Consent to identity verification (Verified)

Version 1 · Effective: 8 November 2026

This page has two parts. Part 1 is the text the member reads on the consent screen, word for word (the UI chat renders it, U7). Part 2 is for the founder and the product team and is never shown to the member.

Part 1 — The text the member sees

Verify your identity (optional)

Verified is a check that you are a real, named person. You do not need it to use Avonao ID. If you do not agree below, nothing is checked and nothing is sent anywhere.

What happens if you agree

1. You open a secure page of Stripe, the company that carries out the check for us.
2. Stripe asks you to photograph an identity document (for example a passport or ID card) and to take a live photo of your face.
3. Stripe compares the face on the document with your live photo and tells us the result: verified or not.

This uses biometric data. Comparing your face with the document photo is processing of biometric data to identify you. The law (Art. 9 GDPR) treats it as especially sensitive, so we only do it if you say yes. Your agreement is explicit and only for this check. It is separate from the Terms: you can use Avonao ID without it, and agreeing to the Terms does not mean you agree to this.

Who sees what

• Stripe receives your document images, your live photo and the data it reads from your document. Stripe processes this data for us to carry out the check, and for its own purposes, such as preventing fraud, meeting legal duties and keeping its service secure, as an independent controller under its own terms. Stripe's own privacy notice applies to what it does as its own controller: stripe.com/privacy.
• Avonao never receives or stores your document, your photos or the data on the document. We send Stripe a reference number we made up for this check; we do not send your email address, name or account id.
• We receive and keep only: that the check was started, its result (verified, not verified, or why it could not be completed, as a short error code), the date, and your trust level. If you ask for a proof (a short-lived token you give to one app, for example to get a verified-member price), the app learns only that you are verified and your trust level, not your name or document.

How long

• We keep the result and your trust level as long as your Avonao ID exists, or until you withdraw your consent, whichever comes first.
• Stripe keeps what it collected for as long as it needs it for the check and for its own legal duties, as set out in its privacy notice, unless you withdraw earlier (see below); when you withdraw, we ask Stripe to delete it, and Stripe may keep only what the law requires it to keep.
• We keep a record that you agreed (which text, and when) and, if you withdraw, when you did, for as long as your Avonao ID exists, so that you can see it and we can show that we asked you. It is deleted with your account. [Note: confirm whether the record of consent has to be kept longer than the account.]

Where
Your Avonao ID data, including the record of your consent and the result, is stored in the region you chose when you signed up. Stripe processes the document and photos in the United States and in other countries where it operates. For members in the EEA, the UK or Switzerland, the transfer relies on the Data Privacy Framework, where Stripe is certified, and on the Standard Contractual Clauses as the fallback.

You can withdraw at any time

• Use Withdraw consent under Verified in your Avonao ID dashboard. It takes one click and no extra sign-in. It is as easy as agreeing.
• When you withdraw, we stop any check that is still running, remove your Verified status and the record of your checks from your Avonao ID, cancel the proofs you had not used yet, and ask Stripe to delete what it collected. We email you a confirmation.
• You then lose whatever depends on being Verified (for example a verified-member price) until you verify again. If you verify again later, we ask for your consent again first.
• Withdrawing does not make the earlier check unlawful. We only stop from now on.
• If the text of this consent changes, we ask you again before your next check. A change does not remove your Verified status by itself.

Your other rights (see the Privacy Policy, section 10): access, correction, deletion, restriction, objection and a complaint to your data protection authority. Contact: privacy@avonao.com.

The box you tick (not ticked in advance, with this label and no other text):

☐ I agree that Stripe checks my identity document and compares it with a live photo of my face to verify my identity, as described above. I understand that this uses biometric data, that Avonao does not receive my document or photos, and that I can withdraw my consent at any time.

Buttons: Agree and continue (enabled only when the box is ticked) · No, not now.

Part 2 — Notes for the founder and the product team

What the code does with this consent

• The consent is recorded before a Stripe session is created: POST /api/v1/me/verified/consent { version, accepted: true }, or the same object as consent in POST /api/v1/me/verification/start. The record is verified_consents (member's region): the text version, the time, the method (checkbox: an unticked box beside this text, nothing bundled with the Terms), and later the time of withdrawal. accepted must be the boolean true; a screen that shows an older text version is refused with the current version (409).
• One consent in force per member (database-enforced). A new text version means a new consent: the old record is closed ("superseded") and the new one inserted; the history is kept and is part of the member's data export.
• A text change asks for fresh consent before the next verification. It does not strip an existing Verified status: the processing that the old consent covered is finished.
• Withdrawal (DELETE /api/v1/me/verified/consent): closes the consent first; stops a running check at Stripe; asks Stripe to redact (delete) each session, or cancels it if redaction is refused; deletes the member's verification records, trust marker and unused Verified Price proofs in one step (the same data the account purge removes); emails the member; writes a security-log event with counts only. Stripe's answer never blocks the erasure on our side; sessions Stripe did not accept are listed by id in the security-log event so they can be finished from Stripe's dashboard. No step-up is required (Art. 7(3): withdrawing must be as easy as giving).
• A Stripe result that arrives for a member without a consent in force is acknowledged (so Stripe stops retrying), not recorded, and noted in the member's security log (verification.dropped_no_consent).
• Avonao stores no document data, images or biometric templates at any point: the only data about a check is identity_verifications (our reference, Stripe's session id, status, Stripe's error code, dates), member_trust (level and date) and verified_proofs (proof ids), see migrations 0012 and 0013.

Open points (add to L12)

1. Stripe's role (processor, joint or independent controller for Identity) and the data processing terms with Stripe; whether the consent text must name Stripe's own purposes.
2. DPIA (Art. 35): required before switching on; processing biometric data to identify a person on a large scale is on the usual lists. Outcome and any prior consultation.
3. Legal basis wording: Art. 6(1)(a) and Art. 9(2)(a), explicit consent; check the label of the box and the three-step description against national guidance, and whether any Member State adds conditions for processing biometric data.
4. Retention at Stripe and whether redaction on request is available for every session state (the code asks for redaction and falls back to cancelling).
5. Record of consent after the account is deleted: this document deletes it with the account (data minimisation). To be decided: whether it should be kept for the limitation period to prove consent (Art. 7(1)).
6. Where Stripe processes the data and the transfer mechanism for members outside the US/EEA.
7. Languages: the consent is valid for the text version the member saw; if the screen is translated, each translation must be reviewed and covered by the same version (a change of any language means a new version).
8. Members below the age of digital consent: the guardian consent (B10) covers the account, not this special-category processing. This draft does not restrict Verified by age. The founder decides whether Verified is offered only to adults before it is switched on.

Versions

Where the consent is mentioned

Privacy Policy section 11 (kept in line with this text); Terms of Service section 9 (mentions explicit consent; to align); README open point L12 (to update once this is answered).