Privacy Policy

1. Overview & Scope

This Privacy Policy explains how Identixia ("Identixia," "we," "us," or "our"), a Kentucky-incorporated, United States–based company, handles information in two different contexts: (a) information collected through this website, identixia.com (the "Site"), from visitors and prospective customers; and (b) biometric and document data processed by our SDKs when integrated into a customer's application. These two contexts are handled very differently, as explained in Section 3 below.

2. The Short Version: Who Controls Biometric Data?

Identixia's SDKs are built to run inside your own infrastructure — your servers, your private cloud, or your end users' own devices. In that on-premise, on-device, or self-hosted configuration, biometric and document data captured through your application (face images, liveness signals, ID document images, and data extracted from them) is processed on your infrastructure, not sent to Identixia's servers as part of normal SDK operation, and Identixia does not act as the "processor," "service provider," or "third party" for that data under laws like the CCPA/CPRA or GDPR. You, as the business operating the application, are the data controller for your own end users' biometric information, and you're responsible for the notices, consents, and retention limits those laws (and biometric-specific statutes like Illinois' BIPA) require. If your deployment uses any Identixia-hosted component, that data flow and our role as a processor will be described in your Data Processing Agreement, which takes precedence over this section for that specific processing.

3. Information We Collect

a. Through the website

• Contact and demo-request information you submit through our forms: name, work email, company, product interest, and any deployment details you choose to share.
• Account and billing information for customers: billing contact, company details, and payment information (processed by our payment processor — we don't store full card numbers ourselves).
• Usage data collected automatically, such as pages visited, referring URL, browser and device type, and approximate location derived from IP address, typically via cookies or similar technologies (see Section 5).

b. Through the SDKs (on-premise deployment)

As described in Section 2, we do not receive your end users' biometric or document data from an on-premise or on-device SDK integration as part of normal operation. We may receive limited SDK diagnostic and license-usage data (for example, verification counts for billing purposes on transaction-based plans, SDK version, and error codes) — not the underlying biometric images or documents themselves — to operate licensing, metering, and support.

4. Biometric Information Notice

We know biometric data carries special legal obligations in many jurisdictions, including the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), Washington's biometric privacy law (HB 1493), and the CCPA/CPRA's treatment of biometric information as "sensitive personal information." Because Identixia's default architecture keeps this data on your infrastructure rather than ours, most of these obligations — providing notice, obtaining consent, publishing a retention schedule, and securely destroying biometric identifiers when no longer needed — fall to you as the entity actually collecting your end users' biometric data. We encourage every customer to review these obligations with their own counsel before going live.

5. Cookies & Website Analytics

The Site uses a limited set of cookies and similar technologies to remember basic preferences and to understand aggregate traffic patterns (for example, which pages are most useful to visitors), which helps us improve the Site. We don't use this data to build advertising profiles of individual visitors or sell it to data brokers. You can control cookies through your browser settings; blocking them may affect some Site functionality but won't affect SDK operation.

Our contact form is protected by Cloudflare Turnstile, a bot-detection service that checks, when you submit the form, whether the request comes from a real person. Turnstile may process technical signals such as your IP address and browser information, and sets a limited set of cookies or similar identifiers for that purpose; Cloudflare handles that data under its own privacy policy.

6. How We Use Information

• To respond to demo requests, sales inquiries, and support questions.
• To create and administer customer accounts, licenses, and billing.
• To meter usage under transaction-based license plans.
• To send product, security, and billing communications relevant to your account, and — where you've agreed — occasional product updates you can opt out of at any time.
• To maintain the security and integrity of the Site and our licensing systems.
• To comply with legal obligations and enforce our Terms of Service.

7. How We Share Information

We don't sell personal information. We share it only with: service providers who help us run the Site and business operations under confidentiality obligations (for example, payment processing, email delivery, and hosting/analytics providers); professional advisors (legal, accounting) as needed; successors in the event of a merger, acquisition, or asset sale, subject to this Policy or a materially similar one; and where required to comply with law, protect our rights, or respond to a valid legal process.

8. Data Retention

We retain website and account information for as long as reasonably necessary to provide the Site and services, comply with legal and tax obligations, resolve disputes, and enforce our agreements, after which it's deleted or anonymized. Because biometric data in on-premise deployments is held on your infrastructure, its retention schedule is set by you, not by Identixia.

9. Your Privacy Rights

Depending on where you're located, you may have rights to access, correct, delete, or receive a copy of the personal information we hold about you as a website visitor or customer contact, and to opt out of certain processing. California residents have specific rights under the CCPA/CPRA, including the right to know, delete, correct, and opt out of the sale or sharing of personal information (we don't sell or share personal information for cross-context behavioral advertising). EU/UK residents have rights under the GDPR/UK GDPR, including access, rectification, erasure, restriction, portability, and objection. To exercise any of these rights regarding information Identixia holds directly (not information held by one of our customers about their own end users — see Section 2), contact us using the details in Section 12.

10. Data Security

We use administrative, technical, and physical safeguards designed to protect information we hold, and our product architecture is built around minimizing the sensitive data that reaches us in the first place, as described in Section 2. No method of transmission or storage is completely secure, and we can't guarantee absolute security.

11. International Data Transfers

Identixia is based in the United States. If you're located outside the United States and interact with the Site or our team, information you provide may be transferred to and processed in the United States, which may have different data protection laws than your home jurisdiction. Where applicable, we rely on appropriate safeguards for such transfers.

12. Children's Privacy

The Site and our sales/support channels are directed at businesses, not children. We don't knowingly collect personal information from children through the Site. If you believe a child has provided us information, contact us and we'll delete it.

13. Changes to this Policy

We may update this Policy from time to time. Material changes will be reflected by an updated "Last updated" date above, and, where appropriate, communicated to active customers directly.

14. Contact Us

Questions about this Policy, or requests regarding your personal information, can be sent to contact@identixia.com, via WhatsApp at +1 (701) 885-4218, or through the Contact page. Our mailing address is Identixia, 421 West Main Street, Frankfort, KY 40601, United States. If your question is about biometric data collected by an application built on our SDKs, please contact that application's operator directly — see Section 2.