Part 1. ChainPass Privacy Policy
Effective date: [OPEN]. Version: [OPEN].
1. Who we are
ChainPass [legal entity name, OPEN] is a Delaware corporation. ChainPass verifies identity and age for platforms and issues the V.A.I. (Verified Anonymous Identity). This policy covers chainpass.io, the ChainPass enrolment pages, the retrieval and recovery pages, and the ChainPass API.
ChainPass is the controller of the identity data it verifies. When ChainPass collects a contact detail or username because a platform asked for it, ChainPass acts for that platform and hands the detail to the platform.
Contact: support@chainpass.io. Postal address: [OPEN].
2. What we collect
| Data | When | Why | Who holds it |
|---|---|---|---|
| Government ID document and the live selfie taken with it | Enrolment, identity step | To confirm you are a real adult and the person on the document | Our verification provider. ChainPass receives the result and a match percentage. [OPEN item 1] |
| Two face images captured by ChainPass, and the face template built from them | Enrolment, identity step and acceptance page | To confirm it is still you at later checks | ChainPass |
| V.A.I. number, credential level, state, issue date, renewal date, document expiry date, provider retention expiry | Issued at enrolment | To run the credential | ChainPass |
| Background check result: clear, or something on file | Enrolment, before the V.A.I. is issued | Platforms that require it | The screening provider runs the check. ChainPass records the result only. |
| Email address and/or phone number, and a username if the platform asks for one | Registration step | One-time passwords and delivery to the platform | Collected for the platform and handed to it. ChainPass keeps a recovery contact. |
| Three security question answers and backup codes | Retrieval page | Account recovery | ChainPass, stored hashed |
| Signed records: terms acceptance, signature agreement, Law Enforcement Disclosure (United States only), mutual consent records | When you sign | Proof of what was signed, by which V.A.I., and when | ChainPass. Versioned and timestamped. |
| Payment confirmation | When you pay for a V.A.I. | To activate the credential | Our payment processor holds your card details. ChainPass does not. |
| Payout reference | Platforms and earners receiving commissions | To pay commissions | Trolley holds name, bank and tax data. ChainPass holds only a Trolley recipient ID. |
| Device and log data: IP address, browser, error and security logs | Every visit | Security, fraud and abuse prevention, service operation | ChainPass and its hosting providers |
| Business contact details: name, work email, platform name and website | Platform inquiry form on chainpass.io | To respond to your inquiry | ChainPass |
3. Your biometric data
ChainPass asks for your consent to collect and use your face data before any image is captured. The consent is ChainPass's own agreement with you and is separate from any platform's terms. You can decline. Without it a V.A.I. cannot be issued.
ChainPass uses your face template only to confirm that the person presenting a V.A.I. is the person who enrolled. ChainPass does not sell, lease or trade biometric data and does not profit from it in any other way. ChainPass does not share your face template with any platform.
ChainPass deletes face data on the earliest of: the purpose ending, [OPEN: period] after your last interaction with ChainPass, or the date required by law. [OPEN item 3: this must be reconciled with the append-only baseline rule before publishing.]
4. What a platform receives
When you finish enrolment from a platform, ChainPass hands that platform:
- Your V.A.I. number.
- A session key, delivered once. ChainPass deletes its own copy at the handoff.
- The contact details and username the platform asked ChainPass to collect.
- The results the platform is set to receive: a yes/no, a colour band, or a colour band with a match percentage.
A platform does not receive your face template or your ID document from ChainPass. [OPEN item 2: state here whether, when, and under what process the platform may use the session key to obtain your legal identity from the verification provider.]
Each platform's terms say what that platform requires ChainPass to collect and what it does with the result. You accept those terms on the ChainPass acceptance page before your V.A.I. is activated, and on your first visit to any other platform.
5. Who else processes your data
| Provider | Purpose |
|---|---|
| Identity verification provider ComplyCube — identity verification | Document and liveness check |
| Offenders.io | Background check (sex offender registry today) |
| Supabase, Amazon Web Services | Hosting and database [OPEN item 6: regions] |
| Payment processor [OPEN item 8] | V.A.I. payments |
| Trolley | Commission payouts |
| SMS and email delivery providers [OPEN: name each] | One-time passwords and notices |
Each provider processes data only for the purpose listed and under a written agreement. ChainPass does not sell or rent personal data and does not share it for cross-context behavioural advertising.
ChainPass discloses data to public authorities only when legally required, and responds only to valid legal process.
6. How long we keep it
| Data | Kept for |
|---|---|
| ID document and selfie | The verification provider's retention period [OPEN: state each provider's period] |
| Face template | See section 3 |
| V.A.I. number and credential record | For the life of the credential. One person holds one V.A.I. for life, so the number is not reissued or reassigned. |
| Signed records | Kept unaltered for [OPEN: period] as proof of what was signed |
| Session key | Deleted at the handoff to the platform |
| Security answers and backup codes | Until you replace them or the account closes |
| Logs | [OPEN: period] |
7. Your rights
Depending on where you live, you may ask to access, correct, delete or receive a copy of your data, object to or restrict processing, and withdraw consent. Residents of California, Colorado, Connecticut, Virginia, Texas and other US states have rights under their state laws. Residents of the EU, UK and Switzerland have rights under the GDPR and equivalent laws.
Some records cannot be changed: a signed agreement record is kept as signed. Deleting your identity data ends your V.A.I.
Send requests to support@chainpass.io. ChainPass will confirm it is you with a face check or your recovery details before acting. ChainPass does not discriminate against you for using these rights. You may complain to your local data protection authority.
8. International transfers
ChainPass processes data in the United States. Where the law requires it, transfers from the EU, UK or Switzerland rely on Standard Contractual Clauses or an equivalent safeguard.
9. Age
ChainPass issues a V.A.I. only to adults aged 18 or older, or the age of majority where you live if higher. ChainPass does not knowingly collect data from minors except the document check that refuses them.
10. Changes
ChainPass will post changes here with a new effective date. A material change is shown to you before it applies.