Privacy Policy

Effective Date: August 21, 2026   |   Last Updated: August 21, 2026

This Privacy Policy governs the manner in which ID123 Inc. and our affiliates (“ID123”) collect, uses, maintain and processes data, including Personal Information on our Website, Services and Mobile Apps. ID123 Inc. is a Delaware corporation headquartered at 100 Summer St Suite 1600, Boston, MA 02110 USA. This Policy applies to ID123 Inc.; no other entity is currently covered by this Policy unless a Policy specific to that entity states otherwise. The purpose of this privacy policy is to inform you about what kinds of information we may collect, process or store about you, how we may use that information, whether we disclose it to anyone, and your rights regarding the use, access and correction of your personal information. We are committed to safeguarding your Personal Information.

This policy does not apply to companies that we do not own or control, or to the actions of people we do not employ or manage. This includes any companies from whom you may have submitted your data to independently or through our Services, and any companies from whom you may have visited through a link made available to you through our Services.

If you disagree with this Privacy Policy, you should not use or stop using our Websites Services and Mobile Apps. Our marketing Website is not directed at children under 13 years of age. Where an educational institution issues digital ID cards to students, including students under 13, we process that information solely as a service provider to the institution and under the institution’s authority. Those arrangements are described in our Student Data Statement.

ID123 provides identity products and services (our “Services”) to institutions worldwide (our “Customers”) to help them create, manage their digital ID cards and credentials, and issue them to both people and things (“End Users”). We also provide Services directly to End Users to help them create a digital identity profile and store their institutionally issued ID cards and credentials. We also provide in-app messaging services to our Customers enabling them to communicate with their Users through the mobile application. Each End User has the option to opt-in or opt-out of receiving messages from the institution. Our Website at “id123.io” and other affiliated sites such as mobile app stores are used to market and advertise our Services as well as serve as a channel for support and feedback for Customers and Users.

Certain parts of our Website allow you to submit personal information voluntarily to learn more about our Service or for support reasons. We may collect personal information about you (such as full name, email address, country, phone number) so we can fulfill your request. You may also provide information about your employer, such as company name, URL and country. We will use this information to respond to your inquiries and communicate with you about our products.

When you visit our Website or Mobile App, we collect certain information related to your device, IP address, browser, geographic location (e.g. country or city-level location), and the time that you visited our Website. We may use cookies and similar technologies to help us track your usage automatically. You can choose to opt out of our cookies when visiting our Website. For more information on our use of cookies, please see our Cookie Policy. We will use the information we collect to analyze how our Website and Mobile App is used and to improve the experience. We will also use it to administer our website, troubleshoot issues, route web traffic, provide advertising to you on third party sites and to enable security mechanisms to prevent abuse.

End Users may upload personal information, such as email addresses, telephone numbers, physical addresses, full names, and photos to our Service to create their profile. End Users will have their email address and phone number verified to ensure they are the legitimate contacts of that individual. We use this information to enable the End Users to sign into the Service and so we can send them communications about their account or their issued digital ID cards. We may use the physical mailing address submitted by End Users to enable the shipping of a physical ID card duplicate to their home or other location, if applicable. End Users may upload a profile face photo or photos of other supporting identity documentation. We use the profile face photo as the default ID card face photo when an End User is installing a new digital ID card and we enable them to submit their photos to an ID card issuing institution. We may also use the profile face photo along with their name as part of chat communications to identify their messages in a conversation. With the End Users permission, we may compare photos submitted by the End User that contain their face with photos provided by the ID Card issuing institution that contain their face as part of the ID card issuing process to prevent fraud. We may collect and process face data from the photos provided by End Users to identify violations of photo ID card guidelines before the photo is submitted to the ID card issuing institution. For example, we may use face data to ensure the End Users eyes are open, or they are not wearing a hat or dark sunglasses. We rely on data processors to process, encrypt and securely storing the photos. We do not share photos with third parties or permit sub-processors to use photos for any other purpose. We will only share photos with an ID card issuing institution upon the request of the End User as part of the digital ID card issuing process. We also provide End users with the tools to share their digital ID card photo and other identity information with third parties from their device.We do not store the face data processed from ID card photos on our servers or share face data with third parties.

Our Customers are businesses and institutions. These Customers may upload ID card information including personal information, such as email addresses, telephone numbers, physical addresses, full names, identification numbers, and photos. Customers may send us attributes of their End Users in order for us to personalize their digital ID cards as well as communication with them. We use this information to generate a digital ID Card and related identity Services to End Users for our Customers. Our Customers can import photos of End Users faces that will then be added and displayed to the End User’ ID cards in the app so that the End User can be utilized as an ID card. Customers who upload an End User face photo controls the photo and this photo can be updated, modified or deleted at any time by the Customer. With the End Users permission, we may compare the photos provided by the ID Card issuing institution that contain their face with a photo or video of the End Users face taken from the Digital ID card app as part of the ID card issuing process to prevent fraud. We may use face data from the photos submitted by the Customer to identify violations of photo ID guidelines before the photo is issued to the End User as a digital ID card or physical ID card.

Customers may use our Services to collect information from their End Users through the mobile app in order to verify their identity and issue them a digital ID card. This may include personal information, photos, identity information, and also device information. We may display form fields within the mobile in order to collect information or obtain consents from an End User on the Customers behalf. We may host an email address or phone number for a Customer in order for them to send and receive communication with End Users on their behalf. We may collect replies and track opens and clicks of those messages. Customers can give End Users the option to upload their own face photos or other supporting identity documentation. We process and store this information on our Customers behalf as their data processor.

We will collect information, including Personal Information, about each Customer when they register for the Service, such as name, email address, phone number company name, company address, support email. We will use that information for correspondence concerning Customer’s use of the Service, regarding such things as product functionality, security updates, billing, support or other service related or marketing reasons. Any recipients of marketing emails will always be able to opt-out of receiving marketing information at any time. If the Customer pays buy credit card, our payment processor will collect payment information in order to process payments for their usage of the Service.

If you are a resident of California, you have rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the “CCPA/CPRA”). These obligations cover any California resident’s personal information we process through the use of our Website, Services, and Mobile Apps. Data submitted to another company independently or through our Services is not covered under this section and all inquiries regarding your data rights should be directed to them.

Your rights are:

• Right to know. You may request disclosure of the categories and specific pieces of personal information we have collected, the sources, the business or commercial purpose for collecting it, and the categories of third parties to whom we disclosed it.
• Right to delete. You may request deletion of personal information we have collected from you, subject to statutory exceptions.
• Right to correct. You may request that we correct inaccurate personal information we maintain about you.
• Right to opt out of sale or sharing. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.
• Right to limit the use and disclosure of sensitive personal information. We use sensitive personal information only for the purposes permitted under Cal. Civ. Code § 1798.121(a) — namely, to perform the Services requested by the institution that issued your ID card, to verify or maintain the quality of those Services, and to prevent, detect and investigate identity fraud. We do not use or disclose sensitive personal information to infer characteristics about you, and we do not use it for advertising or profiling.
• Right to non-discrimination. We will not discriminate against you for exercising any of these rights.

Notice at Collection. When you use our Website, Services, and Mobile Apps we collect the following categories of personal information: identifiers (such as name, email address, telephone number, postal address and institutional identification number); commercial information (such as subscription and payment records); internet or network activity information (such as device, browser and usage data); geolocation data at the country or city level; visual information (face photographs and supporting identity documents); professional, employment or education information supplied by the issuing institution; and inferences drawn only as necessary to deliver the Service.

Sensitive personal information. Some of the information above is “sensitive personal information” under the CPRA, specifically: government identification numbers, biometric information processed for the purpose of uniquely identifying an individual, and, where an issuing institution elects to place them on a credential, information revealing racial or ethnic origin, religious or philosophical belief, union membership, health status, or sexual orientation or gender identity. We collect and process this information solely at the direction of the issuing institution in order to create and maintain the digital credential you requested, and for identity fraud prevention.

We disclose these categories of personal information to service providers and contractors for business purposes only, in order to provide the Services, for operational reasons, and for internal analytics. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined by the CCPA/CPRA. Because we do not sell or share personal information, we do not offer a “Do Not Sell or Share My Personal Information” mechanism; we nonetheless honor Global Privacy Control (GPC) and similar opt-out preference signals received from your browser.

We have not sold or shared personal information, and have not disclosed sensitive personal information for purposes requiring an opt-out, in the preceding twelve (12) months. We do not knowingly sell or share the personal information of consumers under 16 years of age.

You have the right to request the disclosure of all personal information we process about you over the past 12 months, including the right to know what personal information we disclosed to third parties for a business purpose. We will review your request and provide a disclosure which contains the categories and specific pieces of personal information we have processed, the sources of personal information, the business purpose for processing, and any third parties with whom we have shared your personal information. To ensure your privacy and security, we will take reasonable steps to verify your identity before processing your request.

You have the right to request the deletion of your personal information we have processed. We will review your request and will delete your personal information as well as direct all service providers to delete your personal information from their systems. Deletion of personal information is subject to certain exceptions, such as complying with law enforcement requests or other legal matters.

If you choose to exercise any of your data rights, we will not discriminate against you or your use of our Services in any of the following ways, including denying goods or services to you, charging different prices or rates for goods or services, providing a different level or quality of goods or services to you, or suggesting any of the above.
You can send an email to privacy@id123.io to request a disclosure or deletion of your personal information. Please note that you may only make a CCPA-related data access or data portability disclosure request twice within a 12-month period.

Authorized agents. You may use an authorized agent to submit a request on your behalf. We will require written proof of the agent’s authority and may require you to verify your own identity directly with us.

How we respond. We will acknowledge your request within ten (10) business days and respond substantively within forty-five (45) calendar days. Where necessary, we may extend that period by a further forty-five (45) days and will notify you of the extension and the reason for it.

Where ID123 acts for an institution. Where we process personal information on behalf of a school, employer, government body, association or other institution, we act as a service provider and that institution is the business. We will refer your request to that institution and assist them in responding.

A number of U.S. states have enacted comprehensive consumer privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and others. If you are a resident of a state with such a law in force, you have the right to:

• Confirm whether we process your personal data and access that data;
• Correct inaccuracies in your personal data;
• Delete personal data you provided or that we obtained about you;
• Obtain a portable copy of your personal data;
• Opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions producing legal or similarly significant effects. ID123 does not engage in any of these activities; and
• Where required by your state’s law, consent before we process sensitive data. Where ID123 acts on behalf of an institution, that institution is responsible for obtaining any consent required.

Appeals. If we decline to act on your request, you may appeal that decision by replying to our response or by emailing privacy@id123.io with the subject line “Privacy Request Appeal.” We will respond to your appeal in writing within forty-five (45) days, and will explain the reasons for our decision. If your appeal is denied, you may contact your state Attorney General to submit a complaint.

To exercise any of these rights, email privacy@id123.io or use our Data Erasure Request form.

Data Protection Officer. ID123 has appointed Andrew Reed as our Data Protection Officer (DPO). You can contact our DPO with any questions about this Policy or our processing of your personal information at dpo@id123.io.

Legal Bases for Processing. Where we process your personal information as described in this Policy, we rely on one or more of the following legal bases under the GDPR, UK GDPR, and Swiss FADP: performance of a contract, where processing is necessary to deliver the Services to the institution that issued your digital ID or to you directly, including creating and maintaining your ID card and verifying your identity; legitimate interests, where processing is necessary for purposes such as maintaining the security of our Website and Services, preventing fraud, and improving our products, provided those interests are not overridden by your rights and interests; legal obligation, where processing is necessary to comply with applicable law, regulation, or a valid legal request; and consent, where you have specifically agreed to the processing, such as where you have opted in to marketing communications or provided cookie consent as described in our Cookie Policy. Where we rely on consent, you may withdraw it at any time by contacting privacy@id123.io, without affecting the lawfulness of processing carried out before its withdrawal.

You may request access to your information to review, modify or request deletion of any personal information we process about you. We will review your request and will respond in accordance with applicable data protection laws. To protect your privacy and security, we take reasonable steps to verify your identity before processing rights requests. We will also stop sending marketing communications to you by clicking “Unsubscribe” in any marketing e -mail communications we send you.

If you are a resident of the EEA, the United Kingdom, or Switzerland, you can object to processing of your personal information, ask us to restrict processing of your personal information or, if applicable, request the portability of your personal information. You can send an email to privacy@id123.io to exercise these rights or fill out a Data Erasure Request. If you are a resident in the EEA, the United Kingdom, or Switzerland, you have the legal right to complain to the data protection authorities in your jurisdiction about our collection and use of your personal information.

You may also have the right to make a complaint to the relevant supervisory authority. A list of EEA Supervisory Authorities is available here: http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm. UK residents may contact the UK Information Commissioner’s Office (ICO) at https://ico.org.uk/. Swiss residents may contact the Federal Data Protection and Information Commissioner (FDPIC) at https://www.edoeb.admin.ch/. If you need further assistance regarding your rights, please contact us using the contact information provided below and we will consider your request in accordance with applicable law. In some cases our ability to uphold these rights for you may depend upon our obligations to process personal information for security, safety, fraud prevention reasons, compliance with regulatory or legal requirements, or because processing is necessary to deliver the services you have requested. Where this is the case, we will inform you of specific details in response to your request.

If you are a Data Principal located in India, or your personal information is processed in connection with our offer of goods or services to individuals in India, you have rights under India’s Digital Personal Data Protection Act, 2023 (the “DPDPA”), including the right to a summary of your personal data and how we process it, correction and erasure of your personal data, withdrawal of consent at any time as easily as it was given, grievance redressal (including escalation to India’s Data Protection Board), and the right to nominate another individual to exercise these rights in the event of your death or incapacity.

Where we process the personal data of a child — defined under the DPDPA as an individual under the age of 18 — in connection with an institution-issued digital ID, we do so solely as a service provider to, and under the instruction of, that institution, which is responsible for obtaining any required parental or lawful guardian consent. We do not track, profile, or target advertising to children.

To exercise your rights or file a grievance under the DPDPA, use our Data Rights Request form.

ID123 operates a multi-region hosting model. Data processed through the Service and the Mobile App is hosted in the data region selected by the card-issuing institution, and is not moved between regions except as necessary to provide the Service. Physically separate data regions are currently maintained in the United States (AWS US East, Virginia), Canada (AWS Canada, Montreal), the European Union (AWS Europe, Frankfurt), and Australia (AWS Asia Pacific, Sydney). Institutions in other territories are served from a logical partition within one of these physical regions. The current region map is published on our Security page.

Information collected through our marketing Website (including contact and enquiry forms, live chat, and website analytics) is hosted in the United States.

Additionally, we may use third-party vendors and affiliates in various countries around the world to process information on our behalf. A current list, including the country in which each vendor processes data, is published on our Sub-Processors page. We have taken appropriate safeguards, including the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum where applicable, to require that your personal information remains protected in accordance with our obligations.

We have legitimate business interests to collect process and retain personal information for the purposes described in this Policy. We retain personal information we collect from you for as long as we have an ongoing legitimate business reason or requirement to do so. Specific retention periods by data category, and the criteria we use to determine them, are published in our Data Retention & Deletion Schedule. While retaining the data, we will securely store your personal information. We use appropriate technical and organizational security measures to protect personal information against unauthorized access, disclosure, alteration, and destruction.

We do not sell or rent any of your information to third parties for any advertising or marketing purposes. However, the following describes some of the ways that We may disclose your information in the normal course of providing Our services.

We may use third party vendors, consultants and other service providers to help us with any of the collection and processing activities described herein. Those providers work on our behalf, as instructed by our team.  Prior to sharing data with a third party, we assess the provider’s controls to ensure the data is correctly processed and adequately protected. We require that any information disclosed to a provider is used only to provide services to us and only as allowed by applicable law. For a list of third party vendors we use to process personal information see Exhibit 2 of our Data Processing Addendum https://www.id123.io/terms/dpa/

We may provide your information with a subsidiary, parent company or company under common control with ID123 inc. Our affiliates will use your information only as described in this Policy.

We reserve the right to disclose information as required by law or regulation, including in response to lawful requests by public authorities, such as to meet national security or law enforcement requirements, and when necessary to comply with a judicial proceeding, court order, or legal process.

If we are involved in a merger, acquisition or sale of all or a portion of its assets, your information may be shared or transferred as part of that transaction, as permitted by law and only for the purposes disclosed herein.

ID123 is committed to safeguarding the transfer of your data between the EU and the US.  Our Data Processing Agreement (DPA) https://www.id123.io/terms/dpa/ includes the European Commission’s Standard Contractual Clauses and is incorporated into our Terms of Service. Where we transfer personal information to a third party, we remain accountable for ensuring that party provides a level of protection consistent with the standards described in this Policy, unless we can demonstrate that we are not responsible for the event giving rise to the harm.

With respect to personal data of individuals located in India, we process and transfer personal data outside India in accordance with the DPDPA, including any restriction on transfers to specific countries or territories that the Central Government of India may notify from time to time, where applicable.

We periodically update this Privacy Policy. We will post any changes on this page and, if the changes are significant, we will send an email notification if we have your contact info and permission.

If you have any questions concerning our privacy policy, or how we treat your data, please contact us at: privacy@id123.io or mail us at ID123 inc. 100 Summer St Suite 1600, Boston, MA 02110 USA