Privacy and data handling
What happens to your information?
See what Carded checks, what it keeps and what the business receives. The result tells the business whether the age check passed, without sharing your ID photos or document details.
What we check
Carded checks a photo of an identity document, such as a passport, driving licence or national ID card. If the business asks for a face match, you also take a selfie. The check looks at the date of birth, document expiry, signs of tampering and, when requested, whether the faces match.
Some businesses offer a face scan instead. You take one live photo of your face and Carded estimates your age from it, with a safety margin set by the business. No ID is needed.
The photos are sent to an AI service for automated analysis. Carded uses the business's chosen age limit and verification rules to decide the result.
What Carded keeps
Each check has a record, called a session. This lets the business confirm the result. The record includes:
- The status and result, with a reason if the check did not pass
- The minimum age, number of attempts and the time of the check
- A reference supplied by the business, such as its customer account number
- The website and connection details used to start the check and return the customer
- For face scans only, your face photo, kept for 24 hours and then deleted
Technical records used to protect the check
Carded also stores one-way coded versions, called hashes, of the session credentials and the connection's IP address. The IP address hash helps limit repeated requests. These hashes are not shown in the business dashboard.
What the business can see
The business can see the status and result, a reason if the check did not pass, its own customer reference, the time of the check, the minimum age and the number of attempts. If you use a face scan, it also receives your face photo. It does not receive:
- Your ID photograph or the selfie taken with your ID
- Your name, date of birth or address from the document
- Your document number or other document details
Your photos and questions about a check
Carded processes your ID photo and selfie in server memory during the check. The verification application does not save these photos or the details read from your document to its database or file storage. It keeps the check record separately.
Face scan photos are handled differently. Your face photo is shared with the business along with the result, and Carded deletes its copy after 24 hours. The face scan screen tells you this before you take the photo.
To ask about a check or make a request about your data, contact the business that asked you to verify your age. Include your customer reference if you have one so it can find the right record.