it is processed for the purpose of uniquely identifying a person. Our design deliberately avoids that purpose: we measure image properties and face geometry (one face counted; head angle, position and size measured as numbers and compared with the document’s rules), we build no templates, and the detector never recognises, generates or edits a face. We do not have a legal opinion confirming that analysis and we are not going to pretend we do.

Who processes your data

Two consequences of that table matter, because the marketing language around merchants of record routinely blurs them.

• Dodo never receives your photograph. Files are delivered only from our own authenticated storage, never through a payment provider’s fulfilment channel.
• Dodo being the merchant of record removes none of our obligations to you. It handles transaction taxes and it is the seller of record. Every data-protection duty for your photograph, and the accuracy of everything we say about what the product does, stays with us.

Cookies and analytics

We set the cookies below. Each one is needed for something you use on this site, which is why there is no banner asking you to accept them.

• idp_guest: a random token, marked HttpOnly, with SameSite=Lax and a thirty-day lifetime, and only the hash of it is stored on our side. It holds no personal data: it exists so that the browser that created an order can come back to it. The service cannot work without it.
• locale: the language of the pages you last used or chose, kept for one year. It is marked HttpOnly and Secure, so the page itself cannot read it, and it holds nothing else.
• The sign-in cookies of Better Auth, our sign-in software, set only when someone signs in on the account page. They are marked HttpOnly and keep you signed in until you sign out or the session expires.

There are no analytics cookies, no advertising pixels and no third-party tags on any page that shows a photograph or an order. We have not selected an analytics vendor, and no vendor is permitted on those pages if we ever do.

How long we keep things

• Images for an order that was never paid for: 24 hours.
• Images for a paid order: 30 days, so you can come back for the file.
• Earlier than either, whenever you ask. There is a delete button on your own order page. See delete your photos and data.

Both of those windows are product decisions taken pending legal review, and they may change once the consumer-law and accounting positions are settled. They are not legal conclusions.

The order record outlives the photograph, on purpose

When images are deleted, the order row survives with a flag recording that its materials are gone. So do the payment events, the refund records and the audit trail. None of them contains a photograph. We keep them because accounting and complaint handling need a record of what was sold and what happened, and because doing it this way means those needs never become a reason to hold on to your face.

One thing we are not going to hide: today the measurements taken from your photograph survive deletion of the image, and some of them are EXIF-derived strings such as a camera model and a capture date. Whether they ought to be purged with the image is an open question in our legal review. It is listed here rather than quietly left out.

Backups

Live data is deleted immediately. Our providers keep their own backups and snapshots on their own schedules, which we do not control and do not use to restore individual customer records. We will not claim instant erasure from every backup in the world, because that would not be true.

International transfers, and what “EU hosting” does not mean

Our providers are global platforms and processing can happen outside the country you are in. Dodo Payments’ data processing agreement references the EU standard contractual clauses (2021/914) and the UK international data transfer addendum for its own transfers. Our own transfer mechanisms and the processing locations for each provider are not settled yet, and we are not going to write a sentence here that implies they are.

Two claims we specifically refuse to make:

• Hosting in the EU is not, by itself, GDPR compliance. It is one input among many. Any site that presents an EU flag as a compliance statement is selling you a feeling.
• A storage location hint is a hint, not a residency guarantee. Our object storage supports a location hint, which the provider describes as best effort. The only mechanism that guarantees where objects live is a jurisdictional restriction, fixed when the storage bucket is first created and never changeable afterwards. Unless and until this page says we have chosen one, we have not made you a residency promise.

What we never do

Each of these is something we could technically build and have decided not to. They are commitments, not aspirations.

• We do not train models on customer photographs. Not ours, not anyone’s.
• We do not build a face-recognition database. There is no index anywhere in the system from a face to a person.
• We do not create or retain biometric templates or face embeddings. The numbers our checks measure are stored as plain values on the check rows of your report: for example the face count, the eye position, the head tilt, the head height as a share of the photo, the pixels between the eyes, the range from dark to light on the face, and a confidence level for each result, including the image model’s answers. New uploads store no crop guide. Older uploads stored the face position used to frame the preview, and it is removed with the photo. When retention deletes your photos, the stored images are removed and those values are marked as belonging to a deleted asset, but, like all order records, the numbers themselves remain for accounting and disputes. Still no landmark set, no template, no embedding, and no recognition.
• We do not infer sensitive characteristics from a photograph (not ethnicity, health, religion, age or gender). Nothing in the pipeline attempts it. We read the colour of the skin on the face only to judge whether light shines off the skin, and to soften that shine if you ask us to. We infer nothing from it.
• We do not sell, rent or share photographs with advertisers, data brokers or anyone outside the processors named above.
• We never put photographs, image bytes, access tokens or full email addresses in logs or audit rows. Email addresses in audit rows are redacted to a form like a*****@example.com.
• We do not reuse a photograph across orders. An uploaded file belongs to one order and one order only.
• No person looks at your photo unless you ask our support to, and every staff view in our app is written to the audit trail with the staff account that made it.
• We do not change your features or the shape of your face. We soften shine on the skin only if you ask for it. Nothing is generated, and no photo is enlarged. For Polish, Spanish, French and Argentine documents we may replace the background with a plain colour and turn the whole photo to level a tilted head. For Mexican passports and the Colombian online passport we may replace the background with white. For all of these we may also change the brightness or the contrast of the whole photo once and reduce a colour cast from the light once. If we did any of this, the report says so. Where the authority bans edited photos, we replace the background or correct the brightness or contrast only if you ask for it. For a paper UK passport application we may correct the brightness or the contrast once without asking, because HM Passport Office tells its examiners to accept that change. It is explained on the standards we check against.
• We never ask you to email us a photograph. See contact.

Location data in your own file

Because we hand back your original file unchanged, any metadata your camera wrote stays in it, including GPS coordinates, if your phone was recording them. We do not read those coordinates and we do not store them, but we also do not strip them, because stripping them would mean altering the original file.

If that matters to you, turn location off for the camera app before you take the photo, or remove the location from the image on your phone before uploading. The finished photo and the print sheets we make from your upload carry no camera metadata, location included.

Children

One of the documents we support, US online passport renewal, is only open to applicants aged 25 or older under the State Department’s own eligibility rules. We also sell a child profile: the Polish passport photo for a child, online application. We do not market to children. We do not collect a date of birth and we cannot verify anyone’s age, so we do not design around an age check we do not have. Whether the child profile needs a separate notice is an open item for the legal review.

Your rights, and how to use them

Depending on where you live you have some or all of the following rights over your personal data: to get a copy of it, to have it corrected, to have it erased, to restrict or object to how we use it, to receive it in a portable form, and to complain to your data protection authority. We do not make you jump through hoops to use any of them.

• Erasure of your photographs is self-service and immediate. Open your order page and press the delete button. Delete your photos and data explains exactly what that removes and what it leaves behind.
• Everything else goes through the contact page. To exercise any other of these rights, contact us through the contact page and give your order reference (it starts with ord_). Please do not attach the photograph.

We will ask you to show us that the request is yours, and we will do that with the least data we can get away with, normally by tying the request to an order you can already open. We will not ask you to send a scan of your passport or a photograph of yourself to prove who you are. If we genuinely cannot connect a request to an order, we will tell you so rather than delete someone else’s data on a guess.

Security

The short version: image files live in private object storage with no public address at all; identifiers are long random values and knowing one authorises nothing on its own; access tokens are stored only as hashes; every private page is marked not to be cached or indexed; and links that we email are single use and expire in an hour. The long version, including the gaps we know about, is a working document rather than marketing copy, and this page will be updated as it changes.

What we cannot protect you from

It would be easy to stop at the section above. These are the limits, stated plainly: a compromised phone or browser, where the photograph is exposed before we ever receive it; someone with sustained control of your email inbox; anything you do with a file after you have downloaded it; a lawful order served on us or on one of our providers; and a serious compromise at a provider. We reduce the blast radius (private storage, unguessable keys, short retention) and we do not claim to have eliminated it.

Changes to this notice

When this page changes materially, the date at the top changes with it. When the legal review lands, the draft banner comes off and the open questions in this page get answers rather than being quietly deleted.

Related pages

• Delete your photos and data
• Terms of service
• Contact us