Privacy Policy

1. About This Policy

This Privacy Policy explains how IdGenum, LLC ("IdGenum," "we," "us," or "our") collects, uses, protects, and discloses personal information when you use our website, applications, and services.

2. Information We Collect

Depending on the services you use, we may collect the following categories of information.

2.1 Account Information

We may collect:

• email address;
• authentication and account identifiers;
• account status and preferences; and
• information used to secure and administer your account.

Passwords are managed through our authentication provider and are not stored by IdGenum in readable form.

2.2 Persona Profile Information

We may collect information you provide when creating or maintaining an IdGenum persona, including:

• display name;
• persona description;
• contact email;
• profile or identity-reference images; and
• related account or persona settings.

2.3 Biometric Information

If you choose to enroll in biometric features, IdGenum may process information derived from your facial or voice characteristics for identity verification, persona protection, and related security purposes.

Depending on the features you use, this may include:

• facial geometry or derived facial representations;
• biometric voice features or derived speaker representations; and
• protected biometric-derived values used by IdGenum for verification.

Biometric enrollment is optional unless a particular feature clearly requires verified identity status.

IdGenum does not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information.

2.4 Blockchain Information

IdGenum may create or manage blockchain-based records used to provide publicly verifiable proof associated with a persona or credential.

Such records may include:

• a decentralized identifier (DID) or similar blockchain identifier;
• blockchain transaction identifiers;
• block or transaction metadata; and
• issuance or status references associated with a credential.

Public blockchain records are designed to be immutable and generally cannot be deleted after publication.

IdGenum does not intentionally place raw biometric data, biometric templates, protected biometric-derived values, profile photographs, email addresses, voice recordings, or other direct identity attributes on the public blockchain.

Where supported, IdGenum may deactivate an identifier or revoke an associated credential, but the underlying blockchain transaction record may remain permanently available.

2.5 Billing Information

Payments are processed through third-party payment providers such as Stripe.

IdGenum does not store complete payment-card numbers.

Depending on the payment method and transaction, we may receive or retain limited payment-related information such as:

• payment status;
• payment method type;
• masked payment details such as the final four digits of a card;
• Stripe customer, subscription, invoice, or transaction identifiers; and
• billing history needed to operate the service and maintain financial records.

2.6 Device, Security, and Usage Information

We may automatically collect limited technical information associated with your use of the Service, including:

• IP address;
• browser or device information;
• access times;
• application and security logs;
• authentication or session information;
• fraud-prevention and security signals; and
• similar diagnostic or usage information.

For more detail on the technologies involved, see our Cookies & Similar Technologies notice.

3. Analytics, Cookies, and Similar Technologies

3.1 Plausible Analytics

IdGenum uses Plausible Analytics to understand aggregate website usage and improve the Service.

Our standard Plausible implementation is designed to provide website analytics without using analytics cookies, persistent cross-site identifiers, or behavioral advertising profiles.

IdGenum does not use Plausible for targeted advertising or to track users across unrelated websites.

Plausible may process limited technical information needed to generate aggregate website statistics. IdGenum uses this information to understand matters such as general traffic patterns, page usage, and site performance.

3.2 Strictly Necessary Cookies and Storage

Although IdGenum does not rely on analytics cookies for Plausible, the Service may use cookies, browser storage, session identifiers, or similar technologies that are strictly necessary to operate, secure, or provide requested functionality.

These technologies may be used for purposes such as:

• user authentication;
• maintaining secure sessions;
• fraud prevention;
• account security;
• payment or checkout functionality;
• load balancing or infrastructure operation;
• remembering user-requested settings; and
• protecting forms and application requests from abuse.

Where required by applicable law, IdGenum will provide any additional notice or consent mechanism required for technologies that are not strictly necessary. Additional detail is available in our Cookies & Similar Technologies notice.

3.3 FirstPromoter Referral Cookie (Non-Essential, Consent-Gated)

IdGenum operates an affiliate (referral) program using FirstPromoter, a third-party referral-tracking provider. FirstPromoter sets a non-essential referral/tracking cookie whose sole purpose is affiliate referral attribution — recording which affiliate link referred you so that affiliate can be credited for a resulting subscription.

This cookie is set only after you grant consent through our cookie-consent banner (opt-in). If you do not consent, the FirstPromoter tracking script is not loaded and the cookie is not set. You may decline it, or withdraw your consent at any time, through your Privacy Choices; after withdrawal, IdGenum stops setting the cookie.

The FirstPromoter referral cookie and its tracking script do not collect, read, or transmit biometric information, biometric-derived values, or other identity information. Full detail is in our Cookies & Similar Technologies notice.

3.4 No Advertising Cookies at Launch

IdGenum does not currently use advertising cookies or similar technologies for cross-site behavioral advertising.

If this practice changes, IdGenum will update this Privacy Policy and, where required, provide appropriate notice and choice before such technologies are used.

4. Where Information Comes From

We may obtain personal information:

• directly from you;
• automatically from your browser, device, or use of the Service;
• from service providers acting on our behalf;
• from payment providers;
• from blockchain networks; and
• from other sources you authorize to provide information to IdGenum.

Planned Monitoring and Scanning Feature

IdGenum expects to introduce internet monitoring, likeness detection, scanning, or related identity-protection functionality after the initial private launch.

Until such a feature is activated for your account:

• IdGenum does not represent that active internet scanning is being performed for you;
• no scanning provider is processing your information on IdGenum's behalf solely because the feature is labeled Coming Soon; and
• the feature's additional data processing does not begin.

Before or when monitoring or scanning is activated, IdGenum will update applicable disclosures to explain the categories of information used, service providers involved, retention practices, user controls, and any additional consent required.

5. How We Use Information

We may use personal information to:

• create and administer IdGenum accounts;
• create and maintain persona records;
• verify identity when you choose to use biometric verification;
• protect personas against impersonation or unauthorized use;
• create and manage blockchain-based proof or credential records;
• process subscriptions and payments;
• provide requested platform functionality;
• maintain security and prevent fraud or misuse;
• communicate account, payment, privacy, or security information;
• respond to support and privacy requests;
• analyze aggregate website usage and improve the Service;
• comply with legal and regulatory obligations; and
• establish, exercise, or defend legal claims where appropriate.

We do not use biometric information for advertising.

6. Biometric Processing

6.1 Biometric Enrollment

Biometric enrollment is performed only after the user is presented with an applicable biometric notice and consent process.

Where required by law, IdGenum obtains affirmative or written consent before collecting or processing biometric identifiers or biometric information.

6.2 Processing and Security

IdGenum uses technical and organizational safeguards designed to limit access to biometric information and protect biometric-derived information from unauthorized access, disclosure, alteration, or use.

Certain biometric processing may occur through secure infrastructure or service providers that support identity verification, liveness detection, hosting, cryptographic processing, or related security functions.

IdGenum's architecture is designed to limit routine human access to raw biometric information during protected processing.

6.3 Derived Biometric Information

Where supported by the Service, IdGenum may generate a protected biometric-derived representation for identity verification.

Such derived information is protected using technical safeguards designed to limit unauthorized use and reduce exposure of the underlying biometric characteristics.

6.4 Biometric Retention and Destruction

IdGenum retains biometric information only for as long as reasonably necessary to provide the applicable feature, satisfy the purpose for which it was collected, comply with applicable law, and protect the security or integrity of the Service.

Where the Illinois Biometric Information Privacy Act applies, covered biometric identifiers and biometric information will be destroyed when the initial purpose for collecting or obtaining them has been satisfied or within three years of the individual's last interaction with IdGenum, whichever occurs first, unless a different retention period is permitted or required by applicable law.

Raw biometric capture information used only for processing is designed to be deleted promptly after the applicable processing workflow is completed.

Additional information may be provided in an applicable Biometric Privacy Notice presented during enrollment.

7. Retention

We retain personal information for periods appropriate to the purpose for which the information was collected, the nature of the information, applicable legal obligations, and legitimate security, accounting, dispute-resolution, and compliance needs.

Account deletion does not remove information that IdGenum is legally required or permitted to retain, and it cannot remove information already written to a public blockchain.

8. Service Providers and Disclosures

IdGenum does not sell personal information.

We may provide personal information to service providers that perform services on our behalf, including:

• cloud infrastructure and hosting;
• authentication and security;
• identity or liveness verification;
• payment processing;
• analytics;
• blockchain infrastructure;
• email and communications;
• customer support; and
• professional, legal, accounting, compliance, or security services.

These providers are permitted to process information only as necessary to perform services for IdGenum or as otherwise permitted by applicable law and contract.

Current Material Service Providers

IdGenum currently uses service providers that may include:

• Amazon Web Services (AWS) — cloud infrastructure, security, authentication, storage, and related platform services;
• Stripe — payment processing and subscription-related services;
• Alchemy — blockchain infrastructure used to interact with supported blockchain networks; and
• Plausible Analytics — aggregate, privacy-focused website analytics.

A scanning or monitoring provider is not listed because IdGenum has not yet activated that feature for launch users.

If IdGenum activates a monitoring or scanning provider, applicable disclosures will be updated before or when the feature becomes active.

Legal and Safety Disclosures

We may disclose information where we reasonably believe disclosure is:

• required by applicable law or valid legal process;
• necessary to protect the rights or safety of IdGenum, our users, or others;
• necessary to investigate fraud, security incidents, misuse, or violations of our terms; or
• otherwise permitted by applicable law.

Biometric information is subject to additional restrictions where required by applicable biometric privacy law.

9. Your Privacy Rights

Depending on where you live and which privacy laws apply, you may have rights regarding your personal information, including the right to:

• request access to personal information;
• request correction of inaccurate information;
• request deletion of personal information;
• obtain certain personal information in a portable format;
• withdraw biometric consent where applicable;
• opt out of certain uses of personal information where required by law;
• object to or restrict certain processing where applicable;
• use an authorized agent where permitted by law; and
• appeal certain decisions relating to a privacy request where applicable.

To exercise a privacy right, contact:

or use the applicable privacy controls available through your IdGenum account. You may also review and submit requests via our Privacy Choices page.

We may need to verify your identity before completing certain requests.

We will respond within the time required by applicable law and will notify you if an extension is permitted and necessary.

10. Biometric Privacy Rights

Users who enroll in biometric features may withdraw biometric consent in accordance with applicable law and the available product controls.

Withdrawal of biometric consent may:

• disable biometric verification;
• cause biometric-derived information associated with the verification feature to be deleted in accordance with applicable retention requirements; and
• change the verification status or availability of features that require biometric verification.

Withdrawal of biometric consent does not necessarily require deletion of a basic IdGenum account or persona unless the user separately requests account deletion.

Additional jurisdiction-specific terms may apply and may be provided through the Biometric Privacy Notice.

11. Illinois Biometric Information Privacy Act

Where the Illinois Biometric Information Privacy Act ("BIPA") applies, IdGenum:

• provides notice regarding biometric collection and processing;
• identifies the purpose and expected duration of biometric processing;
• obtains the consent or written release required by applicable law;
• maintains a publicly available biometric retention and destruction policy;
• does not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information;
• limits disclosure of biometric information as required by law; and
• uses reasonable safeguards to protect covered biometric information.

Covered biometric identifiers and biometric information will be destroyed when the initial purpose for collection or obtaining the information has been satisfied or within three years of the individual's last interaction with IdGenum, whichever occurs first, unless otherwise permitted or required by law.

For biometric privacy questions:

12. California Privacy Information

Where the California Consumer Privacy Act, as amended, applies to IdGenum, California residents may have additional rights relating to access, correction, deletion, portability, sale or sharing, targeted advertising or similar processing, and the use or disclosure of sensitive personal information.

IdGenum does not sell personal information and does not sell biometric information.

IdGenum does not currently share personal information for cross-context behavioral advertising.

California residents may submit applicable privacy requests through our Privacy Choices page or by contacting privacy@idgenum.com.

13. New Jersey and Other U.S. State Privacy Rights

Residents of New Jersey and other states with applicable comprehensive privacy laws may have additional privacy rights depending on whether the applicable law applies to IdGenum and the particular processing activity.

These rights may include:

• access;
• correction;
• deletion;
• portability;
• opt-out rights;
• consent withdrawal for certain sensitive data processing; and
• appeal of certain privacy-request decisions.

IdGenum will honor applicable state privacy rights where required by law.

14. Children

IdGenum's Services are intended for adults.

Unless a specific product or feature expressly states otherwise, IdGenum does not knowingly permit individuals under 18 to enroll biometric information.

If we learn that personal information has been collected from a minor in circumstances requiring parental or guardian authorization, we will take appropriate steps consistent with applicable law.

15. Data Security

IdGenum uses administrative, technical, and organizational safeguards designed to protect personal information.

Depending on the Service and data involved, these safeguards may include:

• encryption in transit;
• encryption at rest for applicable stored customer data;
• access controls based on least-privilege principles;
• logging and security monitoring;
• protected cryptographic key management;
• network and application security controls; and
• isolated or protected processing environments for sensitive information.

No method of electronic transmission, processing, or storage can be guaranteed to be completely secure.

If a security incident affecting personal information occurs, IdGenum will investigate and provide notifications where required by applicable law.

16. International Users

IdGenum is initially focused on a U.S. private launch.

If IdGenum offers services in jurisdictions outside the United States that impose additional privacy requirements, this Privacy Policy or supplemental privacy notices may be updated before or when those services become available.

17. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes to our services, technology, legal obligations, or privacy practices.

If we make material changes, we will provide notice as required by applicable law.

The "Last updated" date at the top of this page identifies the most recent revision.