Privacy Policy

1. Introduction

ONUS ID is an age and identity verification service operated by ONUS ("ONUS," "we," "us" or "our"). Businesses that sell age-restricted products, such as liquor stores and other retailers, use ONUS ID to help confirm that a customer meets the legal age requirement for a purchase and that the identification presented is valid.

This Privacy Policy explains what personal information we collect through ONUS ID, how we use and protect it, when we share it, how long we keep it, and the choices and rights you have. It applies to:

• Individuals being verified — people whose identification is checked using ONUS ID at a participating business. When this Policy says "you," it generally means you in this role.
• Business users — the businesses that use ONUS ID ("Business Customers") and the employees they authorize to use it.
• Website visitors — anyone who visits the ONUS ID website or contacts us.

ONUS provides ONUS ID to Business Customers under written agreements. Each Business Customer decides whether to use age verification in its locations and is responsible for its own privacy practices, including any notice it gives you at the point of verification. Depending on the arrangement and applicable law, a Business Customer may also be responsible for responding to certain privacy requests (see Section 9). Please read this Policy together with any notice provided by the business where you were verified.

2. Information We Collect

We aim to collect only the information reasonably necessary to perform a verification, operate and secure the service, and meet our legal obligations. What we collect depends on how you interact with ONUS ID.

Information from your government-issued ID. When you enroll in ONUS ID, your driver's license, state ID card, passport or other government-issued identification is presented, and ONUS ID may capture images of the document and read the information printed on it or encoded in it. This may include your name, date of birth, ID number, document type, issuing state or country, issue and expiration dates, address, sex, physical descriptors such as height and eye color, the ID photo, and information about the document's security features that helps determine whether it is genuine. Your ID is captured at enrollment; it is not re-scanned on later visits.

Date of birth and age information. Your date of birth, read from your ID at enrollment, is stored in your ONUS ID profile and used to determine whether you meet the age requirement for a purchase on your enrolled visits. For walk-in customers who have not enrolled, ONUS ID may instead estimate age from a facial image (see Section 4).

Facial images and biometric-related information. Where facial verification is used: at enrollment, ONUS ID captures a live image of your face and creates a facial template (a mathematical representation of your facial features) that is stored in your ONUS ID profile and used to recognize you on future visits. On return visits, a live facial image is captured and compared against stored templates. For walk-in customers, a live facial image may be captured and used to estimate age and is not used to create a stored enrollment. Section 5 explains this in detail.

Verification results. The outcome of a verification (for example, whether the age requirement was met and whether the ID appeared valid), the date and time, the business location and, where applicable, the reason a verification was unsuccessful.

Device, technical and usage information. Information about the device used for the verification — whether the business's device or your own — such as device type and identifiers, operating system, browser type, IP address, approximate location inferred from the IP address, and session logs. Similar technical information is collected when you visit our website (Section 12).

Information from Business Customers and their staff. Business contact details, account and billing information, the names, work contact information, roles and login credentials of authorized users, service settings, and records of how the service is used.

Information you provide to us directly. For example, when you contact us with a question, request a demo or submit a privacy request.

What we do not ask for. ONUS ID does not request your Social Security number, financial account or payment card numbers, or health information, and we do not collect fingerprints, voiceprints, or iris or retina scans.

3. How We Use Your Information

We use personal information for the following purposes:

• Age and identity verification. To determine whether you meet an applicable age requirement, whether your ID appears authentic and unexpired and, where facial verification is used, whether the ID belongs to the person presenting it.
• Fraud and misuse prevention. To detect and prevent the use of fake, altered, borrowed or stolen IDs and other attempts to misuse the service.
• Security. To protect ONUS ID, our systems, our Business Customers' accounts and the people we verify against unauthorized access and other threats.
• Operating and supporting the service. To provide the service to Business Customers, deliver verification results, manage accounts, provide customer support and bill for the service.
• Troubleshooting, reliability and improvement. To monitor performance, diagnose and fix problems, and improve the accuracy and reliability of ONUS ID, using aggregated or de-identified information where practical and otherwise only as permitted by law.
• Record-keeping. To keep records of verifications where reasonably necessary for the Business Customer's or our own legal, regulatory and compliance obligations, to resolve disputes and to enforce our agreements.
• Legal compliance. To comply with applicable laws and lawful requests, and to protect the rights, safety and property of ONUS, our Business Customers, you and others.

We do not use identity, verification or biometric information for advertising or marketing, to build marketing profiles, or to make decisions about you that are unrelated to the verification. Being verified with ONUS ID will never result in marketing from ONUS.

4. How ONUS ID Age Verification Works

ONUS ID can be used in two ways at a participating business: as an enrolled customer who has created an ONUS ID profile, or as a walk-in customer who has not.

Enrolling in ONUS ID (one time). If you choose to enroll, your government-issued ID is scanned or photographed and a live image of your face is captured. ONUS ID reads the information on your ID, checks that the document is genuine and unexpired, confirms that the face presented matches the photo on the ID, and creates an ONUS ID profile for you. Your profile includes your date of birth (used to determine age) and a facial template derived from your facial image. This profile is stored so that you can be recognized on future visits without presenting your ID again. You enroll only once — your ID is not scanned each time you return.

Verifying as an enrolled customer (return visits). On a later visit to a participating business, you simply present your face to the camera. ONUS ID compares your face to the facial templates of enrolled customers, and a "liveness" check helps confirm the image comes from a real, present person rather than a photo, screen or mask. When you are recognized, ONUS ID uses the date of birth in your stored profile to determine whether you meet the age requirement for the specific product being purchased, and returns a result to the business — for example, "verified 21+." You are not asked to present your ID again unless recognition is unsuccessful.

Verifying as a walk-in customer (no enrollment). If you have not enrolled, a live image of your face may be captured and used to estimate your age, and that estimated age is provided to the business to assist its own age check. An estimated age is an approximation, not a determination based on your ID; the business decides whether to complete the sale and may ask to see your government-issued ID.

The business makes the final decision. In every case, ONUS ID supports — but does not replace — the business's own age-verification process. Verification results and age estimates are generated automatically by software; the business and its staff make the final decision, and a sale will only proceed if you are eligible, by age, for the product being purchased. If a result or estimate seems wrong, you can ask the business to review your ID. You may also decline to use ONUS ID; the business will decide whether it can verify your age another way.

5. Facial, Biometric and Sensitive Information

Some of the information ONUS ID handles is especially sensitive, including government ID numbers, ID images and — where facial verification is used — facial images and information derived from them. This section applies only when facial verification is part of your verification.

Photographs versus biometric identifiers. An image of your face or of your ID photo is a photograph. Comparing the two may generate a mathematical representation of facial features (sometimes called a facial template or "faceprint"), which some state laws treat as a "biometric identifier." This Policy applies the commitments below to facial templates and to the facial images used to create them.

Why we process it. Facial verification is used to (a) create your ONUS ID profile and recognize you on return visits, so your age can be confirmed without re-scanning your ID; (b) confirm at enrollment that the ID presented belongs to the person enrolling; (c) for walk-in customers, estimate age to assist the business's check; and (d) detect fraud, such as a borrowed or stolen ID, a photograph held up to the camera, or a digitally altered image. We do not use facial or biometric information to identify you in any other context, for surveillance, for advertising or marketing, or to build a profile of you.

Notice and consent. Before facial verification is performed, you will be informed that it is being used and for what purpose, and your consent will be obtained where required by law. If you do not wish to complete facial verification, you may decline, and the business may verify your age by other means, such as a manual review of your ID.

No sale. We do not sell, lease, trade or otherwise profit from facial or biometric information.

Limited disclosure. We disclose facial and biometric information only (a) to the service and technology providers that help us perform the verification, under contracts that restrict them to that purpose; (b) to the business where you were verified, to the extent necessary to deliver the verification result; (c) with your consent; (d) to complete a transaction you requested or authorized; or (e) as required by law, subpoena or warrant.

Retention and destruction. If you enroll, the facial template in your ONUS ID profile is retained so that you can be recognized on return visits, and is permanently destroyed when your enrollment ends or no later than three years after your last interaction with ONUS ID, whichever occurs first (or any shorter period required by applicable biometric-privacy law). Facial images used only to estimate a walk-in customer's age are not stored as an enrollment and are deleted after the check, except briefly as needed for security and fraud prevention. Section 8 describes our broader retention approach.

Security. We protect facial and biometric information using a standard of care at least as protective as the measures we use for other confidential and sensitive information, as described in Section 6.

6. How We Protect Information

We maintain technical and organizational safeguards designed to protect personal information against unauthorized access, use, alteration and disclosure, taking into account the sensitivity of the information. These safeguards include:

• Encryption of sensitive information, including ID and facial information, in transit and, where applicable, at rest.
• Access controls and authentication that limit access to the personnel and systems that need the information to perform the service, using role-based permissions.
• Monitoring and logging to detect and respond to unauthorized access or unusual activity.
• Security procedures, including assessments of our service and our providers, and incident-response procedures that include notifying affected individuals, Business Customers and authorities where required by law.
• Organizational safeguards, including confidentiality obligations and privacy and security training for our personnel, and written contracts requiring service providers to protect information appropriately.

No method of transmitting or storing information is completely secure, and we cannot guarantee absolute security. If you believe your information has been compromised, please contact us (Section 15).

7. How We Share Information

We do not sell personal information — including identity, verification and biometric information — and we do not share it for targeted or cross-context behavioral advertising. We share personal information only in the following circumstances.

Businesses using ONUS ID. We provide the verification result and related verification details to the Business Customer where you were verified so that it can decide whether to complete the sale and maintain its own compliance records. Our agreements require Business Customers to use this information only for age and identity verification, fraud prevention and their legal compliance, and not for marketing or other unrelated purposes.

Service and technology providers. We rely on trusted third-party service providers to operate portions of ONUS ID on our behalf. These include identity verification technology providers that analyze ID documents and, where used, perform facial comparison and liveness checks; cloud hosting and infrastructure providers; security and fraud-prevention providers; and providers of customer support, communications and billing tools. These providers act on our instructions under written agreements that require them to protect the information, use it only to provide services to us, not use it for their own purposes, and delete or return it when it is no longer needed. For security and business reasons we do not publicly name individual providers, but we disclose the categories of providers we use as required by law.

Legal, safety and security purposes. We may disclose information when we believe in good faith that doing so is required by law, regulation, court order, subpoena, warrant or other lawful request, or is reasonably necessary to protect the rights, property or safety of ONUS, our Business Customers, you or others; to investigate, prevent or address fraud, security incidents or illegal activity; or to enforce our agreements.

Corporate transactions. If ONUS is involved in a merger, acquisition, financing, reorganization or sale of some or all of its business or assets, personal information may be transferred as part of that transaction, subject to protections at least equivalent to this Policy and to any notice required by law.

With your direction or consent. We may share information in other ways if you ask us to or consent.

Aggregated and de-identified information. We may create and use aggregated or de-identified information that cannot reasonably be linked to you — for example, the number of verifications performed at a location — and we do not attempt to re-identify it.

8. Data Retention and Deletion

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy — performing and recording verifications, providing the service, preventing fraud, security, resolving disputes, enforcing our agreements and meeting legal obligations — and then delete or de-identify it.

How long a particular type of information is kept depends on what it is and why it was collected:

• The most sensitive information is handled as follows: if you enroll, the facial template and date of birth in your ONUS ID profile are retained for as long as you remain an enrolled customer so you can be recognized on return visits, and are destroyed when your enrollment ends or no later than three years after your last interaction, whichever is first. ID images captured at enrollment are kept only for the shortest period needed to establish your profile and meet applicable law. Facial images used to estimate a walk-in customer's age are deleted after the check.
• Verification results and related records may be kept longer where reasonably necessary for Business Customers' or our own compliance and record-keeping obligations, subject to limits in applicable law, including state laws that restrict what may be retained after an ID is scanned for age verification.
• Business Customer account and billing records are kept for the duration of the relationship and as long afterward as needed for legal, tax and accounting purposes.
• Device, technical and log information is kept for a period reasonably necessary for security, troubleshooting and fraud prevention.

Deleted information is removed from our active systems, and our service providers are required to delete it from theirs. It may remain in secure backups for a limited period before being overwritten and is not used during that time. We may keep limited information where the law requires it or to resolve a dispute or enforce our agreements — for example, a record that a verification occurred and its outcome, without the underlying images.

9. Your Privacy Rights

Depending on where you live, you may have the right to:

• Access — confirm whether we process your personal information and obtain a copy of it, along with information about how it is used and shared.
• Correct — request correction of inaccurate personal information.
• Delete — request deletion of your personal information, subject to exceptions (for example, where we must retain a record of a verification).
• Portability — receive the information you provided to us in a portable format.
• Opt out — of the sale or sharing of personal information, targeted advertising and certain profiling. We do not engage in these activities; if that ever changes, we will update this Policy and provide the required choices.
• Limit the use of sensitive information — we use sensitive information only to perform the service you requested, to prevent fraud and secure the service, and as otherwise permitted by law.
• Withdraw consent — where processing is based on your consent, such as facial verification, you may withdraw it at any time. This does not affect processing that already occurred and may mean a verification cannot be completed.
• Appeal — if we deny a request, ask us to reconsider. We will tell you the result and, where applicable, how to contact your state's attorney general or privacy regulator.

We will not discriminate against you for exercising your rights. A business may still decline a sale if your age cannot be verified.

How to submit a request. Contact us at hello@onusid.com or by mail at the address in Section 15. We will verify your identity before acting on a request, asking only for information reasonably necessary to do so. Where the law allows, you may use an authorized agent; we may require proof of the agent's authority and may still verify your identity directly. We will respond within the time required by law, generally 45 days, and will tell you if we need more time.

Requests involving a Business Customer. Where a Business Customer is legally responsible for your information — for example, because we processed it on the business's behalf — we may forward your request to that business or work with it to fulfill your request, and we will tell you which. Business Customer employees may also contact their employer, which manages their account.

10. U.S. State Privacy Rights

This section provides additional disclosures for residents of states with specific privacy or biometric laws. Not every right or requirement applies to every person or activity. Where this section conflicts with the rest of this Policy, it controls for residents of the relevant state.

Illinois. Where facial verification is used, this Policy — in particular Sections 5 and 8 — serves as our publicly available written policy on the retention and destruction of biometric identifiers and biometric information. We collect biometric information only after informing you in writing that it is being collected, the purpose, and the length of time it will be retained, and after obtaining your written consent. We permanently destroy biometric information when the initial purpose for collecting it has been satisfied or within three years of your last interaction with us, whichever occurs first, unless a court order or applicable law requires otherwise. We do not sell, lease, trade or otherwise profit from biometric information; we disclose it only as described in Section 5; and we protect it using the reasonable standard of care in our industry and in a manner at least as protective as the way we treat other confidential and sensitive information.

Texas and Washington. These states regulate the capture of biometric identifiers for commercial purposes. Where facial verification is used, we provide notice and obtain consent before capture; we do not sell, lease or disclose biometric identifiers except as described in Section 5; we protect them with reasonable care; and we retain them no longer than reasonably necessary to complete the verification, prevent fraud and comply with law, and in any event within the time limits those states impose.

Colorado. Colorado treats biometric identifiers as sensitive data that may be processed only with your consent, and requires businesses that collect them to maintain a written retention and deletion policy (Sections 5 and 8) and incident-response procedures (Section 6). Colorado law also limits a business's ability to deny goods or services solely because a consumer declines to provide biometric identifiers that are not necessary to provide them; consistent with Section 5, facial verification can be declined and the business may verify your age another way.

California. In the 12 months before the Effective Date, we have collected the following categories of personal information, as described in Section 2: identifiers; personal information described in California's customer records law (such as name, address and driver's license or passport number); characteristics of protected classifications (age and sex as shown on an ID); biometric information (where facial verification is used); internet or other network activity information; approximate geolocation inferred from IP address and the location of the business; audio, electronic, visual or similar information (images of your ID and, where used, your face); professional or employment-related information (Business Customer staff only); and sensitive personal information (government ID numbers and biometric information processed to verify identity). We do not use personal information to draw inferences about your preferences or characteristics for profiling. The sources of this information are described in Section 2, our purposes in Section 3, our retention criteria in Section 8, and the categories of recipients — Business Customers, service providers and contractors, and legal and governmental authorities — in Section 7. This Policy also serves as our notice at collection; a business using ONUS ID may provide its own notice at the point of verification. We do not sell personal information or share it for cross-context behavioral advertising and have not done so in the preceding 12 months, and we do not sell or share the personal information of consumers under 16. We use sensitive personal information only for purposes permitted by California law, such as performing the service you requested, preventing fraud and security incidents, and maintaining the quality and safety of the service. California residents may exercise the rights in Section 9, including through an authorized agent, without discrimination. We do not disclose personal information to third parties for their own direct marketing purposes.

Other states. Residents of states with comprehensive privacy laws — including Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Utah and Virginia — may have rights to access, correct, delete and obtain a copy of their personal data; to opt out of targeted advertising, sales and certain profiling (which we do not engage in); and to appeal a denied request. Many of these laws treat biometric data and government ID numbers as sensitive data that may be processed only with consent or after notice and an opportunity to opt out. Where these laws apply to us, we honor them. To exercise your rights, use the contact information in Section 15.

11. Children's Privacy

ONUS ID is designed to verify adults who are purchasing age-restricted products. It is not directed to children, and we do not knowingly collect personal information from children under 13, except as may occur incidentally when a minor attempts verification.

A person under the legal purchasing age may nevertheless present an ID and attempt to be verified. In that case, the result will indicate that the age requirement was not met, and any information collected during the attempt is handled under the same protections and retention principles described in this Policy. We do not sell or share the personal information of minors, and we do not use it for advertising or profiling. If you are a parent or guardian and believe we hold information about your child that should be deleted, please contact us using the details in Section 15.

12. Cookies and Similar Technologies

Our website uses cookies and similar technologies that are necessary for the site to function and to remember your preferences, and may use them to understand how the site is used so that we can maintain and improve it. You can control cookies through your browser settings; disabling some cookies may affect how the site works. The ONUS ID verification process itself uses only the technologies necessary to run the verification and keep it secure, such as session identifiers, and does not use cookies or tracking technologies for advertising purposes.

13. International Data Processing

ONUS ID is intended for use in the United States. Personal information may be stored and processed in the United States and, where our service providers operate elsewhere, in other countries. Wherever it is processed, we apply the safeguards described in this Policy and require our providers to do the same.

14. Changes to This Privacy Policy

We may update this Policy to reflect changes in our practices, the service or the law. When we do, we will post the updated Policy on our website and revise the "Last Updated" date. If we make material changes to how we handle facial or biometric information, or to our commitments regarding the sale or advertising use of personal information, we will provide more prominent notice — including through the businesses where ONUS ID is used — and will obtain new consent where the law requires it.

15. Contact Us

If you have questions about this Policy, want to exercise your privacy rights, or have a concern about how your information has been handled, please contact us. If you were verified at a participating business, you may also contact that business about its own privacy practices.