Elevate ID Verify Privacy Policy

Version: 2026-10-22
Effective date: October 22, 2026
Provider: Elevate Brands Group [legal entity name to be confirmed before publication]
Privacy contact: [to be confirmed before publication]

Draft for legal review before publication.

This policy explains what information Elevate ID Verify (the "Service") collects, how it is used, and the choices available. It applies to the mobile apps, the Shopify POS integration, the web dashboard, and related websites. Businesses that use the Service ("Merchants") agree to the Merchant Terms of Service; this policy is part of those Terms.

1. The short version

• When an ID is scanned, the barcode is read in the device's memory to calculate a result. By default the Service does not store or send us the ID number, name, address, full date of birth, barcode contents, or any image of the ID.
• We keep a short record of each check (for example, the outcome, the age requirement, a coarse age band, and whether the employee inspected the ID) so the Merchant can show it followed its procedure.
• Customer profiles exist only where a Merchant chooses to create them through a separate, voluntary interaction, where its plan and location allow it. They are never created from a scan.
• We do not sell personal information, use it for advertising, or track people across other companies' apps or websites.

2. Our role and the Merchant's role

For account information about Merchants and their staff, we decide how the information is used. For information about a Merchant's customers (verification records and customer profiles), the Merchant decides how it is used and we process it on the Merchant's behalf as its service provider or processor. If you are a retail customer, please contact the business that checked your ID about your information; we will help that business respond.

3. Information we collect

Account and business information. Business name, state of operation, time zone, the names and email addresses of people the Merchant invites, their roles and assigned locations, and sign-in records. Passwords and employee PINs are stored only as one-way cryptographic hashes; we never store them in readable form.

Store devices. Device name, platform, model, operating system version, app version, scanner type, the location the device is assigned to, and when it was last active.

Verification records. For each check: a random record ID, time, local date and time zone, location, device, the employee who performed it (if any), the product category and age requirement, the outcome, whether the age requirement was met, a coarse age band (under 18, 18 to 20, 21 to 29, or 30 and over), expiration status, document type, issuing country and state or province, whether the card is marked REAL ID compliant, technical warning codes, the employee's disposition and inspection confirmations, any manual-review reason and short note, and a point-of-sale reference where available. These records do not contain the ID number, name, address, full date of birth, barcode contents, or images. In certain jurisdictions and product categories (for example, alcohol sales in Texas), the Service keeps even less, omitting the age band and document details.

Customer profiles (optional, Pro and Business plans). Where enabled, the Merchant may enter a display name, a phone number, email address or postal address the customer provides, a merchant reference, internal notes, and the date and method of the customer's consent, and may link past verification records (showing only each check's outcome, time, store and employee). With the customer's separate consent, the Merchant may add a photo of the customer taken in the app; it is never a photo of an ID, and it is not used for face recognition or any biometric matching. These fields and photos are encrypted at rest and deleted when the Merchant deletes the profile. They are never filled from barcode data.

Billing. Plan, subscription status, and billing history. Payment card details are handled by our payment processor or by Shopify; we do not receive full card numbers.

Support. What you tell us when you contact support.

Technical information. We process IP addresses and request details briefly to operate the Service, prevent abuse, and limit sign-in attempts. Our application logs are designed to exclude identification data and secrets. We do not use third-party advertising or analytics software development kits in the apps.

4. Information that stays on the device

The apps keep the sign-in session in the device's secure Keychain. Checks made while offline are stored on the device, protected by the operating system's file encryption and excluded from device backups, until they are sent to us. In "use on this device" mode, check records stay on the device and are not sent to us at all. Removing the app, or choosing "Stop using on this device," deletes them.

5. How we use information

To provide and secure the Service; to show Merchants their records and reports; to send account messages such as verification codes and invitations; to process subscriptions; to provide support; to detect and prevent fraud and abuse; to comply with law; and to improve the Service using aggregated statistics that do not identify any Merchant, person, or document.

We do not use information obtained from identification documents for marketing, advertising, loyalty enrollment, profiling, or resale, and we do not use Merchant data to train general-purpose artificial intelligence models.

6. How we share information

We share information only:

• with service providers that help us run the Service under contracts that limit their use of it: Cloudflare (hosting, database, and content delivery), Shopify (for Merchants who use the Shopify integration and for Shopify billing), our payment processor (for web subscriptions, once enabled), Apple (to distribute the iOS app), and an email delivery provider (to send account emails, once selected);
• with the Merchant whose account the information belongs to, and with the people the Merchant authorizes;
• when required by law, legal process, or a lawful request from authorities, or to protect the rights, safety, and security of the Service, our users, or the public; and
• as part of a merger, acquisition, or sale of assets, subject to this policy.

7. How long we keep information

• Verification records: for the Merchant's configured retention period, 24 months by default (adjustable within the limits the Service allows and the law requires), then deleted.
• Customer profiles: until the Merchant deletes them or closes its account.
• Account information: while the account is active, then deleted within 30 days of account closure, except where the law requires us to keep it.
• Security and audit logs: as long as reasonably needed for security, dispute resolution, and legal obligations.
• Backups: database backups expire on a rolling schedule of about 30 days.

8. Security

We use encryption in transit, encryption at rest for customer-profile fields, hashed passwords and PINs, per-organization access controls, least-privilege access for our personnel, and audit logging of administrative changes. No system is completely secure; we will notify affected Merchants of a security incident as required by law.

9. Your choices and rights

Account holders can view and update their information in the dashboard and apps. An owner can close the organization's account, which deletes its data as described above. Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, and to appeal a decision about your request. To exercise these rights, contact [to be confirmed before publication]. If your information is held for a Merchant, we will direct your request to that Merchant or assist it in responding. We will not discriminate against anyone for exercising privacy rights.

10. Children

The Service is for businesses and is not directed to children under 13. We do not knowingly collect personal information from children under 13 through the Service, other than verification records that, by design, contain no name, ID number, address, or date of birth.

11. Where information is processed

The Service is operated from the United States. Our providers' networks may process requests in other countries to deliver the Service.

12. Changes to this policy

We will post updates here and update the version and effective date. If a change is material, we will notify Merchants in the Service or by email before it takes effect.

13. Contact

Elevate Brands Group [legal entity name to be confirmed before publication]
[to be confirmed before publication]
Privacy: [to be confirmed before publication]
Website: [to be confirmed before publication]