Privacy policy
IDReady is a Shopify app that lets a store (the "merchant") ask its customers to prove their identity or age before an order is fulfilled. This policy explains what we collect, why, who else handles it, and the choices you have.
1. Who we are and our role
Azirious LTD ("we", "us") operates IDReady. We play two roles:
- Processor (service provider) for the identity checks. The merchant decides to verify its customers and why; we process the data on the merchant's behalf and instructions. See our Data Processing Addendum.
- Controller (business) for merchant account data, billing, support and our own security and abuse prevention.
If you are a customer asked to verify, the store you are buying from is your primary point of contact, and its own privacy policy also applies.
2. What we collect and why
| Data | Whose | Why |
|---|---|---|
| Shop domain, store name, access tokens, settings, rules, billing plan | Merchant | To run the app, authenticate with Shopify and bill through Shopify. |
| Name, email address, order number and order total | Merchant's customer | To send the verification link, match the result to the right order and apply the merchant's rules. |
| Photo of an ID document and a selfie, including the facial geometry used to compare them | Merchant's customer | To confirm the document is genuine, that the person holding it is the person on it, and that they meet any minimum age the merchant set. Captured and analysed by our verification partner, who holds them (not our own servers) for the period the merchant chooses so the merchant can review them. See section 3. |
| The outcome: passed, failed or needs review; document type; issuing country; whether the name matches the order; face-match score; flags | Merchant's customer | So the merchant can release, hold or review the order. |
| Technical data: IP address, device and request logs | Everyone | Security, fraud prevention and keeping the service running. |
| Messages you send to support | Merchant or customer | To answer you. |
Our legal bases (where such concepts apply) are: performing our contract with the merchant, the customer's consent to the biometric comparison, our legitimate interests in security and service quality, and compliance with legal obligations.
3. Where the ID photos live, and what we do not keep
The merchant, not IDReady, decides whether its staff can view the photos, whether they are watermarked, and how long they are kept (within the limits above). Customers are told the store's setting before they begin.
4. Who else handles data
| Provider | What they do |
|---|---|
| Didit (identity verification) | Captures and analyses the ID and selfie, and returns the outcome. |
| Railway | Hosts the application and its database. |
| Cloudflare | DNS, network security and email routing. |
| Resend | Delivers verification and reminder emails. |
| Shopify | The platform the app runs on, and its billing system. |
These providers act on our instructions and are bound by confidentiality and data protection terms. Data may be processed in countries other than your own; where required we rely on recognised safeguards such as standard contractual clauses. We may disclose information if the law requires it or to protect people from fraud or harm. We do not sell or share personal information for cross-context behavioural advertising.
5. How long we keep it
- Verification outcomes are kept while the merchant has the app installed, so they can see their history.
- Uninstall: about 48 hours after the app is removed, Shopify instructs us to erase the shop, and we delete everything we hold for it.
- Customer erasure: when Shopify forwards a customer's erasure request, we remove their name, email and order reference from our records.
- ID photos and selfies are deleted by our verification partner after the retention period the merchant chose (default 30 days, maximum 90, or immediately), and sooner if you ask. Erasure requests from Shopify delete them too.
- Logs are kept for a limited period for security and debugging.
6. Your rights
Depending on where you live you may be able to access, correct or delete your information, restrict or object to its use, receive a copy, withdraw consent, and complain to your data protection authority. Because the merchant is the party you are buying from, requests about a purchase are best made to them, and they can ask us to act. Shopify's privacy-request tools reach us automatically. You can also write to us directly at privacy@realidchecker.com. We respond within 30 days. We do not discriminate against anyone for exercising their rights.
7. Biometric information
Comparing your face to the photo on your ID involves processing biometric information. We ask for your agreement before you begin and use it only for that comparison. The selfie is held with the ID photos for the same retention period and then deleted. We do not use it to identify you anywhere else. If you do not agree, simply do not start the check and contact the store.
8. Security
Connections are encrypted in transit, access tokens are stored server-side only, every webhook is signature-checked, and each merchant can reach only its own records. See our security overview. No system is perfectly secure; if a breach affects you we will notify the affected merchants and, where required, the authorities, without undue delay.
9. Cookies
This website sets no tracking cookies. The merchant admin uses a single session cookie that is strictly necessary to keep a signed-in merchant signed in. The customer verification page uses no cookies at all.
10. Children
IDReady is a business tool and is not directed at children. Where a merchant sells age-restricted goods, the check exists to keep them from buyers under the legal age.
11. Changes
If we change this policy in a way that matters, we will update the date above and tell merchants in the app or by email.
12. Contact
Azirious LTD · privacy@realidchecker.com · support@realidchecker.com