Applicant Privacy & Biometric Notice

Who is asking, and who we are

You have been asked to complete this verification by the business you are dealing with. They decide why your information is needed and what they do with the result — in legal terms they are the "controller". DoorID Ltd runs this verification service on their behalf and follows their instructions. Questions about why you have been asked should go to them; questions about how this service works can go to us at paul@doorid.ai.

What we capture during the verification

With your agreement, during this session we capture: photographs of your driving licence or identity document; images of your face, which we compare with your document and, within the 7 days below, with faces from other checks to detect the same person using different details — never against any outside database (this is biometric data); photographs and short video of the property entrance and surroundings you are asked to capture; your location (GPS) and your device's movement and orientation while you capture; and technical details of your device and connection. Everything is captured live in this session. Nothing is taken from your device's stored photos or files.

What it is for, and what it does and does not show

The purpose is to give the business evidence that the person completing this session was physically present at the address at the time, with the identity document shown. The result is evidence to support the business's decision. It does not prove that anyone owns, rents or lives at a property, and the business should not treat it as doing so.

Your agreement, and your choice

The facial comparison uses biometric data, which we process only with your explicit consent, asked for on the next screen. You can stop at any point before finishing; if you stop, the verification simply is not completed and the business is told it was not completed — nothing more. If you would rather not use this method at all, tell the business: they can offer you another way to progress that does not use biometrics, and choosing that must not by itself count against you.

Automated analysis, and who reviews

The analysis is automated: comparing your face to your document, checking location signals and assessing the imagery. DoorID produces a result and a report and sends them to the business. The business reviews the result and makes any decision — DoorID does not decide anything about you. The business must not base an adverse decision on this result alone without a person considering it, and you can ask the business for a human review of any outcome.

Who your information goes to

Your information goes to the business that asked for the verification (as a report — the evidence pack), and to the service providers DoorID uses to run the service: facial comparison is performed by Amazon Web Services in the United Kingdom (London); document reading and imagery analysis by OpenAI (United States); address matching by Ordnance Survey and Ideal Postcodes (United Kingdom); mapping and building-outline services by Google, Mapbox and OpenStreetMap (United States and Europe); text messages by Twilio and emails by SendGrid (United States); and the service is hosted by Replit (United States). Where information leaves the United Kingdom, safeguards required by UK law are used. We never sell your information, and we do not allow providers to use it to train their artificial-intelligence models.

How long we keep it

DoorID keeps your images and identifying details only for as long as needed to produce the report and give the business time to collect it. From the date DoorID's removal process applies to the business's account, your images, identity details, precise location and the report itself are removed from DoorID's systems within 7 days of your verification finishing; until that date they are held securely and deleted when the business instructs us. If you were asked to photograph your driving licence first, before a property or handover check, DoorID keeps the licence images and details for up to 60 days so that the later check can use them without asking you again; each check that uses them starts the 60 days again, up to 180 days in total; once the check they were kept for is finished they are removed within 7 days, and you can ask the business to remove them sooner. What remains afterwards cannot identify you: the technical results, including how your phone moved during the check measured relative to the property rather than where you were, and a scrambled fingerprint of your phone number and licence number that lets DoorID spot the same details being used again but cannot be turned back into the numbers. If the business has a dispute or complaint about your verification it can ask DoorID to keep the full record for longer, and it will tell you if that affects you. DoorID may also keep the full record for up to 12 months where a check shows signs of fraud, so that it can be investigated. The report the business receives is their copy, kept under their own rules — ask them how long they keep it.

Practical guidance while you capture

Please avoid capturing other people — family, children, neighbours or passers-by — and, where you can, avoid letters, screens or documents with personal details being visible. Only the property entrance and what you are asked to capture is needed. Do not put yourself at risk to complete a step: if a step is unsafe or impossible, stop and contact the business.

Your rights

You have rights over your information — to see it, correct it, have it deleted, and object to its use — under UK data protection law and, if you are in Australia, under the Privacy Act 1988. Contact the business you are dealing with (they are the controller and we help them respond) or reach us at paul@doorid.ai. You must be 18 or over to complete this verification. If you are unhappy with how your information has been handled you can complain to the Information Commissioner's Office at ico.org.uk or, in Australia, to the Office of the Australian Information Commissioner at oaic.gov.au.

If you are in Australia

Your biometric information is sensitive information under Australian privacy law, and we collect it only with your express consent given on the next screen. Your information is disclosed to recipients in the United Kingdom and the United States as listed above. If there is a data breach that is likely to cause you serious harm, the business or DoorID will notify you and the Australian Information Commissioner as the law requires.