Privacy Policy - Identity-as-a-Service
Updated on: October 28, 2026
IDmission helps various online service provider platforms validate your identity.
IDmission provides software that eliminates risk associated with false identities and is headquartered in the United States. IDmission will collect images of your photo ID and your selfie and will securely process and store them on our Clients’ behalf. Only a limited number of individuals will have access to review any user-submitted data.
IDmission does not sell any user-submitted data.
Our Clients define data retention policies and specify how long to keep data before it is permanently deleted from our systems. IDmission uses Amazon Web Services to store your data which is encrypted both in transit and at rest. IDmission maintains a robust security policy, is ISO 27001:2013 certified and undergoes regular security penetration testing by external auditors.
IDmission LLC (“IDmission”) is concerned about privacy issues and respects the privacy of our users. This Privacy Policy (“Policy”) describes our privacy practices concerning personal information collected in connection with IDmission’s IDentity Solution and Identity-as-a-Service, including self-service registration, and all associated validation, enrollment and verification services available through the product and services (the “Services”).
A separate policy describes our privacy practices in connection with our online website, located at www.idmission.com/privacy . Please see our Biometric Policy – Identity-as-a-Service for information about our privacy practices concerning biometric information in compliance with applicable biometric privacy laws.
IDmission makes the Services available to our clients, their customers and third parties for use in their identity verification and enrollment practices. In most cases, IDmission collects, uses, and discloses individual users’ information only as directed by these third parties and, accordingly, acts as a processor of user information with respect to the Services. However, in certain cases IDmission may determine the purposes and means of processing certain personal information — for example, for security, fraud prevention, service improvement, meeting the requirements of applicable certification or trust frameworks, or complying with our own legal obligations — and in those cases IDmission acts as a controller. Where IDmission acts as a controller, this Privacy Policy governs that processing directly.
To fully understand how your information will be handled when you use the Services, you must review not just this Policy, but also the privacy policy of the third party with whom you are dealing directly (the “Third-Party Data Controller”).
1. What personal and other information IDmission collects about you
IDmission collects “personal information” about users of the Services. “Personal information” is information such as name, email address, or identification card image, which refers to an identified or identifiable person.
Personal information
IDmission collects a wide range of personal information through the Services. This information varies depending on the IDentity application and the Third-Party Data Controller in question, but may include such information as name, physical address, email address, telephone number, social security number, driver’s license number, state or national ID card number, passport number, other ID card number, credit or debit card number, CVV, expiration date, and/or date of birth.
Biometric Information
IDmission collects biometric information through the Services. Our Biometric Policy must be reviewed separately and users of the Services must consent to this policy as part of their enrollment or registration of the Services.
Data provided by third parties
We may receive personal information about you from the Third-Party Data Controller that integrates the Services into its website, application, or other online service. This information includes a unique ID, selected by the Third-Party Data Controller, that uniquely identifies you in the third party’s database.
Cookies and other tracking data
When you use the Services, we automatically receive and record certain information from your computer (or other device) and/or your web browser. This may include your IP address, domain name, date and time of session, software/hardware attributes, and general geographic location.
2. Cookies
What are cookies?
Cookies are small files that are stored on your computer or other device by your web browser. A cookie allows IDmission to recognize whether you have used the Services before and may store user preferences and other information.
How are cookies used?
Cookies can be used to collect information about your use of the Services during your current session and over time, your computer or other device’s operating system and browser type, your Internet service provider, and your general geographic location.
How do you avoid cookies?
You can set your browser to refuse all cookies or to indicate when a cookie is being set. However, if you choose to block or delete cookies, certain features of the Services may not operate correctly.
3. How IDmission uses the personal information that we collect
Where IDmission acts as a processor, personal information is used only as directed by the Third-Party Data Controller that integrates the Services into its website, application, or other online service. Where IDmission acts as a controller, we use personal information for the purposes described in this Policy, including as set out below.
IDmission uses your personal information to provide the Services. For example, we might use your ID card information to verify your identity. We also may use your personal information to fulfill the terms of any agreement with the Third-Party Data Controller; to complete a transaction; and to comply with legal and/or regulatory requirements.
4. How IDmission shares personal information with third parties.
Third-Party Data Controller
We share the personal information that we collect on behalf of a particular Third-Party Data Controller with that Third-Party Data Controller.
IDmission service providers
IDmission uses third-party service providers to help us deliver, manage, and improve the Services. These service providers may use your personal information to assist us in achieving the purposes discussed above.
Legal purposes
We may share your personal information with third parties when necessary to comply with applicable law, court orders, or to investigate/prevent illegal activities or fraud.
5. Security
IDmission uses commercially reasonable physical, electronic, and procedural safeguards to protect your personal information against loss or unauthorized access. Among other things, IDmission encrypts personal information both in transit and at rest.
IDmission is PCI Level 3 compliant and regularly conducts security audits, vulnerability scans, and penetration tests. However, no security program is foolproof, and thus we cannot guarantee absolute security.
6. Reviewing, updating or deleting your information
IDmission will grant you access to your personal information as directed by the Third-Party Data Controller. If you want to learn more about the personal information that IDmission has about you, or you would like to submit a request to update, change or delete that information, please contact the Third-Party Data Controller.
You also may submit a request to us at privacyteam@idmission.com or call us at 1-800-925-8041 ext. 4. Where IDmission acts as a controller with respect to your personal information, you may exercise your rights with us directly as described in the “What Are Your Data Subject Rights?” section below.
7. What Are Your Data Subject Rights?
Depending on applicable data protection laws and the circumstances of the processing, individuals may have the following rights in relation to their personal information:
You have the right to receive clear and transparent information about how we collect, use, retain, disclose, and otherwise process your personal information. This Privacy Policy provides information about our processing activities.
You may request access to the personal information we hold about you and information about how that information is processed, subject to applicable legal requirements and exemptions.
You may request that inaccurate or incomplete personal information held by us be corrected or updated.
In certain circumstances, you may request that your personal information be deleted or removed. This right is not absolute and may not apply where we are required or permitted to retain or process the information under applicable law, including where the information is required for legal claims or other lawful purposes.
In certain circumstances, you may request that we restrict the processing of your personal information. Where processing is restricted, we may retain the information but will generally not process it further except as permitted by applicable law.
Where applicable, you may request to receive personal information that you have provided to us in a structured, commonly used, and machine-readable format. Where technically feasible and required by applicable law, you may also request that the information be transmitted directly to another organization.
In certain circumstances, you may object to the processing of your personal information, including where processing is based on legitimate interests or is otherwise permitted under applicable law.
Where applicable, you may have rights relating to decisions based solely on automated processing, including profiling, where such decisions produce legal effects or similarly significantly affect you. These rights are subject to applicable legal requirements and exceptions.
How to Exercise Your Rights
If you wish to exercise any of the rights described above, or if you have a question or concern regarding the processing of your personal information, you may contact IDmission using the contact details provided in the Grievance Officer section of this Privacy Policy.
We may need to verify your identity before processing a request in order to protect your personal information from unauthorized disclosure.
We will process and respond to valid requests in accordance with applicable data protection laws and within one calendar month of receiving a verified request. Where permitted by applicable law, the time required to respond may be extended where a request is complex or where multiple requests are received. Where an extension applies, we will inform you of the reason for the delay.
Where we determine that we cannot fulfil a request, we will provide an explanation where required by applicable law and inform you of any applicable right to lodge a complaint with the relevant supervisory or regulatory authority.
8. Grievance Officer
If you wish to exercise any of your rights, or if you have any questions, concerns or complaints regarding the processing of your personal information, you may contact our Grievance Officer using the details below:
Email: privacyteam@idmission.com
Phone: 1-800-925-8041 ext. 4
We will acknowledge and address grievances in accordance with applicable data protection laws.
9. Changes to this Policy
Technology and the Internet are rapidly changing. IDmission therefore is likely to make changes to the Services in the future and may need to revise this Policy. When we revise the Policy, IDmission will post the new Policy on the IDmission website’s home page.
10. Questions or comments
If you have any questions or comments regarding our Policy, please email us at: