Privacy Notice

ID Link is an identity verification service operated by ByteCraft Solutions Ltd. (“ByteCraft”, “we”, “us”), a company established in Trinidad and Tobago. We decide how and why your personal data is used for the ID Link service, and we are responsible for it under this notice.

If you are verifying your identity because a business (for example, a bank, lender or employer) asked you to, that business also uses the result for its own purposes. Its own privacy notice applies to what it does with your information, and in some cases we process your data on its behalf and under its instructions.

Contact us about anything in this notice at enquiries@bytecraftsolutions.org.

Account details

Your email address, the name on your account, and the identifier our sign-in provider gives your account.

Identity details you declare

Your legal name, date of birth, the number of the document you are verifying with, and your residential address.

Document images

Photos of the front (and, where it has one, the back) of your National ID Card, Driver’s Permit or passport.

Your selfie

A photo of your face, taken so a reviewer can compare it with the photo on your document.

Verification records

The status of your verification, the reviewer’s decision and reasons, and an audit log of actions taken on your case (for example, when a document was uploaded or viewed, and by whom).

Technical data

Information your browser sends when you use the service, such as your IP address, browser type and the time of each request, recorded in our security and server logs.

Messages to us

If you contact us, your name, email, company and message.

We collect this information from you directly. We do not buy personal data, and we do not collect information about you from social media.

• To verify your identity. A trained member of our team checks that your document appears genuine and unaltered, that the details you declared match it, and that your selfie matches the document photo.
• To run your account, show you the status of your verification and email you about it.
• To prevent fraud and misuse, including detecting repeated or suspicious attempts, and to protect the people whose identities could be misused.
• To keep the service secure, investigate incidents and keep an audit trail of who accessed what.
• To meet our legal obligations and respond to lawful requests from authorities.
• To answer your enquiries and, where you have asked us to, contact you about ID Link.

We do not sell your personal data, use it for advertising, or use your documents or selfie to train artificial-intelligence models.

We handle personal data in line with the Data Protection Act, 2011 of Trinidad and Tobago and its general privacy principles: collecting only what we need, for a stated purpose, keeping it accurate and secure, and not keeping it longer than necessary. We rely on:

• Your consent, which you give when you submit a verification. You can withdraw it (see section 9).
• Providing the service you asked for, which we cannot do without this information.
• Legal obligations that require us to keep or disclose certain records.
• Our legitimate interests in preventing fraud and keeping the service secure, balanced against your rights.

Today, every verification is decided by a person. Your selfie is compared with your document photo by a trained reviewer, visually. We do not run automated facial recognition on it and we do not create a biometric template or faceprint from it.

Photos are stored privately. They are never publicly accessible, and authorised staff can only open them through short-lived, signed links. Each time a document is opened, it is recorded in our audit log. If we ever introduce automated checks, we will update this notice and tell you before they apply to you.

We share personal data only as follows:

• Service providers who process it for us under contract and only on our instructions: Auth0 (by Okta) for sign-in, Railway for hosting, databases and private file storage, and our email provider for service emails.
• The business that asked you to verify, if any: the result of your verification and the details needed for its own compliance, as you would expect when you verify at its request.
• Authorities, such as the police, regulators or the Financial Intelligence Unit, where the law requires or permits us to disclose information, including to report suspected fraud or identity misuse.
• Professional advisers, such as lawyers and auditors, under a duty of confidentiality.
• A successor business, if ByteCraft or the ID Link service is sold or reorganised. It must then protect your data as this notice describes.

We never sell your personal data or share it with advertisers.

Our service providers operate data centres outside Trinidad and Tobago, including in the United States. When your data is stored or processed there, we rely on those providers’ contractual commitments and security controls to protect it to the standard described in this notice.

• Unsubmitted verifications. If you start a verification but don’t submit it, it is deleted automatically, together with any photos, after 30 days without activity. You can delete it yourself at any time from your dashboard.
• Submitted verifications, including your details, photos and the decision, are kept while your account is open and for up to seven years after the verification is decided. This lets us deal with disputes and fraud, and meet record-keeping duties. They are then deleted or anonymised.
• Audit logs are kept for the same period as the verification they relate to. They record actions, not the contents of your documents.
• Enquiries are kept for up to two years after our last contact.
• Security and server logs are kept only as long as needed to run and protect the service.

We may keep information longer where the law requires it, or where it is needed for an ongoing investigation or legal claim.

• All traffic between your device and ID Link is encrypted (TLS).
• Documents are kept in private storage and are only viewable through short-lived, signed links.
• Uploads are checked for type, size and file signature before they are accepted.
• Only authorised reviewers can open a case. Customers can only ever see their own.
• Uploads, document views and decisions are written to an audit log.

You can ask us to:

• give you a copy of the personal data we hold about you;
• correct information that is inaccurate or incomplete;
• delete your data, where we are not required to keep it;
• stop or limit how we use it, or withdraw your consent. Withdrawing consent doesn’t affect what we did before, and may mean we can no longer verify you.

Email enquiries@bytecraftsolutions.org from the address on your account. We may need to confirm it’s you before we act, and we aim to respond within 30 days. If you’re not satisfied with our response, you may complain to the data protection authority in Trinidad and Tobago.

ID Link is only for people aged 18 or over. We do not knowingly verify anyone younger.

We use only the cookies needed to keep you signed in and to protect sign-in (an encrypted session cookie and short-lived cookies during sign-in). We also store a few preferences in your browser, such as your display name. We do not use advertising cookies or third-party tracking.

We may update this notice as the service or the law changes. The date at the top shows when it last changed. If a change materially affects how we use your data, we will tell you before it takes effect.

ByteCraft Solutions Ltd.
enquiries@bytecraftsolutions.org

See also our Terms of Use and who we are.