Privacy Policy

Last Updated: August 21, 2026

1. Information IDEnforcer Collects

IDEnforcer collects information that you voluntarily provide when you use the contact form to inquire about services or request sales information. The information IDEnforcer collects includes:

Required Information:

• Name: Your full name
• Email Address: Your email address for communication
• Business Name: The name of your business or organization

Optional Information:

• Phone Number: Your contact phone number
• Business Type: The type of business you operate
• Locations: Number of locations or specific location information
• Message: Any additional information you choose to provide in your inquiry

2. How IDEnforcer Uses Your Information

IDEnforcer uses the information you provide through the contact form solely for the following purposes:

• To respond to your inquiries and provide information about our products and services
• To process sales requests and provide quotes or proposals
• To communicate with you regarding your inquiry
• To send you a confirmation email acknowledging receipt of your message

3. Data Storage and Retention

When you submit our contact form, your information is:

• Sent to us via email at support@idenforcer.com
• Stored in our email system for the purpose of responding to your inquiry
• Retained only as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law

IDEnforcer does not store your contact form information in a separate database or customer relationship management (CRM) system unless you become a customer and explicitly consent to such storage.

4. Data Sharing and Disclosure

IDEnforcer does not sell, trade, or rent your personal information to third parties. IDEnforcer may share your information only in the following circumstances:

• Service Providers: IDEnforcer may share your information with third-party service providers who assist in operating the website and conducting business, such as email service providers. These service providers are contractually obligated to keep your information confidential and use it only for the purposes IDEnforcer specifies.
• Legal Requirements: IDEnforcer may disclose your information if required to do so by law or in response to valid requests by public authorities.

5. Your Rights

You have the right to:

• Access: Request access to the personal information IDEnforcer holds about you
• Correction: Request correction of any inaccurate or incomplete information
• Deletion: Request deletion of your personal information
• Opt-Out: Unsubscribe from our communications at any time by contacting us

To exercise any of these rights, please contact us using the information provided in the "Contact Us" section below.

6. Data Security

IDEnforcer implements appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or electronic storage is 100% secure, and IDEnforcer cannot guarantee absolute security.

7. Cookies and Tracking Technologies

Our website may use cookies and similar tracking technologies to enhance your browsing experience. These technologies help us understand how visitors use our website. You can control cookie preferences through your browser settings.

8. Children's Privacy

The IDEnforcer website and services are not directed to individuals under the age of 18. IDEnforcer does not knowingly collect personal information from children. If you believe IDEnforcer has inadvertently collected information from a child, please contact IDEnforcer immediately.

9. Changes to This Privacy Policy

IDEnforcer may update this Privacy Policy from time to time to reflect changes in practices or for other operational, legal, or regulatory reasons. IDEnforcer will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

10. Contact Us

11. Compliance

This Privacy Policy is designed to comply with applicable privacy laws and regulations, including but not limited to:

• Illinois Biometric Information Privacy Act (BIPA) — public retention schedule in Section 12.6
• Texas Capture or Use of Biometric Identifier Act (CUBI)
• Washington biometric privacy statutes (RCW 19.375)
• California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA)
• General Data Protection Regulation (GDPR) for European Union residents, where applicable
• Other applicable U.S. state comprehensive privacy laws

This policy describes IDEnforcer's data practices but does not constitute legal advice. Venues using IDEnforcer are independently responsible for compliance in their jurisdiction.

12. Processing on Behalf of Business Clients (Venue Scan Data)

IDEnforcer (operated by ProSolutions Technology LLC) provides identity verification, document fraud screening, access management, and venue security software to licensed business clients ("Venues"). When a patron's ID is scanned at a venue, IDEnforcer processes personal information on the Venue's instructions as a data processor / service provider. The Venue is the data controller and decides why scanning occurs, how long data is kept, and who may access it.

IDEnforcer does not sell, rent, or trade patron scan data. We do not use patron scan data for advertising, credit eligibility, or any purpose unrelated to providing the service to the Venue.

12.1 Categories of Data Processed

• Government ID fields: Name, date of birth, ID number, issuing state/country, expiration date, sex, and physical descriptors encoded in the PDF417 barcode or machine-readable zone (MRZ)
• Photographs: Cropped portrait from the ID document (profile image for staff visual identification); optional door webcam photo (staff visual verification only); optional back-of-ID image
• Barcode data: Raw PDF417 string and decoded AAMVA/MRZ field results
• Fraud screening results: Composite fraud score, individual check outcomes (UV, IR, tamper, layout, field comparison), alert flags, and jurisdiction classification — stored in scan metadata
• Scan metadata: Timestamp, scanner/station identifier, session folder token, visit count, ban/watch status, staff-assigned status (e.g., VIP)
• Venue-assigned data: Ban/watch list entries, staff notes, loyalty/rewards points where enabled

What is not uploaded to the cloud: Full infrared (IR) and ultraviolet (UV) channel images captured by supported scanners are analyzed on the Bridge device at the venue. The cloud receives the results of those analyses (scores, flags, and anonymous numerical telemetry described in Section 12.3) — not the raw IR/UV image files. IDEnforcer does not send ID data to third-party barcode decode services.

12.2 Fraud Detection — What the System Does and Does Not Do

When fraud detection is enabled, the Bridge software runs automated checks on each scanned document to help venue staff identify potentially altered or counterfeit IDs. These checks are document-integrity analyses, not identity verification or law-enforcement adjudication.

• UV zone analysis: Compares ultraviolet response patterns against expected security-feature behavior for the detected jurisdiction (supported hardware only)
• IR consistency analysis: Evaluates infrared ink and print consistency across the document (supported hardware only)
• Tamper heuristics: Detects signs of photo substitution, re-lamination, compression artifacts, and related alterations
• Layout geometry: Compares document aspect ratio, edge density, brightness zones, and region placement against learned templates for the jurisdiction and orientation
• Field comparison: Cross-checks OCR-extracted fields against barcode-decoded fields where both are available
• Adaptive scoring: Combines check results into a single advisory score; staff always make the final admission decision

Important limitations: Fraud screening is a staff aid only. IDEnforcer does not guarantee detection of every fraudulent document, does not make admission decisions automatically, and does not report scan results to law enforcement unless the Venue chooses to do so independently. See our Terms of Use for full disclaimers.

Fleet-wide model improvement uses anonymous numerical data only (see Section 12.3). Operator accept/reject feedback on fraud alerts may be uploaded to improve scoring accuracy. No patron names, ID numbers, or document images are included in fleet ML uploads.

12.3 Biometrics and Photographs

IDEnforcer does not perform facial recognition, facial geometry extraction, biometric template creation, automated face matching, or identity inference from faces. Specifically, we do not:

• Generate face embeddings, faceprints, or other biometric templates
• Compare a patron's face to a database of faces or to other patrons
• Perform one-to-one or one-to-many biometric identification
• Use photographs for automated profiling, emotion detection, or age estimation from facial features

What photographs are used for: The cropped ID portrait and optional webcam photo are stored so venue staff can visually confirm that the person presenting the ID matches the document — the same way a bouncer would look at a physical ID. Photos are displayed only to authorized venue staff through the IDEnforcer platform.

Document portrait detection (not face recognition): The system may record anonymous telemetry about whether a portrait region was detected on a scanned document (e.g., region size and contrast statistics). This measures document quality and layout — not who the person is. No face geometry, identity, or likeness is transmitted in this telemetry.

State biometric privacy laws: Laws such as the Illinois Biometric Information Privacy Act (BIPA), Texas Capture or Use of Biometric Identifier Act (CUBI), and Washington's biometric privacy statutes regulate "biometric identifiers" and "biometric information." Whether stored ID photographs qualify depends on how each statute and court interprets those terms in the ID-scanning context. Venues in regulated states should consult qualified legal counsel, post the required patron notices, and obtain any consent required before scanning. IDEnforcer provides a Patron Privacy Notice template for venue use but does not provide legal advice.

12.4 Anonymous Fleet Learning Data

Approximately every four hours, Bridge devices may upload anonymous machine-learning feedback to improve fleet-wide fraud screening. This data contains no names, ID numbers, photographs, or other personally identifiable information. Categories include:

• Anonymous numerical feature vectors from fraud check outcomes
• Operator accept/reject labels on fraud alerts (when fraud feedback is enabled)
• Layout geometry statistics aggregated by jurisdiction and document orientation
• UV/IR/OCR quality telemetry (zone means, consistency scores, field recovery counts — not images)
• Document portrait-region detection statistics (anonymous quality metrics only)

This data is stored in global fleet tables shared across all licensed venues to improve document fraud detection for the entire IDEnforcer network. It cannot be used to identify any individual patron.

12.5 Retention, Encryption, and Deletion

• Retention: Each Venue configures how long scan records are kept (from immediate deletion up to permanent retention). When the retention period expires, records are automatically purged from cloud storage. Ban/watch list entries are retained separately per Venue policy.
• Default unknown-scan purge: Unmatched scan records that cannot be linked to a profile may be purged after 30 days.
• Encryption in transit: All data between Bridge devices and the cloud is transmitted over TLS 1.2 or higher.
• Encryption at rest: Government ID numbers on cloud profiles are encrypted using AES-256-CBC. Storage paths use cryptographically derived folder tokens.
• Audit logs: Staff action audit logs are retained for a minimum of 365 days per our Data Processing Addendum.
• Backups: Database backups are retained for up to 14 days.

12.6 Biometric and Personal Data Retention Schedule (Public Policy)

In compliance with biometric privacy laws that require a publicly available written retention schedule (including Illinois BIPA § 15(a)), IDEnforcer publishes the following guidelines for data processed on behalf of Venues:

• Patron scan data (including photographs and ID fields) is retained only for the period configured by the Venue, or until the Venue or patron requests deletion, whichever occurs first.
• When the configured retention period expires, or upon verified deletion request from the Venue, IDEnforcer permanently deletes the associated scan records and images from active systems within the normal purge cycle.
• Anonymous fleet learning data (Section 12.4) is retained indefinitely because it cannot identify any individual; it is used solely to improve document fraud detection.
• IDEnforcer will not retain patron photographs or ID data longer than the Venue's configured retention period except where required by law or valid legal process.

Venues operating in Illinois, Texas, Washington, or other states with biometric destruction requirements should configure retention periods that comply with the stricter applicable standard (e.g., Texas CUBI's one-year guideline or Illinois BIPA's three-year maximum from last interaction, whichever the Venue's counsel advises).

12.7 Data Flow

Identity documents are scanned on the Bridge device at the venue entrance. Fraud checks run locally on the device. Scan results, photographs, and metadata are uploaded to the IDEnforcer cloud platform over encrypted connections. Authorized venue staff access patron records through the Cloud Portal. Data is automatically purged when the Venue's retention window expires.

12.8 Your Rights as a Patron

If you were scanned at a venue using IDEnforcer and wish to access, correct, or delete your data:

• Contact the venue first — they are the data controller and can process your request using built-in platform tools
• Email support@idenforcer.com with the venue name, approximate visit date, and your name — IDEnforcer will route your request to the relevant Venue

Typical response timelines: 30 days under California CCPA/CPRA; up to 45 days under most other U.S. state privacy laws. Venues in the EU/UK should comply with GDPR timelines where applicable.

12.9 U.S. State and Federal Privacy Law Compliance

IDEnforcer is designed to support Venues' compliance obligations. Relevant frameworks include:

• Illinois BIPA (740 ILCS 14): Requires informed consent before collecting biometric identifiers, a public written retention/destruction policy, and prohibits sale or profiting from biometric data. Venues must post notice and obtain consent; IDEnforcer provides notice templates and configurable retention.
• Texas CUBI (Bus. & Com. Code Ch. 503): Requires informed consent before capturing biometric identifiers and destruction within one year of collection or when purpose is fulfilled, unless required by law.
• Washington RCW 19.375: Requires notice and consent before enrolling biometric identifiers in a commercial database.
• California CCPA/CPRA: IDEnforcer acts as a "service provider" / processor. Biometric and government-ID data are categories of sensitive personal information. We do not sell personal information. California residents may limit use of sensitive personal information through the Venue (controller).
• Comprehensive state privacy laws (Virginia, Colorado, Connecticut, Oregon, Texas HB 4, and others): Many classify biometric data as sensitive data requiring consent or a data protection assessment. Venues should evaluate applicability based on patron volume and state of operation.

This summary is for informational purposes only and does not constitute legal advice. Venues are independently responsible for compliance with laws in their jurisdiction. IDEnforcer recommends that each Venue consult qualified privacy counsel.

12.10 Related Legal Documents

• Data Processing Addendum (DPA)
• Subprocessors List
• Terms of Use

12.11 California Consumer Privacy Act (CCPA/CPRA) Disclosure

Under the CCPA/CPRA, IDEnforcer acts as a "service provider" processing personal information on behalf of the Venue (the "business"). IDEnforcer does not sell or share personal information for cross-context behavioral advertising. California residents may exercise rights of access, correction, and deletion by contacting the Venue or emailing support@idenforcer.com.

13. Facebook / Meta Platform Integration

IDEnforcer operates a Meta (Facebook) application that publishes social media content to Facebook Pages managed by our business clients. This section describes how data is handled in connection with that integration.

Data Collected via Facebook

• Page Access Tokens: When a Page administrator authorizes our app, we receive and store an encrypted Page Access Token that allows us to publish content on behalf of the Page.
• Page Information: Page name, Page ID, and username — used solely to identify which Page to publish to.

How Facebook Data Is Used

• To publish scheduled text and image posts to authorized Facebook Pages
• To verify that published posts are live on the Page's timeline
• To display post status and permalinks within our internal administration dashboard

We do not access, collect, or store any data about Page followers, visitors, or commenters. We do not read the Page inbox, comments, or any user-generated content. We do not use Facebook data for advertising, analytics, or any purpose other than publishing content on behalf of the Page owner.

Data Storage and Security

Page Access Tokens are encrypted at rest using AES-256-CBC with HMAC verification. Tokens are stored in a secured database accessible only to authorized personnel. No Facebook data is shared with third parties.

Data Retention and Deletion

Page tokens and associated Page metadata are retained only while the client's service agreement is active. Upon termination of service or at the Page administrator's request, all stored tokens and Page data are permanently deleted within 30 days.

Revoking Access

Page administrators may revoke our app's access at any time by:

• Removing the app from their Page's settings in Meta Business Suite
• Contacting us at support@idenforcer.com to request immediate token deletion

Facebook Data Deletion Callback

In compliance with Meta Platform Terms, we support data deletion requests. To request deletion of all data associated with your Facebook account or Page, email support@idenforcer.com with your Page name and Page ID. Deletion will be completed within 30 days and you will receive confirmation.