Authenticating.com LLC · Version 3.0 · Effective November 11, 2026 · Prior versions
Prior versions of this Policy are available on request from privacy@authenticating.com.
Authenticating.com LLC ("Authenticating.com," "we," "us") maintains written policies for the retention and destruction of biometric identifiers and biometric information in compliance with applicable law, including the Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14; the Texas Capture or Use of Biometric Identifier Act (CUBI), Tex. Bus. & Com. Code § 503.001; Wash. Rev. Code 19.375; and the biometric and sensitive-data provisions of state comprehensive privacy laws.
This Policy is publicly available as required by 740 ILCS 14/15(a) and forms part of our Privacy Policy.
We perform identity verification using facial recognition — comparing two or more captured images of faces. For example, we may compare the face on a government-issued photo ID against a photograph you capture and submit.
The biometric identifiers used to perform this comparison are facial geometry data derived from the photographs you submit.
We collect and retain facial geometry and identity document images for the following purposes:
We do not collect biometric identifiers for any purpose outside this list.
Before we collect, capture or store your biometric identifiers or biometric information, we — or the business that directs you to us — will:
That release is presented as a separate, affirmative action. We do not treat your continued use of a website or service, or your acceptance of general terms of service, as consent to biometric collection.
If you are under 18, we require verifiable consent from your parent or legal guardian before collecting biometric data.
Withdrawing consent. You may withdraw your consent at any time by contacting us at privacy@authenticating.com. Withdrawal does not affect the lawfulness of processing before withdrawal, and we will destroy your biometric data as described in Section 6.
Alternative verification. Where required by applicable law, and wherever otherwise practicable, we offer a verification method that does not involve biometric data. Contact the business requesting your verification, or contact us, to ask about alternatives.
We do not sell, lease, trade or otherwise profit from biometric identifiers or biometric information. This commitment is absolute and is required of us under 740 ILCS 14/15(c).
Why we retain biometric data. We collect and retain facial geometry and identity document images for the purposes set out in Section 1: to verify an individual's identity; to respond to and investigate a dispute raised by an individual about a verification; to investigate suspected fraud or misuse; to allow an individual to be re-verified without providing their information again; to meet our audit, examination and regulatory obligations; and to establish or defend a legal claim.
Our retention schedule. We do not store facial geometry. We permanently destroy the photographs and identity document images it is computed from when the purposes above have been satisfied, or within the period below, whichever occurs first:
| Type of data | Retention |
|---|---|
| Facial geometry and biometric templates | Not stored — computed for the comparison and discarded |
| Photographs and identity document images from which facial geometry is derived | Destroyed within 11 months of the verification |
In no case do we retain biometric identifiers or biometric information for more than three years following an individual's last interaction with us.
This schedule applies to every service through which we process biometric data, including one-time identity verification, re-verification of a returning individual, continuous monitoring and Regulated Services.
Consent and audit records. Records evidencing the notice given to an individual and the release obtained, and the audit and verification logs described in Section 6, are not biometric identifiers or biometric information. We retain them for five years and destroy them thereafter.
Legal hold. Where biometric data is subject to a valid warrant, subpoena, litigation hold or regulatory demand, we retain it only for as long as that requirement is in force, and we destroy it promptly once it is lifted. We do not otherwise extend these periods.
Texas. Tex. Bus. & Com. Code § 503.001(c)(3) requires destruction of a biometric identifier within a reasonable time and in no event later than the first anniversary of the date the purpose for collecting the identifier expires. The periods in this schedule run from the verification and are set so that destruction occurs within that limit.
We do not disclose, redisclose or otherwise disseminate biometric identifiers or biometric information unless:
1) you consent to the disclosure; 2) the disclosure completes a financial transaction that you requested or authorized; 3) disclosure is required by federal, state or municipal law or ordinance; or 4) disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.
These are the disclosure grounds permitted by 740 ILCS 14/15(d).
Vendors. We may share biometric identifiers with third-party service providers who perform biometric verification on our behalf, but only under contracts that prohibit them from retaining, using or disclosing biometric data for any purpose other than providing services to us, that require destruction on the schedule in Section 4, and that require security measures at least as protective as our own. We do not receive payment or other valuable consideration from these providers in exchange for biometric data.
AI and model training. We do not use biometric identifiers or biometric information to train machine learning or artificial intelligence models, except where separately disclosed to and consented to by the individual.
We store biometric identifiers and biometric information in the United States.
Biometric identifiers and source photographs may be accessed remotely by our personnel, agents, contractors, service providers and sub-processors, including personnel located outside the United States. The jurisdictions from which such access occurs are listed on our Sub-Processor List. All such access is limited to the minimum data necessary on a least-privilege basis, occurs through a controlled environment with multi-factor authentication, is subject to detailed logging of every access to biometric systems, and is prohibited from download, local storage or export outside our controlled environment.
Destruction is permanent. We delete the data from our production systems, from any cached copy, and from file storage including prior stored versions. Data held in encrypted system backups taken before destruction is overwritten on our standard backup rotation and is not restored into production or used for any purpose. We do not sell, lease, trade or otherwise profit from biometric identifiers or biometric information.
The methods we use include cryptographic erasure and secure deletion for electronic data, physical destruction of storage media, and cross-cut shredding for physical documents. All of them ensure that data cannot be reconstructed, retrieved or accessed.
Verification. We run an automated process that identifies and destroys biometric data past the periods in Section 4, and a separate automated check that confirms no data remains beyond them. Both are logged.
We store, transmit and protect biometric identifiers and biometric information using a reasonable standard of care within our industry, and in a manner at least as protective as the manner in which we store, transmit and protect our other confidential and sensitive information. This standard is required by 740 ILCS 14/15(e).
Our safeguards include encryption in transit and at rest, access controls limiting access to personnel with a demonstrated need, multi-factor authentication, logging and monitoring, and vendor security review.
Security matters may be reported to security@authenticating.com.
We retain biometric data beyond the periods in Section 4 only under the legal hold described in that Section — that is, only where retention is required by a valid warrant, subpoena, court order, litigation hold, regulatory demand or other applicable law. Where an exception applies, we retain only the data necessary for that purpose and destroy it as soon as the basis for retention ends. We do not otherwise extend the periods in Section 4.
You may request early deletion of your biometric data at any time by contacting our Data Protection Officer at privacy@authenticating.com. We will respond within 30 days and destroy your data within 15 days of verifying your identity, unless retention is legally required.
You may also withdraw consent as described in Section 2.
If you believe a verification result about you is wrong. You may dispute the accuracy or completeness of information we provided about you by writing to disputes@authenticating.com. We will acknowledge your dispute, investigate it, correct anything that is our error, and forward the dispute to the originating source where the information did not originate with us.
How to exercise these rights. Our Consumer Rights page explains each of the rights in this Section, what we will ask you for, and how long each step takes.
BIPA provides a private right of action. Illinois residents may have rights and remedies beyond those in this Policy, including statutory damages.
CUBI is enforced by the Texas Attorney General, with civil penalties of up to \$25,000 per violation. Texas residents may contact the Office of the Texas Attorney General.
Wash. Rev. Code 19.375 governs the commercial collection of biometric identifiers and is enforced under the Washington Consumer Protection Act. Washington residents may also have rights under the My Health My Data Act.
Colorado's Privacy Act, as amended, imposes notice, consent, retention-policy and data protection assessment requirements for biometric data. Maryland's Online Data Privacy Act prohibits the sale of sensitive data, including biometric data, outright — a prohibition we meet as a matter of policy nationwide. Residents of states with comprehensive privacy laws may also exercise the access, deletion, correction, portability and opt-out rights described in our Privacy Policy, including the right to appeal a denied request.
Biometric data processed for the purpose of uniquely identifying a natural person is special category data under GDPR Article 9 and the UK GDPR. We process it only on the basis of your explicit consent under Article 9(2)(a). You may withdraw consent at any time, and you have the rights of access, rectification, erasure, restriction, portability and objection described in our Privacy Policy.
We may update this Policy from time to time. Material changes will be notified in accordance with applicable law. Changes to retention periods will not be applied retroactively to shorten the protections applicable to biometric data already collected.
Version history
| Version | Date | Summary |
|---|---|---|
| 2.0 | [prior date] | Consent and written release process; disclosure restrictions and security standard added; multi-state coverage; vendor and AI restrictions; duplicated contact section removed; address updated to Park City, Utah; governing law aligned to Utah / Summit County; processing location section added at § 5.1 |
| 3.0 | November 11, 2026 | Retention purposes stated in full at § 1; service-specific retention schedules consolidated into a single schedule at § 4: facial geometry and biometric templates not stored (computed for the comparison and discarded), and 11 months for source photographs and identity document images, with a three-year cap on last interaction; consent and audit record retention stated at five years; legal hold provision added; Texas provision restated by reference to § 503.001(c)(3); destruction mechanics, treatment of encrypted system backups and automated verification stated at § 6; consumer dispute route and Consumer Rights page added at § 9.1 |
Prior versions of this Policy are available on request from privacy@authenticating.com.
This Policy is written for individuals whose biometric information we process. Businesses that use our Services should also read our Biometric Data Terms, which set out their obligations to provide notice, obtain written consent, instruct deletion and indemnify us.
Authenticating.com LLC
Attention: Data Protection Officer
1743 Sidewinder Dr, #109
Park City, UT 84060
United States
Privacy and data rights: privacy@authenticating.com
Disputes about a verification result: disputes@authenticating.com
Legal notices: legal@authenticating.com
Security: security@authenticating.com
Toll free: (833) 2-VERIFY
This Policy is governed by the laws of the State of Utah. Disputes arising out of or relating to it are subject to the dispute resolution provisions of our Terms of Use, which designate the courts of the State of Utah sitting in Summit County and the United States District Court for the District of Utah. This does not limit any non-waivable right or remedy available to you under the biometric privacy law of your own state, including the private right of action under the Illinois Biometric Information Privacy Act.
Prior versions of this Policy are available on request from privacy@authenticating.com.