Privacy Policy

This Privacy Policy explains how SoLiDware AB (company registration number 559432-1761, Vallgatan 8, 352 34 Växjö, Sweden; "we", "us" or "our") collects, uses, stores and shares personal data when you use IDfier. SoLiDware AB is the data controller for the processing described here.

It covers:

• the IDfier mobile app ("the App");
• the website idfier.com, including public profile pages; and
• IDfier's business products, such as age verification and Login with IDfier, when you use the App to share details with a business.

IDfier Sign (sign.idfier.com) is covered by its own privacy notice. Businesses that receive your details through IDfier handle them under their own privacy policies.

Identity verification. To create an account you verify your identity with one of these methods:

• Document scan and face check: you scan a government ID (such as a passport, national ID card or driver's license) and take a short selfie or video to prove you are a real person and that the ID is yours. Depending on the method, this runs on your device or with our verification provider Tuteliq. Some methods also read the NFC chip in your ID to confirm it is genuine.
• Swedish BankID: you sign in with BankID and we receive your name and personal identity number from the BankID record.

From your verification we store: your full name, personal identity number (if your ID or BankID provides one), date of birth, gender, nationality, country, document type, document number, the document's issue and expiry dates, and whether the NFC chip was checked (yes or no). Your name, personal identity number, date of birth, email, nationality and document number are stored encrypted.

If your verification method provides the portrait photo from your ID document, we store it so you can choose to show it to people you exchange IDs with. We do not store your selfie, video or any face template. Where a face match is done on your device, we store only the resulting similarity score.

Account and profile. Your email address (verified with a one-time code), preferred name, IDfier handle, profile names and descriptions, profile photos, the links you add, your plan, credits and purchase records.

ID Exchange. The details you choose to share in each ID Exchange, who you share them with, and how long the exchange lasts.

Sharing with businesses. When a business asks you to verify your age or sign in with IDfier, we record which business asked, when, and whether you approved or declined, so you can see your history in the App.

Device and technical data. A device identifier generated by the App, your device type and operating system, a push notification token, an app attestation token (used to confirm requests come from the genuine App), and error reports when the App or our servers fail. Your IP address is used to start BankID sign-ins and to protect our services against abuse; we do not store it.

Website. When you use the contact form on idfier.com we receive your name, email address, topic, subject and message. With your consent, the website uses Google Analytics; see our Cookie Policy.

• To provide IDfier (create and run your account, verify your identity, run ID Exchanges and public profiles, process purchases, and send the notifications you need): performance of our contract with you (GDPR Art. 6(1)(b)).
• To verify your face against your ID document: this involves biometric data, which we process only with your explicit consent, given when you start verification (GDPR Art. 9(2)(a)). You can withdraw consent by deleting your account; withdrawal does not affect verification already completed.
• To share details with other people or businesses: only when you approve each ID Exchange or business request (contract and, for special categories, your explicit consent).
• To keep IDfier secure and working (prevent fraud and abuse, fix errors, and understand how features are used): our legitimate interests (GDPR Art. 6(1)(f)).
• To answer your messages sent through the contact form: our legitimate interest in responding to you.
• Website analytics: your consent, which you can change at any time in the cookie settings (GDPR Art. 6(1)(a)).
• To meet legal obligations, such as responding to lawful requests from authorities (GDPR Art. 6(1)(c)).

We do not sell your personal data, use it for advertising, or make decisions about you based solely on automated processing that have legal or similarly significant effects, other than the identity check you ask us to perform.

People you choose. In an ID Exchange, the other person sees only the details you select, and nothing is revealed until both of you approve. If you publish a profile, anyone can see it, including your display name, handle, profile photo, description, links, how you verified (for example BankID or document scan, and the document type), whether the NFC chip was checked, and how closely your profile photo matches your ID photo. You can unpublish a profile at any time.

Businesses you approve. A business only receives the details its IDfier account is set up for, and you see exactly those details before you approve. Depending on the business, this can be a yes or no for an age check, or details such as your name, email, date of birth, age, gender, country, IDfier handle, verification level or personal identity number. It also receives an identifier so it can recognise you next time. This identifier is different for every business, so businesses cannot use it to match you with each other.

Service providers that process data on our behalf, only for the purposes below:

• Tuteliq: identity document and face verification. Receives the images and video captured during verification and returns the document details.
• BankSignering / BankID (Sweden): BankID sign-in. Receives your IP address and returns your name and personal identity number.
• Vercel (servers in Stockholm, Sweden): hosting of our servers and storage of files such as ID portraits and profile photos.
• TiDB Cloud by PingCAP (servers in Frankfurt, Germany): our database.
• Resend: sends one-time codes to verify your email address.
• Expo, Apple and Google: deliver push notifications.
• Ably: delivers live updates to the App, identified by your internal user ID.
• Google Firebase App Check: confirms requests come from the genuine App.
• RevenueCat, Apple App Store and Google Play: in-app purchases and subscriptions. RevenueCat does not receive your name or contact details.
• Branch: opens IDfier links (such as ID Exchange invitations) in the App.
• Sentry (United States): error monitoring for the App and our servers, including recordings of App screens when an error occurs in a sampled share of sessions.
• LogSnag: product event logging, identified by your internal user ID and IDfier handle.
• FormSubmit: forwards messages from the website contact form to our inbox.
• Google Analytics: website statistics, only if you accept analytics cookies.

Authorities and legal requirements. We may disclose data when required by law, court order or a lawful request from a public authority.

Business transfers. If SoLiDware AB is involved in a merger, acquisition or sale of assets, your data may be transferred as part of it. We will tell you before your data becomes subject to a different privacy policy.

Our database is located in the EU (Frankfurt, Germany), and our servers and file storage in Sweden (Stockholm).

Some service providers listed above, including Sentry, process data outside the EU/EEA, mainly in the United States. When they do, the transfer is protected by an EU adequacy decision, such as the EU–US Data Privacy Framework for certified providers, or by the European Commission's standard contractual clauses. Contact us for more information about these safeguards.

• Your account, including verification details, ID portrait, profiles, profile photos, links, ID Exchanges and your history of business requests: until you delete your account.
• Selfies, verification video and face data: not stored by IDfier.
• When you delete your account (Settings → Delete Account), we delete it and the files stored for it straight away. If you have an active ID Exchange that the other person has verified, the deletion is postponed until the sharing period you both agreed to has ended, and then completed automatically within a day.
• Backups: deleted data can remain in encrypted database backups for a limited period until the backups are overwritten.
• Error reports and event logs: for the limited retention periods set in Sentry and LogSnag.
• Contact form messages: as long as needed to handle your request.

We may keep specific data longer when the law requires it, for example accounting records for purchases.

All traffic between the App, the website and our servers is encrypted with TLS. Sensitive fields such as your name, personal identity number, date of birth, email and document number are encrypted in our database, and the database itself only accepts encrypted connections. Access to personal data is limited to people who need it to run IDfier. We review our security measures regularly.

Under the GDPR you have the right to:

• Access the personal data we hold about you and receive a copy of it;
• Rectify inaccurate data. Identity details come from your ID document or BankID, so to correct them you verify again with an updated document; contact us if anything looks wrong;
• Erase your data, which you can do yourself with Delete Account, subject to the postponement described above;
• Restrict or object to processing based on our legitimate interests;
• Data portability: receive your data in a structured, machine-readable format;
• Withdraw consent at any time, without affecting processing before the withdrawal.

To use these rights, contact us at info@idfier.com. We answer within one month.

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se, or with the data protection authority where you live.

IDfier is not intended for children under 13, and we do not knowingly collect their personal data. If you believe a child under 13 has created an account, contact us and we will delete it.

We may update this Privacy Policy when our services or legal requirements change. We will update the date at the top of this page and, for significant changes, notify you in the App or by email before they take effect.

For questions about this Privacy Policy or our handling of your data, contact:

SoLiDware AB (559432-1761)
Vallgatan 8, 352 34 Växjö, Sweden
Email: info@idfier.com