[{"data":1,"prerenderedAt":2889},["ShallowReactive",2],{"legal-all-for-type":3},[4,385,1708,1948],{"id":5,"title":6,"body":7,"description":377,"extension":378,"meta":379,"navigation":380,"path":381,"seo":382,"stem":383,"__hash__":384},"legal/legal/dpa/2026_10_01.md","Data Processing Addendum — ZeroTrust",{"type":8,"value":9,"toc":358},"minimark",[10,14,35,45,48,51,54,59,62,64,68,74,80,86,91,125,131,133,137,140,143,145,149,152,154,158,161,181,183,187,198,201,204,206,210,213,216,218,222,225,227,231,234,236,240,243,246,248,252,255,258,260,264,267,278,281,283,287,290,292,296,306,312,314,318,323],[11,12,6],"h1",{"id":13},"data-processing-addendum-zerotrust",[15,16,17,21,22,26,27,30,31,34],"p",{},[18,19,20],"strong",{},"Version:"," ",[23,24,25],"code",{},"2026-10-01","  ·  ",[18,28,29],{},"Effective:"," October 1, 2026  ·  ",[18,32,33],{},"Supersedes:"," none, this is the first published version",[36,37,38],"blockquote",{},[15,39,40,41,44],{},"This document is versioned by its effective date. Every superseded version\nremains available at ",[23,42,43],{},"zerotrust.entrinsia.com/dpa/\u003Cversion>"," permanently. Changes are listed in the\nRevision History at the end.",[15,46,47],{},"This Data Processing Addendum (\"Addendum\") forms part of the ZeroTrust Terms of Service between Entrinsia Inc. (\"Entrinsia\") and the Customer, and applies to Entrinsia's processing of personal data on the Customer's behalf.",[15,49,50],{},"Terms used but not defined here have the meaning given in the Terms of Service. \"GDPR\" means Regulation (EU) 2016/679, and \"UK GDPR\" means that Regulation as it forms part of the law of England and Wales, Scotland, and Northern Ireland.",[52,53],"hr",{},[55,56,58],"h2",{"id":57},"_1-roles","1. Roles",[15,60,61],{},"The Customer is the controller and Entrinsia the processor in respect of End User verification data. Where the Customer is itself a processor, Entrinsia is a subprocessor, and references to the Customer's instructions mean the instructions of the relevant controller as passed on by the Customer.",[52,63],{},[55,65,67],{"id":66},"_2-details-of-processing","2. Details of Processing",[15,69,70,73],{},[18,71,72],{},"Subject matter:"," identity and age verification of the Customer's End Users.",[15,75,76,79],{},[18,77,78],{},"Duration:"," the term of the Terms of Service, together with the retention periods set out in the Privacy Policy.",[15,81,82,85],{},[18,83,84],{},"Nature and purpose:"," capture and real-time analysis of a government-issued identity document and a video selfie; document authentication; liveness detection; facial comparison; extraction of configured text fields; return of a verification result to the Customer; and retention of a compliance record.",[15,87,88],{},[18,89,90],{},"Types of personal data:",[92,93,94,98,101,104,107,110,113,116,119,122],"ul",{},[95,96,97],"li",{},"Facial images, and the biometric comparison derived from them, processed transiently and not retained",[95,99,100],{},"Identity document images, processed transiently and not retained",[95,102,103],{},"Name",[95,105,106],{},"Address, passed to the Customer where configured and not retained by Entrinsia",[95,108,109],{},"Date of birth, processed transiently and not retained",[95,111,112],{},"Document number, retained only as a keyed one-way hash",[95,114,115],{},"Document type and expiry status",[95,117,118],{},"City, state, and postal code",[95,120,121],{},"A record of biometric notice acceptance, comprising acceptance, notice version, and timestamp",[95,123,124],{},"Device, browser, and network diagnostics",[15,126,127,130],{},[18,128,129],{},"Categories of data subject:"," individuals whom the Customer directs to verification, being the Customer's customers, applicants, or account holders.",[52,132],{},[55,134,136],{"id":135},"_3-processing-on-instructions","3. Processing on Instructions",[15,138,139],{},"Entrinsia processes personal data only on the Customer's documented instructions, which comprise the Terms of Service, this Addendum, and the Customer's account configuration, unless required to do otherwise by applicable law. Where the law requires otherwise, Entrinsia will inform the Customer before processing, unless the law prohibits that notice on important grounds of public interest.",[15,141,142],{},"Entrinsia will inform the Customer if, in its opinion, an instruction infringes applicable data protection law.",[52,144],{},[55,146,148],{"id":147},"_4-confidentiality","4. Confidentiality",[15,150,151],{},"Entrinsia ensures that persons authorised to process personal data under this Addendum are bound by an appropriate obligation of confidentiality, whether contractual or statutory.",[52,153],{},[55,155,157],{"id":156},"_5-security","5. Security",[15,159,160],{},"Entrinsia implements appropriate technical and organisational measures, including:",[92,162,163,166,169,172,175,178],{},[95,164,165],{},"Encryption of personal data in transit and at rest",[95,167,168],{},"Keyed one-way hashing of document numbers, with the keying material held server side and never released to a client",[95,170,171],{},"Handling of identity document images and video in ephemeral, in-memory processing only, without persistence to storage or backup",[95,173,174],{},"Removal of all image data on the capturing device before any cross-device transfer",[95,176,177],{},"Role-based access control limited to personnel who require access to operate or support the Service",[95,179,180],{},"Logging and monitoring of access, and of anomalous use of the verification flow",[52,182],{},[55,184,186],{"id":185},"_6-subprocessors","6. Subprocessors",[15,188,189,190,197],{},"The Customer gives general authorisation for Entrinsia to engage the subprocessors listed at ",[191,192,196],"a",{"href":193,"rel":194},"https://zerotrust.entrinsia.com/subprocessors",[195],"nofollow","zerotrust.entrinsia.com/subprocessors",".",[15,199,200],{},"Entrinsia will give at least thirty (30) days' notice before adding or replacing a subprocessor that processes End User personal data. The Customer may object on reasonable data protection grounds within that period, with the remedy set out in Section 16 of the Terms of Service.",[15,202,203],{},"Entrinsia imposes on each subprocessor data protection obligations no less protective than those in this Addendum, and remains fully liable to the Customer for each subprocessor's performance.",[52,205],{},[55,207,209],{"id":208},"_7-data-subject-rights","7. Data Subject Rights",[15,211,212],{},"Taking into account the nature of the processing, Entrinsia will assist the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to requests to exercise data subject rights.",[15,214,215],{},"Where Entrinsia receives such a request directly from a data subject in respect of data processed for the Customer, Entrinsia will not respond substantively and will refer the request to the Customer without undue delay, except where Entrinsia is required to respond under applicable law.",[52,217],{},[55,219,221],{"id":220},"_8-assistance","8. Assistance",[15,223,224],{},"Entrinsia will provide the Customer with reasonable assistance in respect of data protection impact assessments and prior consultations with a supervisory authority, taking into account the nature of the processing and the information available to Entrinsia.",[52,226],{},[55,228,230],{"id":229},"_9-personal-data-breach","9. Personal Data Breach",[15,232,233],{},"Entrinsia will notify the Customer without undue delay, and in any event within seventy-two (72) hours of becoming aware, of any personal data breach affecting personal data processed for the Customer, and will provide the information the Customer reasonably requires in order to meet its own obligations.",[52,235],{},[55,237,239],{"id":238},"_10-deletion-or-return","10. Deletion or Return",[15,241,242],{},"On termination of the Terms of Service, Entrinsia will delete personal data processed for the Customer within thirty (30) days, except for compliance records that remain within their retention period and records Entrinsia is required by law to retain.",[15,244,245],{},"On written request made before termination takes effect, Entrinsia will provide an export of the Customer's compliance records in a machine-readable format.",[52,247],{},[55,249,251],{"id":250},"_11-audit","11. Audit",[15,253,254],{},"Entrinsia will make available to the Customer the information necessary to demonstrate compliance with this Addendum, including the materials described in Section 10.3 of the Terms of Service, and will allow for and contribute to audits conducted by the Customer or an auditor it mandates.",[15,256,257],{},"Audits may be conducted no more than once in any twelve month period, on at least thirty (30) days' notice, subject to confidentiality obligations and to reimbursement of Entrinsia's reasonable costs, save where an audit follows a personal data breach affecting the Customer.",[52,259],{},[55,261,263],{"id":262},"_12-international-transfers","12. International Transfers",[15,265,266],{},"Where the Customer transfers personal data subject to the GDPR or the UK GDPR to Entrinsia in the United States, the parties incorporate the European Commission's Standard Contractual Clauses of 4 June 2021, Module Two (controller to processor) or Module Three (processor to subprocessor) as applicable, with the Customer as data exporter and Entrinsia as data importer.",[92,268,269,272,275],{},[95,270,271],{},"The optional docking clause applies.",[95,273,274],{},"Clause 17 is governed by the law of Ireland, and Clause 18(b) designates the courts of Ireland.",[95,276,277],{},"Annexes I, II, and III to those Clauses are populated by Sections 2, 5, and 6 of this Addendum respectively.",[15,279,280],{},"For transfers subject to the UK GDPR, the UK International Data Transfer Addendum to those Clauses applies, with Tables 1 to 3 populated as above, and with the importer permitted to end the Addendum as set out in Table 4.",[52,282],{},[55,284,286],{"id":285},"_13-precedence","13. Precedence",[15,288,289],{},"In the event of a conflict, this Addendum prevails over the Terms of Service in respect of the processing of personal data, and the Standard Contractual Clauses prevail over this Addendum in respect of transfers to which they apply.",[52,291],{},[55,293,295],{"id":294},"_14-contact","14. Contact",[15,297,298,21,301,305],{},[18,299,300],{},"Email:",[191,302,304],{"href":303},"mailto:support@entrinsia.com","support@entrinsia.com",", subject line \"Data Protection\"",[15,307,308,311],{},[18,309,310],{},"Mail:","\nEntrinsia Inc.\nAttn: Privacy Officer\n559 S El Monte Ave\nLos Altos, CA 94022",[52,313],{},[55,315,317],{"id":316},"revision-history","Revision History",[15,319,320,321,197],{},"Every published version of this document remains available at ",[23,322,43],{},[324,325,326,342],"table",{},[327,328,329],"thead",{},[330,331,332,336,339],"tr",{},[333,334,335],"th",{},"Version",[333,337,338],{},"Effective",[333,340,341],{},"Summary of changes",[343,344,345],"tbody",{},[330,346,347,352,355],{},[348,349,350],"td",{},[23,351,25],{},[348,353,354],{},"October 1, 2026",[348,356,357],{},"First published version.",{"title":359,"searchDepth":360,"depth":360,"links":361},"",2,[362,363,364,365,366,367,368,369,370,371,372,373,374,375,376],{"id":57,"depth":360,"text":58},{"id":66,"depth":360,"text":67},{"id":135,"depth":360,"text":136},{"id":147,"depth":360,"text":148},{"id":156,"depth":360,"text":157},{"id":185,"depth":360,"text":186},{"id":208,"depth":360,"text":209},{"id":220,"depth":360,"text":221},{"id":229,"depth":360,"text":230},{"id":238,"depth":360,"text":239},{"id":250,"depth":360,"text":251},{"id":262,"depth":360,"text":263},{"id":285,"depth":360,"text":286},{"id":294,"depth":360,"text":295},{"id":316,"depth":360,"text":317},"Version: 2026-10-01  ·  Effective: October 1, 2026  ·  Supersedes: none, this is the first published version","md",{},true,"/legal/dpa/2026_10_01",{"title":6,"description":377},"legal/dpa/2026_10_01","g92IoVkvDaDm9XwJ5J0Yw9GFxTJ-6FQEAzitBqPYmXU",{"id":386,"title":387,"body":388,"description":377,"extension":378,"meta":1703,"navigation":380,"path":1704,"seo":1705,"stem":1706,"__hash__":1707},"legal/legal/privacy/2026_10_01.md","Privacy Policy — ZeroTrust",{"type":8,"value":389,"toc":1621},[390,393,403,410,413,416,430,435,437,441,444,494,497,499,503,508,511,537,541,544,549,557,562,582,585,590,604,609,638,643,651,654,658,661,675,679,706,710,713,716,719,722,724,728,732,749,753,770,774,788,790,794,797,801,804,811,815,818,822,825,829,832,836,839,841,845,848,852,863,866,869,873,876,882,888,894,900,904,911,914,932,935,939,945,959,963,966,970,973,977,980,982,986,989,993,1007,1016,1020,1039,1041,1045,1049,1087,1091,1102,1106,1109,1113,1116,1118,1122,1126,1129,1133,1136,1162,1166,1174,1176,1180,1183,1187,1190,1194,1211,1215,1218,1235,1238,1241,1244,1248,1251,1254,1256,1260,1263,1267,1270,1274,1277,1281,1287,1291,1294,1298,1301,1305,1308,1312,1315,1319,1326,1328,1332,1335,1339,1369,1373,1380,1384,1387,1391,1398,1400,1404,1407,1422,1424,1428,1432,1452,1456,1459,1463,1466,1470,1473,1475,1479,1485,1510,1513,1515,1519,1522,1524,1528,1531,1533,1537,1540,1542,1546,1552,1557,1571,1575,1581,1583,1585,1589,1613,1615],[11,391,387],{"id":392},"privacy-policy-zerotrust",[15,394,395,21,397,26,399,30,401,34],{},[18,396,20],{},[23,398,25],{},[18,400,29],{},[18,402,33],{},[36,404,405],{},[15,406,40,407,44],{},[23,408,409],{},"zerotrust.entrinsia.com/privacy-policy/\u003Cversion>",[15,411,412],{},"This Privacy Policy explains how Entrinsia Inc. (\"Entrinsia,\" \"we,\" \"us,\" or \"our\") collects, uses, shares, and protects information in connection with ZeroTrust, our identity and age verification product (the \"Service\").",[15,414,415],{},"ZeroTrust is used in two ways, and this policy addresses both:",[92,417,418,424],{},[95,419,420,423],{},[18,421,422],{},"Business Customers"," — companies that integrate ZeroTrust into their checkout, sign-up, or account flows (\"Customers,\" \"you,\" when we mean the business).",[95,425,426,429],{},[18,427,428],{},"End Users"," — the individuals a Customer's website or app asks to verify their ID and take a live selfie (\"End Users,\" \"you,\" when we mean the person being verified).",[15,431,432],{},[18,433,434],{},"By using ZeroTrust, whether as a Customer integrating the Service or an End User completing a verification, you agree to the practices described in this Privacy Policy.",[52,436],{},[55,438,440],{"id":439},"_1-the-short-version","1. The Short Version",[15,442,443],{},"We wrote the full policy below because you should be able to see exactly how we handle your information. Here is the part that matters most.",[92,445,446,452,458,464,470,476,482,488],{},[95,447,448,451],{},[18,449,450],{},"We do not store the ID photo or video selfie you submit during verification."," Both are processed in real time and permanently deleted, typically within seconds of a verification completing.",[95,453,454,457],{},[18,455,456],{},"We do not extract, retain, or sell biometric templates."," The facial comparison used to confirm liveness and match a selfie to an ID happens in memory during processing and is not saved afterward.",[95,459,460,463],{},[18,461,462],{},"We retain only what a compliance record needs."," After a verification ends we keep the person's name, the pass or fail result of each check we ran, the type of document presented, coarse location (city, state, and postal code), a one-way hash of the document number, a record of the biometric notice that was accepted, and a timestamped record that the verification occurred.",[95,465,466,469],{},[18,467,468],{},"Full street address is passed through, never retained."," Where a Customer has configured ZeroTrust to return the address printed on an ID, we pass it to that Customer at the moment of verification, for example so a shopping cart can populate a shipping address. Entrinsia does not store it.",[95,471,472,475],{},[18,473,474],{},"Date of birth is never returned and never retained."," It is read from the ID solely to compare against the age threshold the Customer configured, such as 18 or 21. Neither the date of birth nor the person's exact age leaves that comparison. We keep only the threshold that was applied and whether it was met.",[95,477,478,481],{},[18,479,480],{},"Document numbers are never stored in readable form."," If a document number, such as a driver's licence or passport number, is part of a verification, we store only a one-way cryptographic hash of it, not the number itself. We cannot look up or reveal what a document number is from that hash. We can only confirm whether a document number someone later presents matches one we have seen before.",[95,483,484,487],{},[18,485,486],{},"We do not sell personal information",", and we do not use End User verification data for advertising.",[95,489,490,493],{},[18,491,492],{},"We do not use your data to train AI models."," Neither we nor the cloud processing providers we use may train or improve any machine learning model on ID images, video selfies, biometric data, or data extracted from an ID.",[15,495,496],{},"The rest of this policy explains all of this in detail, including exactly what we collect, how long we keep it, who is responsible for what, and your rights.",[52,498],{},[55,500,502],{"id":501},"_2-information-we-collect","2. Information We Collect",[504,505,507],"h3",{"id":506},"_21-information-from-business-customers","2.1 Information From Business Customers",[15,509,510],{},"When a business signs up to use ZeroTrust, we collect:",[92,512,513,519,525,531],{},[95,514,515,518],{},[18,516,517],{},"Account information"," — name, business name, email address, and role of the individuals who administer the account.",[95,520,521,524],{},[18,522,523],{},"Billing information"," — billing contact, billing address, and payment details (processed by our third-party payment processor or AWS Marketplace; we do not store full payment card numbers).",[95,526,527,530],{},[18,528,529],{},"Integration data"," — domains registered for verification, configuration settings (which data fields are returned, age thresholds, accepted document types), and API and usage logs.",[95,532,533,536],{},[18,534,535],{},"Communications"," — support requests, correspondence, and information provided when you contact us.",[504,538,540],{"id":539},"_22-information-from-end-users-during-verification","2.2 Information From End Users During Verification",[15,542,543],{},"When an End User completes a ZeroTrust verification, the following information is involved.",[15,545,546],{},[18,547,548],{},"Submitted during the verification session, processed, then deleted:",[92,550,551,554],{},[95,552,553],{},"A photo or scan of a government-issued ID (driver's licence, state ID, or passport)",[95,555,556],{},"A short video selfie used for liveness detection and to confirm the selfie matches the ID photo",[15,558,559],{},[18,560,561],{},"Extracted during processing, and returned to the Customer only where that Customer has configured the field:",[92,563,564,567,570,573,576,579],{},[95,565,566],{},"Name fields printed on the ID",[95,568,569],{},"Address fields printed on the ID, including the street address",[95,571,572],{},"Document number, document type, and expiration date",[95,574,575],{},"A pass or fail result for each check performed: document authenticity, age threshold, liveness, selfie match, document expiry, and any acknowledgment step",[95,577,578],{},"An age-over-threshold confirmation, for example \"21 or over: yes\"",[95,580,581],{},"Liveness and face-match confidence values used to produce those results",[15,583,584],{},"Fields a Customer has not configured are not transmitted to that Customer. Date of birth is never transmitted, under any configuration.",[15,586,587],{},[18,588,589],{},"Used internally only, never transmitted and never retained:",[92,591,592,598],{},[95,593,594,597],{},[18,595,596],{},"Date of birth",", read from the ID solely to compare against the Customer's configured age threshold",[95,599,600,603],{},[18,601,602],{},"Exact age",", computed from the date of birth for that same comparison and discarded with it",[15,605,606],{},[18,607,608],{},"Retained by Entrinsia after the verification session ends (see Section 5):",[92,610,611,614,617,620,623,626,629,632,635],{},[95,612,613],{},"Full name",[95,615,616],{},"City, state, and postal code as printed on the ID. Never the street address",[95,618,619],{},"The age threshold that was applied, and whether the End User met it",[95,621,622],{},"The type of document presented, and whether it had expired",[95,624,625],{},"A one-way keyed cryptographic hash of the document number, never the number itself (Section 5.3)",[95,627,628],{},"The pass or fail result of each check performed, and the confidence values that produced those results",[95,630,631],{},"A record that the biometric notice was accepted, which version of that notice was shown, and when",[95,633,634],{},"A compliance record confirming the verification occurred: timestamp, result, session identifier, the Customer's account, and the Customer's transaction or order reference where supplied",[95,636,637],{},"Device diagnostics: device type, mobile operating system, browser user agent, and camera resolution",[15,639,640],{},[18,641,642],{},"Returned to the Customer, never retained by Entrinsia, regardless of configuration:",[92,644,645],{},[95,646,647,650],{},[18,648,649],{},"Full street address",", passed through at the moment of verification so a Customer's order or account processing can use it",[15,652,653],{},"We do not retain the ID image, the video selfie, the document number in readable form, the date of birth, the exact age, the street address, gender, the document issue or expiry dates, or any biometric template derived from any of them. See Section 9 for biometric information specifically.",[504,655,657],{"id":656},"_23-information-collected-automatically","2.3 Information Collected Automatically",[15,659,660],{},"When Customers or End Users interact with our website, API, or verification widget, we automatically collect:",[92,662,663,669],{},[95,664,665,668],{},[18,666,667],{},"Device and log data"," — IP address, browser type, operating system, device identifiers, and timestamps",[95,670,671,674],{},[18,672,673],{},"Usage data"," — API calls made, pages visited on our marketing site, and general interaction data used for reliability, security, and abuse prevention",[504,676,678],{"id":677},"_24-information-from-third-parties","2.4 Information From Third Parties",[92,680,681,694,700],{},[95,682,683,686,687,690,691],{},[18,684,685],{},"Cloud AI providers"," (currently Amazon Web Services) that perform the underlying document authentication, liveness detection, and facial comparison on our behalf. These providers process ID images, video selfies, and biometric comparisons ",[18,688,689],{},"solely in memory and in transit"," to return a result to us, operate under contract as our subprocessors, and are ",[18,692,693],{},"contractually prohibited from retaining End User ID images, selfies, or biometric data, or from using them to train or improve their own AI models or services.",[95,695,696,699],{},[18,697,698],{},"Payment processors and AWS Marketplace"," — transaction confirmations and subscription status.",[95,701,702,705],{},[18,703,704],{},"Authentication providers",", if a Customer's administrator signs in using a third-party identity provider.",[504,707,709],{"id":708},"_25-verification-starts-and-service-telemetry","2.5 Verification Starts and Service Telemetry",[15,711,712],{},"When an End User opens the verification portal, before any acknowledgment and before any camera access, we record that a verification began. That record contains a timestamp, a session identifier, the Business Customer's account and organisation code, the Customer's transaction or order reference where supplied, an identifier for the e-commerce platform the verification was launched from, the Customer's registered storefront domain, the address of the page that embedded the portal, and the device type, operating system, and browser user agent.",[15,714,715],{},"We use this record for two purposes. The first is to measure how many End Users begin a verification and do not finish it, so that we can find and fix the points where the flow fails. The second is to bill Business Customers, as described in our Terms of Service.",[15,717,718],{},"This record contains nothing read from an ID, no image, and no biometric data. It is retained for the same period as the compliance record described in Section 5.4.",[15,720,721],{},"We also record operational events during a verification, such as which step was reached and whether a step failed, for reliability and fraud monitoring. These events carry the same identifiers as the start record and no ID data.",[52,723],{},[55,725,727],{"id":726},"_3-how-we-use-information","3. How We Use Information",[504,729,731],{"id":730},"_31-to-provide-the-verification-service","3.1 To Provide the Verification Service",[92,733,734,737,740,743,746],{},[95,735,736],{},"Authenticate a submitted ID and confirm it is genuine",[95,738,739],{},"Confirm the person in the live selfie matches the ID and is physically present (liveness and anti-spoofing)",[95,741,742],{},"Determine age from the ID and compare it to the Customer's configured threshold",[95,744,745],{},"Return the specific result and data fields the Customer configured",[95,747,748],{},"Generate and retain the minimal compliance record described in Section 5",[504,750,752],{"id":751},"_32-to-operate-our-business","3.2 To Operate Our Business",[92,754,755,758,761,764,767],{},[95,756,757],{},"Administer Customer accounts and process billing",[95,759,760],{},"Provide support and respond to inquiries",[95,762,763],{},"Maintain the security, integrity, and availability of the Service",[95,765,766],{},"Detect, investigate, and prevent fraud, abuse of the verification flow (for example repeated fake ID attempts), and security threats",[95,768,769],{},"Analyse aggregated, de-identified usage trends to improve accuracy and performance",[504,771,773],{"id":772},"_33-what-we-do-not-do","3.3 What We Do Not Do",[92,775,776,779,782,785],{},[95,777,778],{},"We do not use End User ID images, selfies, or extracted ID data for advertising or marketing.",[95,780,781],{},"We do not sell personal information to third parties.",[95,783,784],{},"We do not build a searchable database of End Users' identities.",[95,786,787],{},"We do not use Customer data, End User ID images, video selfies, biometric data, or data extracted from an ID to train or improve any machine learning model, whether our own or a third party's.",[52,789],{},[55,791,793],{"id":792},"_4-how-we-share-information","4. How We Share Information",[15,795,796],{},"We do not sell personal information. We share information only as follows.",[504,798,800],{"id":799},"_41-service-providers","4.1 Service Providers",[15,802,803],{},"We use vetted service providers under contract to operate ZeroTrust, including cloud infrastructure and AI processing providers, payment processors, and email and communication tools. These providers process data solely to deliver the Service to us and are contractually restricted from using it for their own purposes, from retaining it beyond what is needed to perform the service, and from using it to train or improve any model.",[15,805,806,807,810],{},"A current list of the subprocessors that process End User personal data, including the categories of data each one receives and the country in which it processes them, is maintained at ",[191,808,196],{"href":193,"rel":809},[195],". Business Customers may subscribe to notification of changes to that list. The notice period and objection right are set out in our Terms of Service.",[504,812,814],{"id":813},"_42-with-the-business-customer","4.2 With the Business Customer",[15,816,817],{},"The result of a verification, and any data fields the Customer configured us to return, is shared with the Customer whose checkout or sign-up flow initiated the verification. The Customer receives only what it configured. It does not receive the underlying ID image or video selfie, and it does not receive the date of birth under any configuration.",[504,819,821],{"id":820},"_43-legal-requirements","4.3 Legal Requirements",[15,823,824],{},"We may disclose information if required to do so by law, subpoena, court order, or governmental request, or where we believe disclosure is necessary to protect our rights, investigate fraud, or respond to an emergency.",[504,826,828],{"id":827},"_44-business-transfers","4.4 Business Transfers",[15,830,831],{},"If Entrinsia is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy or a policy offering equivalent protections.",[504,833,835],{"id":834},"_45-with-consent","4.5 With Consent",[15,837,838],{},"We may share information for other purposes with explicit consent from the relevant party.",[52,840],{},[55,842,844],{"id":843},"_5-data-retention","5. Data Retention",[15,846,847],{},"This is the section most people come to this policy to read, so we have kept it direct.",[504,849,851],{"id":850},"_51-raw-id-images-and-video-selfies","5.1 Raw ID Images and Video Selfies",[15,853,854,855,858,859,862],{},"The ID image and video selfie submitted during a verification are processed ",[18,856,857],{},"in memory and in transit"," to perform document authentication, liveness detection, and facial comparison. Once a result is produced, the raw image and video are ",[18,860,861],{},"permanently deleted",", generally within seconds, and no later than the completion of the verification session. In the event of a system error, a dropped session, or an uncompleted verification attempt, deletion occurs in all cases within 24 hours. We do not archive them, we do not use them for model training in any form, and we do not provide any Customer, employee, or third party with access to them after deletion.",[15,864,865],{},"Two mechanisms back this commitment rather than policy alone. Images and video are never written to persistent storage in the first place: they are held in browser memory for the life of the session and discarded with it. Where a verification begins on a desktop and is completed on a phone, every image and video is removed on the phone before anything is transmitted, so the record that moves between the two devices contains text fields and numeric results only.",[15,867,868],{},"A handoff record that the originating desktop never collects, because the End User closed the page or lost connectivity, is deleted automatically within 24 hours.",[504,870,872],{"id":871},"_52-extracted-data-fields","5.2 Extracted Data Fields",[15,874,875],{},"Not every field we can read from an ID is retained, even where it was briefly available during processing or returned to the Customer at the moment of verification.",[15,877,878,881],{},[18,879,880],{},"We retain:"," the full name; the city, state, and postal code printed on the ID; the age threshold applied and whether it was met; the document type and whether the document had expired; a keyed one-way hash of the document number; the pass or fail result and confidence value for each check performed; and a record of the biometric notice accepted.",[15,883,884,887],{},[18,885,886],{},"We do not retain, even though it is returned to the Customer at the moment of verification:"," the full street address, used only to support the Customer's own order or account processing. It is not stored by Entrinsia after the verification session ends.",[15,889,890,893],{},[18,891,892],{},"We never return, and never retain:"," the date of birth, and the exact age computed from it. Both are used solely to produce a pass or fail result against the Customer's configured age threshold, and neither leaves that computation.",[15,895,896,899],{},[18,897,898],{},"We do not retain at all:"," gender, the document issue date, the document expiry date, or any field a Customer has not configured us to return.",[504,901,903],{"id":902},"_53-document-numbers-one-way-hash-only","5.3 Document Numbers, One-Way Hash Only",[15,905,906,907,910],{},"Document numbers, such as a driver's licence or passport number, are never retained in plaintext or in any reversible form. Instead, we store a ",[18,908,909],{},"one-way cryptographic hash"," of the document number.",[15,912,913],{},"This means:",[92,915,916,919,926,929],{},[95,917,918],{},"We cannot reconstruct, decrypt, or look up the original document number from what we store.",[95,920,921,922,925],{},"We ",[18,923,924],{},"can"," compare a document number presented to us in the future against previously stored hashes, to determine whether that specific document has been used in a prior verification. This lets us flag the same ID being used across multiple accounts or orders in a way that may indicate fraud.",[95,927,928],{},"The hash is produced with a secret key held on our servers and never released to a browser or a Customer. A licence number alone carries little entropy, so an unkeyed digest would be reversible by anyone who obtained the stored values. The keying prevents that.",[95,930,931],{},"This hash is not linked back to the underlying ID image or video selfie, both of which are already deleted under Section 5.1.",[15,933,934],{},"This allows us, and where configured our Customers, to detect document reuse and fraud patterns without Entrinsia ever holding a readable copy of a government ID number.",[504,936,938],{"id":937},"_54-compliance-record","5.4 Compliance Record",[15,940,941,942],{},"For every verification attempt, we retain a minimal compliance record consisting of a timestamp, the pass or fail result, a session identifier, the Customer's account, and, where supplied by the Customer, a transaction or order reference. This record exists so a Customer can demonstrate, if audited or challenged, that a verification took place and what its outcome was. ",[18,943,944],{},"It does not, and will never, contain the ID image, the video selfie, or any biometric template, regardless of retention period.",[15,946,947,950,951,954,955,958],{},[18,948,949],{},"Retention period:"," compliance records, the retained fields described in Section 5.2, the biometric notice acceptance record described in Section 9.3, and the start and telemetry records described in Section 2.5 are retained for ",[18,952,953],{},"3 years"," from the date of verification, which aligns with common state age-verification and audit-trail requirements, including recommended AB 1263 recordkeeping practices. Where a Customer's financial, tax, or KYC-related obligations require longer retention of associated billing or transaction records, those specific records, not the compliance record itself, may be retained for up to ",[18,956,957],{},"7 years",", consistent with Section 5.5. After the applicable period, records are deleted or de-identified, except as required by law (Section 5.7).",[504,960,962],{"id":961},"_55-business-customer-account-data","5.5 Business Customer Account Data",[15,964,965],{},"Customer account and billing information is retained for the duration of the Customer's subscription and for a limited period afterward as required for accounting, tax, and legal purposes, generally up to 7 years for financial records.",[504,967,969],{"id":968},"_56-backups","5.6 Backups",[15,971,972],{},"Backup copies of the limited data described above may persist for a short period after deletion for disaster recovery purposes, and are purged on a routine schedule. Raw ID images and video selfies are never written to backups, because they are never written to persistent storage in the first place.",[504,974,976],{"id":975},"_57-legal-holds","5.7 Legal Holds",[15,978,979],{},"We may retain information longer than stated above where necessary to comply with a legal obligation, resolve a dispute, or enforce our agreements.",[52,981],{},[55,983,985],{"id":984},"_6-data-controllers-and-processors","6. Data Controllers and Processors",[15,987,988],{},"Understanding who is responsible for what matters for compliance, for both Customers and End Users.",[504,990,992],{"id":991},"_61-for-business-customers","6.1 For Business Customers",[92,994,995,1001],{},[95,996,997,1000],{},[18,998,999],{},"Entrinsia is the data processor"," for verification data belonging to a Customer's End Users. We process it strictly according to the Customer's configuration and instructions, such as which fields to return and what age threshold to apply.",[95,1002,1003,1006],{},[18,1004,1005],{},"The Customer is the data controller"," for its End Users' verification data. The Customer determines why verification is being run, for example to comply with an age-verification law, what it does with the data we return, and how long it keeps that data on its own systems.",[15,1008,1009,1010,1015],{},"Business Customers processing personal data subject to the GDPR or the UK GDPR should also read our ",[191,1011,1014],{"href":1012,"rel":1013},"https://zerotrust.entrinsia.com/dpa",[195],"Data Processing Addendum",", which forms part of our agreement with them and sets out our obligations as a processor in full.",[504,1017,1019],{"id":1018},"_62-what-this-means-in-practice","6.2 What This Means in Practice",[92,1021,1022,1028,1034],{},[95,1023,1024,1027],{},[18,1025,1026],{},"Customers are responsible"," for having a lawful basis to collect and use End User data, for their own privacy notices to their End Users, for honouring End User rights requests regarding data the Customer holds, and for their own regulatory compliance with respect to what they do with the verification result after we return it.",[95,1029,1030,1033],{},[18,1031,1032],{},"Entrinsia is responsible"," for processing data only as instructed, securing it appropriately while it is in our systems, deleting the raw ID image and video selfie as described in Section 5, and providing the biometric notice described in Section 9.3.",[95,1035,1036,1038],{},[18,1037,428],{}," whose data was processed as part of a verification, and who have questions about how a business used their result, should generally start with that business, since the business controls what happens to the data after we return it. Entrinsia will assist Customers in responding to End User requests where relevant to data we hold.",[52,1040],{},[55,1042,1044],{"id":1043},"_7-data-security","7. Data Security",[504,1046,1048],{"id":1047},"_71-technical-safeguards","7.1 Technical Safeguards",[92,1050,1051,1057,1063,1069,1075,1081],{},[95,1052,1053,1056],{},[18,1054,1055],{},"Encryption"," — data is encrypted in transit (TLS) and at rest.",[95,1058,1059,1062],{},[18,1060,1061],{},"Keyed one-way hashing of document numbers"," — document numbers are never stored in plaintext; only an irreversible keyed cryptographic hash is retained, as described in Section 5.3, with the keying material held server side and never released to a browser.",[95,1064,1065,1068],{},[18,1066,1067],{},"Ephemeral processing"," — raw ID images and video selfies are held in memory for the life of the session and are never written to storage or backup. In cross-device verification, all image data is removed on the capturing device before any transfer.",[95,1070,1071,1074],{},[18,1072,1073],{},"Access controls"," — access to Customer accounts, configuration, and compliance records is role-based and limited to personnel who need it to operate or support the Service.",[95,1076,1077,1080],{},[18,1078,1079],{},"Zero-trust architecture"," — every request to our systems is authenticated and authorised; nothing is trusted by default based on network location alone.",[95,1082,1083,1086],{},[18,1084,1085],{},"Monitoring"," — we monitor for anomalous access patterns and potential abuse of the verification flow.",[504,1088,1090],{"id":1089},"_72-organizational-safeguards","7.2 Organizational Safeguards",[92,1092,1093,1096,1099],{},[95,1094,1095],{},"Limited employee access to personal information, on a need-to-know basis",[95,1097,1098],{},"Confidentiality obligations for employees and contractors with system access",[95,1100,1101],{},"Vetting of subprocessors who touch verification data (see Section 4.1)",[504,1103,1105],{"id":1104},"_73-no-guarantee-of-absolute-security","7.3 No Guarantee of Absolute Security",[15,1107,1108],{},"No method of transmission or storage is 100% secure, and no verification system can guarantee the identification of every fraudulent document or spoofing attempt with perfect accuracy. We implement reasonable, industry-standard safeguards, but we cannot and do not guarantee absolute security, or guarantee that every verification result is error-free. Customers are responsible for determining whether ZeroTrust's verification approach is appropriate for their specific legal and risk requirements, and for maintaining appropriate fallback and dispute-handling procedures for their own use of the Service.",[504,1110,1112],{"id":1111},"_74-data-breach-notification","7.4 Data Breach Notification",[15,1114,1115],{},"In the event of a breach affecting personal information we control, we will notify affected Business Customers without undue delay, and in any event within 72 hours of becoming aware, so they can meet their own notification obligations. We will notify affected individuals directly where we are legally required to do so, consistent with applicable law.",[52,1117],{},[55,1119,1121],{"id":1120},"_8-your-privacy-rights","8. Your Privacy Rights",[504,1123,1125],{"id":1124},"_81-if-you-are-a-business-customer","8.1 If You Are a Business Customer",[15,1127,1128],{},"You may access, correct, or export your account and configuration data through your account, or by contacting us. You may request deletion of your account, subject to the retention obligations described in Section 5.5.",[504,1130,1132],{"id":1131},"_82-if-you-are-an-end-user","8.2 If You Are an End User",[15,1134,1135],{},"Because a Business Customer controls what happens to your verification result after we return it (Section 6), requests about how a business uses your data should generally go to that business first. For data that Entrinsia itself holds, being the compliance record described in Section 5.4 and the retained fields described in Section 5.2, you may contact us directly, and we will work with the relevant Customer as needed to respond to:",[92,1137,1138,1144,1150,1156],{},[95,1139,1140,1143],{},[18,1141,1142],{},"Access"," — a description of the compliance record and retained fields we hold about a specific verification",[95,1145,1146,1149],{},[18,1147,1148],{},"Correction"," — correction of inaccurate information we hold",[95,1151,1152,1155],{},[18,1153,1154],{},"Deletion"," — deletion of the compliance record and any retained fields, subject to the legal retention exceptions in Section 5.7",[95,1157,1158,1161],{},[18,1159,1160],{},"Questions about a specific verification result"," — we can confirm what our system returned to the Customer, but decisions about the underlying transaction, such as whether an order shipped, are the Customer's to make",[504,1163,1165],{"id":1164},"_83-how-to-exercise-these-rights","8.3 How to Exercise These Rights",[15,1167,1168,1169,1173],{},"Email ",[18,1170,1171],{},[191,1172,304],{"href":303}," with the subject line \"Privacy Rights Request,\" including your name, the Customer or business involved if known, and the nature of your request. We will respond within 30 days, or as required by applicable law. We may need to verify your identity before completing certain requests.",[52,1175],{},[55,1177,1179],{"id":1178},"_9-biometric-information","9. Biometric Information",[15,1181,1182],{},"Because ZeroTrust's core function involves comparing a live selfie to a photo ID, this section addresses biometric data specifically and directly.",[504,1184,1186],{"id":1185},"_91-what-we-process","9.1 What We Process",[15,1188,1189],{},"During a verification session, our system, and the AI processing providers we use under contract, analyses a live video selfie in order to confirm that it reflects a real, physically present person rather than a photo, video, or mask, and to compare facial characteristics to the photo on the submitted ID in order to produce a match or no-match signal.",[504,1191,1193],{"id":1192},"_92-what-we-do-not-do","9.2 What We Do Not Do",[92,1195,1196,1199,1202,1205,1208],{},[95,1197,1198],{},"We do not store the video selfie or ID photo after verification (Section 5.1).",[95,1200,1201],{},"We do not create or retain a persistent biometric template, faceprint, or identifier that could be used to re-identify an End User later or to run future comparisons.",[95,1203,1204],{},"We do not use biometric data for any purpose other than completing the specific verification session in which it was submitted.",[95,1206,1207],{},"We do not use biometric data to train or improve any machine learning model, and our processing providers are contractually prohibited from doing so.",[95,1209,1210],{},"We do not sell, license, or otherwise disclose biometric data to third parties for their own purposes.",[504,1212,1214],{"id":1213},"_93-notice-and-consent","9.3 Notice and Consent",[15,1216,1217],{},"Before ZeroTrust requests access to a camera, and before it captures any image or video, the verification flow displays a biometric notice and requires the End User to take an affirmative action to continue. The notice states:",[92,1219,1220,1223,1226,1229,1232],{},[95,1221,1222],{},"that a photograph of a government-issued ID and a short video selfie will be captured;",[95,1224,1225],{},"that facial characteristics from the selfie will be compared with the photograph on the ID, in order to confirm that they match and that a live person is present;",[95,1227,1228],{},"that this processing is carried out by Entrinsia and by the cloud processing providers named in Section 14, acting under contract on our behalf;",[95,1230,1231],{},"that the image and the video are deleted when the session ends and are never used to train any model; and",[95,1233,1234],{},"that no facial template, faceprint, or other persistent biometric identifier is created or stored.",[15,1236,1237],{},"An End User who does not accept cannot proceed, and no camera is opened. Where a verification begins on a desktop and is handed off to a phone, the notice is shown on the device that captures the images.",[15,1239,1240],{},"We retain a record that the notice was accepted, which version of the notice text was shown, and when it was accepted. We retain no image or video associated with that acceptance. A Business Customer may request that record for a verification run under its account.",[15,1242,1243],{},"This notice is built into the ZeroTrust flow. It does not depend on a Business Customer's configuration and cannot be disabled. It is separate from, and does not replace, any additional notice a Business Customer displays in its own checkout or sign-up flow, such as an AB 1263 disclaimer or a notice specific to that Customer's product or jurisdiction.",[504,1245,1247],{"id":1246},"_94-state-biometric-privacy-laws","9.4 State Biometric Privacy Laws",[15,1249,1250],{},"We designed our biometric handling, being real-time processing with immediate deletion, no persistent templates, and the mandatory in-flow notice described in Section 9.3, to align with the intent of state biometric privacy statutes, including the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act, Washington's biometric privacy law, and comparable provisions under California law.",[15,1252,1253],{},"Business Customers deploying ZeroTrust in these states remain responsible for their own compliance obligations under these statutes, including any notice or written release those statutes require of the party collecting biometric identifiers, since Entrinsia acts as a processor and does not control how a Customer presents verification to its own End Users.",[52,1255],{},[55,1257,1259],{"id":1258},"_10-california-residents-ccpa","10. California Residents (CCPA)",[15,1261,1262],{},"If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), as amended.",[504,1264,1266],{"id":1265},"_101-right-to-know","10.1 Right to Know",[15,1268,1269],{},"You may request the categories and specific pieces of personal information we hold about you, the categories of sources, the business purpose for collecting it, and the categories of third parties with whom it is shared.",[504,1271,1273],{"id":1272},"_102-right-to-delete","10.2 Right to Delete",[15,1275,1276],{},"You may request deletion of personal information we hold about you, subject to exceptions such as completing a transaction, complying with a legal obligation, or the compliance-record retention described in Section 5.",[504,1278,1280],{"id":1279},"_103-right-to-opt-out-of-sale-or-sharing","10.3 Right to Opt Out of Sale or Sharing",[15,1282,1283,1286],{},[18,1284,1285],{},"We do not sell personal information, and we do not share it for cross-context behavioural advertising."," There is nothing to opt out of.",[504,1288,1290],{"id":1289},"_104-right-to-correct","10.4 Right to Correct",[15,1292,1293],{},"You may request correction of inaccurate personal information we hold.",[504,1295,1297],{"id":1296},"_105-right-to-limit-use-of-sensitive-personal-information","10.5 Right to Limit Use of Sensitive Personal Information",[15,1299,1300],{},"ID and biometric data processed during verification may constitute \"sensitive personal information\" under the CCPA while it is being processed. We limit our use of this information to the verification purpose itself and do not use it to infer characteristics about you beyond the specific configured result. Because the underlying image and biometric data are deleted immediately after processing (Section 5.1), and because we do not retain the date of birth, exact age, street address, or readable document number (Section 5.2), there is minimal sensitive personal information for us to retain or further limit.",[504,1302,1304],{"id":1303},"_106-non-discrimination","10.6 Non-Discrimination",[15,1306,1307],{},"We will not discriminate against you for exercising your CCPA rights.",[504,1309,1311],{"id":1310},"_107-authorized-agents","10.7 Authorized Agents",[15,1313,1314],{},"You may designate an authorised agent to submit requests on your behalf, subject to identity and authorisation verification.",[504,1316,1318],{"id":1317},"_108-how-to-submit-a-ccpa-request","10.8 How to Submit a CCPA Request",[15,1320,1168,1321,1325],{},[18,1322,1323],{},[191,1324,304],{"href":303}," with subject line \"CCPA Request.\"",[52,1327],{},[55,1329,1331],{"id":1330},"_11-european-and-uk-residents-gdpr","11. European and UK Residents (GDPR)",[15,1333,1334],{},"If you are located in the European Economic Area, United Kingdom, or Switzerland, the following applies where the GDPR governs our processing.",[504,1336,1338],{"id":1337},"_111-legal-basis-for-processing","11.1 Legal Basis for Processing",[92,1340,1341,1347,1353,1359],{},[95,1342,1343,1346],{},[18,1344,1345],{},"Contract"," — to provide the Service to a Business Customer or complete a specific verification an End User initiated (Article 6(1)(b))",[95,1348,1349,1352],{},[18,1350,1351],{},"Legitimate interests"," — to secure the Service, prevent fraud, and improve verification accuracy (Article 6(1)(f))",[95,1354,1355,1358],{},[18,1356,1357],{},"Legal obligation"," — to comply with applicable law (Article 6(1)(c))",[95,1360,1361,1364,1365,1368],{},[18,1362,1363],{},"Explicit consent for biometric data"," — facial liveness detection and the comparison of a live selfie to an ID photo constitute processing of special category biometric data for the purpose of uniquely identifying a person. For End Users located in the EEA, UK, or Switzerland, this processing relies on ",[18,1366,1367],{},"explicit consent under Article 9(2)(a) GDPR",", obtained through the mandatory in-flow consent step described in Section 9.3, in addition to the Article 6 basis supporting the verification as a whole.",[504,1370,1372],{"id":1371},"_112-international-transfers","11.2 International Transfers",[15,1374,1375,1376,197],{},"Data may be processed in the United States. Where required, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and, for UK transfers, the UK International Data Transfer Addendum. The operative terms are set out in our Data Processing Addendum at ",[191,1377,1379],{"href":1012,"rel":1378},[195],"zerotrust.entrinsia.com/dpa",[504,1381,1383],{"id":1382},"_113-additional-gdpr-rights","11.3 Additional GDPR Rights",[15,1385,1386],{},"In addition to the rights in Section 8, you may have the right to restrict processing, receive your data in a portable format, object to processing based on legitimate interests, and lodge a complaint with your local data protection authority.",[504,1388,1390],{"id":1389},"_114-contact","11.4 Contact",[15,1392,1168,1393,1397],{},[18,1394,1395],{},[191,1396,304],{"href":303},", subject line \"GDPR Request.\"",[52,1399],{},[55,1401,1403],{"id":1402},"_12-childrens-privacy","12. Children's Privacy",[15,1405,1406],{},"ZeroTrust is not directed at children, and its function, being to verify that a person meets a minimum age requirement, typically 18 or 21, is designed to prevent underage individuals from completing age-restricted transactions in the first place.",[92,1408,1409,1412,1415],{},[95,1410,1411],{},"We do not knowingly collect personal information from children through the verification flow independent of a verification attempt.",[95,1413,1414],{},"If a verification attempt indicates the individual does not meet the required age threshold, the raw ID image and selfie are deleted in the same manner as any other verification (Section 5.1), and only the configured fail result is returned to the Customer.",[95,1416,1417,1418,197],{},"If we become aware that we have retained information about a child under 13 outside of the standard verification-and-delete flow described above, we will delete it promptly. Parents or guardians with concerns should contact ",[18,1419,1420],{},[191,1421,304],{"href":303},[52,1423],{},[55,1425,1427],{"id":1426},"_13-cookies-and-tracking","13. Cookies and Tracking",[504,1429,1431],{"id":1430},"_131-what-we-use-cookies-for","13.1 What We Use Cookies For",[92,1433,1434,1440,1446],{},[95,1435,1436,1439],{},[18,1437,1438],{},"Essential cookies"," — authentication for Business Customer accounts, session management, and security",[95,1441,1442,1445],{},[18,1443,1444],{},"Functional cookies"," — remembering preferences and settings",[95,1447,1448,1451],{},[18,1449,1450],{},"Analytics cookies"," — understanding usage of our marketing website and dashboard",[504,1453,1455],{"id":1454},"_132-what-we-dont-do","13.2 What We Don't Do",[15,1457,1458],{},"We do not use cookies to track End Users across unrelated third-party websites, and we do not use verification-related data for ad targeting.",[504,1460,1462],{"id":1461},"_133-managing-cookies","13.3 Managing Cookies",[15,1464,1465],{},"You can control cookies through your browser settings. Disabling essential cookies may affect the ability to log into a Customer dashboard or complete a verification session.",[504,1467,1469],{"id":1468},"_134-do-not-track","13.4 Do Not Track",[15,1471,1472],{},"We do not currently respond to browser \"Do Not Track\" signals.",[52,1474],{},[55,1476,1478],{"id":1477},"_14-third-party-services","14. Third-Party Services",[15,1480,1481,1482,197],{},"The Service relies on the following categories of third-party providers, each governed by its own privacy policy. The current, specific list is published at ",[191,1483,196],{"href":193,"rel":1484},[195],[92,1486,1487,1498,1504],{},[95,1488,1489,1492,1493,1497],{},[18,1490,1491],{},"Cloud infrastructure and AI processing:"," Amazon Web Services, ",[191,1494,1495],{"href":1495,"rel":1496},"https://aws.amazon.com/privacy/",[195],". As described in Section 2.4, our agreements with cloud AI subprocessors used for document authentication, liveness detection, and facial comparison require that End User ID images, video selfies, and biometric data be processed only in memory or in transit to generate a result for us, and prohibit these subprocessors from independently retaining that data or using it to train or improve their own models or services.",[95,1499,1500,1503],{},[18,1501,1502],{},"Payment processing and marketplace billing:"," AWS Marketplace and our direct payment processor",[95,1505,1506,1509],{},[18,1507,1508],{},"Email and support tools:"," used to communicate with Business Customers",[15,1511,1512],{},"We are not responsible for the privacy practices of third-party websites linked from our site, and encourage you to review their policies independently.",[52,1514],{},[55,1516,1518],{"id":1517},"_15-international-use","15. International Use",[15,1520,1521],{},"Data is primarily processed on infrastructure located in the United States. By using the Service, you consent to the transfer and processing of information in the United States and any other country where our service providers operate, subject to the safeguards described in Section 11.2. If you access the Service from outside the United States, you are responsible for compliance with applicable local laws, including any local consent requirements for biometric or ID data collection.",[52,1523],{},[55,1525,1527],{"id":1526},"_16-changes-to-this-privacy-policy","16. Changes to This Privacy Policy",[15,1529,1530],{},"We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. Material changes will be communicated to Business Customers via email or dashboard notice, and a new version with a new effective date will be published. Where a change would materially reduce the protections applying to End User data, we will give Business Customers at least 30 days' notice before it takes effect. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.",[52,1532],{},[55,1534,1536],{"id":1535},"_17-limitation-regarding-this-policy","17. Limitation Regarding This Policy",[15,1538,1539],{},"This Privacy Policy describes our data handling practices and is not, by itself, a guarantee of any particular legal compliance outcome for a Business Customer's use of the Service. Business Customers are solely responsible for determining whether their use of ZeroTrust satisfies the requirements of laws applicable to their business, including but not limited to state age-verification statutes, the CCPA, the GDPR, and biometric privacy laws, for obtaining any consents required from their own End Users beyond the in-flow notice described in Section 9.3, and for their own retention and use of any data ZeroTrust returns to them. Nothing in this Policy constitutes legal advice.",[52,1541],{},[55,1543,1545],{"id":1544},"_18-contact-us","18. Contact Us",[15,1547,1548,21,1550],{},[18,1549,300],{},[191,1551,304],{"href":303},[15,1553,1554],{},[18,1555,1556],{},"Subject lines for specific requests:",[92,1558,1559,1562,1565,1568],{},[95,1560,1561],{},"General privacy inquiry — \"Privacy Inquiry\"",[95,1563,1564],{},"CCPA request — \"CCPA Request\"",[95,1566,1567],{},"GDPR request — \"GDPR Request\"",[95,1569,1570],{},"Data deletion — \"Data Deletion Request\"",[15,1572,1573,311],{},[18,1574,310],{},[15,1576,1577,1580],{},[18,1578,1579],{},"Response time:"," we aim to respond within 30 days, or as required by applicable law.",[52,1582],{},[55,1584,317],{"id":316},[15,1586,320,1587,197],{},[23,1588,409],{},[324,1590,1591,1601],{},[327,1592,1593],{},[330,1594,1595,1597,1599],{},[333,1596,335],{},[333,1598,338],{},[333,1600,341],{},[343,1602,1603],{},[330,1604,1605,1609,1611],{},[348,1606,1607],{},[23,1608,25],{},[348,1610,354],{},[348,1612,357],{},[52,1614],{},[15,1616,1617],{},[1618,1619,1620],"em",{},"This policy applies specifically to ZeroTrust. Other Entrinsia products, such as MementoBook, are governed by their own privacy policies.",{"title":359,"searchDepth":360,"depth":360,"links":1622},[1623,1624,1632,1637,1644,1653,1657,1663,1668,1674,1684,1690,1691,1697,1698,1699,1700,1701,1702],{"id":439,"depth":360,"text":440},{"id":501,"depth":360,"text":502,"children":1625},[1626,1628,1629,1630,1631],{"id":506,"depth":1627,"text":507},3,{"id":539,"depth":1627,"text":540},{"id":656,"depth":1627,"text":657},{"id":677,"depth":1627,"text":678},{"id":708,"depth":1627,"text":709},{"id":726,"depth":360,"text":727,"children":1633},[1634,1635,1636],{"id":730,"depth":1627,"text":731},{"id":751,"depth":1627,"text":752},{"id":772,"depth":1627,"text":773},{"id":792,"depth":360,"text":793,"children":1638},[1639,1640,1641,1642,1643],{"id":799,"depth":1627,"text":800},{"id":813,"depth":1627,"text":814},{"id":820,"depth":1627,"text":821},{"id":827,"depth":1627,"text":828},{"id":834,"depth":1627,"text":835},{"id":843,"depth":360,"text":844,"children":1645},[1646,1647,1648,1649,1650,1651,1652],{"id":850,"depth":1627,"text":851},{"id":871,"depth":1627,"text":872},{"id":902,"depth":1627,"text":903},{"id":937,"depth":1627,"text":938},{"id":961,"depth":1627,"text":962},{"id":968,"depth":1627,"text":969},{"id":975,"depth":1627,"text":976},{"id":984,"depth":360,"text":985,"children":1654},[1655,1656],{"id":991,"depth":1627,"text":992},{"id":1018,"depth":1627,"text":1019},{"id":1043,"depth":360,"text":1044,"children":1658},[1659,1660,1661,1662],{"id":1047,"depth":1627,"text":1048},{"id":1089,"depth":1627,"text":1090},{"id":1104,"depth":1627,"text":1105},{"id":1111,"depth":1627,"text":1112},{"id":1120,"depth":360,"text":1121,"children":1664},[1665,1666,1667],{"id":1124,"depth":1627,"text":1125},{"id":1131,"depth":1627,"text":1132},{"id":1164,"depth":1627,"text":1165},{"id":1178,"depth":360,"text":1179,"children":1669},[1670,1671,1672,1673],{"id":1185,"depth":1627,"text":1186},{"id":1192,"depth":1627,"text":1193},{"id":1213,"depth":1627,"text":1214},{"id":1246,"depth":1627,"text":1247},{"id":1258,"depth":360,"text":1259,"children":1675},[1676,1677,1678,1679,1680,1681,1682,1683],{"id":1265,"depth":1627,"text":1266},{"id":1272,"depth":1627,"text":1273},{"id":1279,"depth":1627,"text":1280},{"id":1289,"depth":1627,"text":1290},{"id":1296,"depth":1627,"text":1297},{"id":1303,"depth":1627,"text":1304},{"id":1310,"depth":1627,"text":1311},{"id":1317,"depth":1627,"text":1318},{"id":1330,"depth":360,"text":1331,"children":1685},[1686,1687,1688,1689],{"id":1337,"depth":1627,"text":1338},{"id":1371,"depth":1627,"text":1372},{"id":1382,"depth":1627,"text":1383},{"id":1389,"depth":1627,"text":1390},{"id":1402,"depth":360,"text":1403},{"id":1426,"depth":360,"text":1427,"children":1692},[1693,1694,1695,1696],{"id":1430,"depth":1627,"text":1431},{"id":1454,"depth":1627,"text":1455},{"id":1461,"depth":1627,"text":1462},{"id":1468,"depth":1627,"text":1469},{"id":1477,"depth":360,"text":1478},{"id":1517,"depth":360,"text":1518},{"id":1526,"depth":360,"text":1527},{"id":1535,"depth":360,"text":1536},{"id":1544,"depth":360,"text":1545},{"id":316,"depth":360,"text":317},{},"/legal/privacy/2026_10_01",{"title":387,"description":377},"legal/privacy/2026_10_01","9oeEkj7qA9yZ71Vz_YbsLutYQPe-bLaZm9IINKLpBYg",{"id":1709,"title":1710,"body":1711,"description":1942,"extension":378,"meta":1943,"navigation":380,"path":1944,"seo":1945,"stem":1946,"__hash__":1947},"legal/legal/subprocessors/2026_10_01.md","Subprocessor Directory — ZeroTrust",{"type":8,"value":1712,"toc":1933},[1713,1716,1725,1728,1731,1733,1737,1792,1794,1798,1801,1841,1843,1847,1854,1858,1869,1873,1876,1897,1899,1903,1906],[11,1714,1710],{"id":1715},"subprocessor-directory-zerotrust",[15,1717,1718,21,1720,26,1722,1724],{},[18,1719,20],{},[23,1721,25],{},[18,1723,29],{}," October 1, 2026",[15,1726,1727],{},"To deliver ZeroTrust, Entrinsia Inc. (\"Entrinsia,\" \"we,\" \"us,\" or \"our\") engages third-party infrastructure and service providers (\"Subprocessors\") to process End User personal data on behalf of our Business Customers (Data Controllers).",[15,1729,1730],{},"This page lists our active Subprocessors, the category of data each provider handles, the processing location, and how we govern these relationships.",[52,1732],{},[55,1734,1736],{"id":1735},"_1-active-subprocessors","1. Active Subprocessors",[324,1738,1739,1759],{},[327,1740,1741],{},[330,1742,1743,1747,1750,1753,1756],{},[333,1744,1746],{"align":1745},"left","Subprocessor",[333,1748,1749],{"align":1745},"Purpose & Processing Function",[333,1751,1752],{"align":1745},"Categories of Personal Data Handled",[333,1754,1755],{"align":1745},"Primary Processing Location",[333,1757,1758],{"align":1745},"Transfer Mechanism / Safeguards",[343,1760,1761],{},[330,1762,1763,1768,1771,1781,1789],{},[348,1764,1765],{"align":1745},[18,1766,1767],{},"Amazon Web Services, Inc. (AWS)",[348,1769,1770],{"align":1745},"Cloud infrastructure, compute, document OCR/authentication, facial liveness detection, and biometric comparison",[348,1772,1773,1774,1777,1778,1780],{"align":1745},"Raw ID images ",[1618,1775,1776],{},"(transient/in-memory only)",", video selfies ",[1618,1779,1776],{},", biometric confidence signals, extracted text fields, and encrypted compliance logs",[348,1782,1783,21,1786],{"align":1745},[18,1784,1785],{},"United States",[1618,1787,1788],{},"(US-East / US-West regions)",[348,1790,1791],{"align":1745},"EU Standard Contractual Clauses (SCCs), UK IDTA, AWS GDPR Data Processing Addendum",[52,1793],{},[55,1795,1797],{"id":1796},"_2-subprocessor-safeguards-obligations","2. Subprocessor Safeguards & Obligations",[15,1799,1800],{},"Every Subprocessor engaged by Entrinsia is vetted under our vendor security management program and bound by a written Data Processing Agreement (DPA) enforcing strict contractual protections:",[92,1802,1803,1813,1819,1829,1835],{},[95,1804,1805,1808,1809,1812],{},[18,1806,1807],{},"Strict Purpose Limitation:"," Subprocessors are contractually authorized to process End User data ",[18,1810,1811],{},"solely"," to deliver the verification service requested by Entrinsia and our Business Customers.",[95,1814,1815,1818],{},[18,1816,1817],{},"No AI Model Training:"," Subprocessors are strictly prohibited from retaining, archiving, or using End User ID images, video selfies, biometric comparisons, or extracted personal data to train or improve their own machine learning models or algorithms.",[95,1820,1821,1824,1825,1828],{},[18,1822,1823],{},"Ephemeral Data Handling:"," Cloud processing providers process ID images, video selfies, and biometric comparisons ",[18,1826,1827],{},"in-memory and in-transit only",". Media is never written to persistent disk, databases, or backup storage.",[95,1830,1831,1834],{},[18,1832,1833],{},"Confidentiality & Access Control:"," Subprocessor personnel are bound by statutory or contractual obligations of confidentiality, with logical access restricted under least-privilege role-based access control (RBAC).",[95,1836,1837,1840],{},[18,1838,1839],{},"Security Standards:"," Subprocessors must maintain industry-recognized security attestations (such as SOC 2 Type II and ISO/IEC 27001 certification) and implement technical safeguards including TLS encryption in transit and AES-256 encryption at rest.",[52,1842],{},[55,1844,1846],{"id":1845},"_3-subprocessor-change-notification-objection-rights","3. Subprocessor Change Notification & Objection Rights",[15,1848,1849,1850,1853],{},"Entrinsia maintains a ",[18,1851,1852],{},"30-day advance notice policy"," for any proposed addition or replacement of a Subprocessor that handles End User personal data.",[504,1855,1857],{"id":1856},"how-to-receive-notifications","How to Receive Notifications",[15,1859,1860,1861,1865,1866,197],{},"Business Customers can subscribe to automated Subprocessor update alerts by emailing ",[18,1862,1863],{},[191,1864,304],{"href":303}," with the subject line ",[23,1867,1868],{},"\"Subprocessor Notification Subscription\"",[504,1870,1872],{"id":1871},"right-to-object","Right to Object",[15,1874,1875],{},"In accordance with Section 16 of our Terms of Service and Section 6 of our Data Processing Addendum:",[1877,1878,1879,1886,1894],"ol",{},[95,1880,1881,1882,1885],{},"Business Customers will receive notification at least ",[18,1883,1884],{},"thirty (30) days"," prior to the engagement of any new Subprocessor.",[95,1887,1888,1889,1893],{},"A Customer may object to a new Subprocessor on reasonable data protection or security grounds by submitting a written objection to ",[18,1890,1891],{},[191,1892,304],{"href":303}," within the 30-day notice period.",[95,1895,1896],{},"If Entrinsia cannot reasonably accommodate or provide an alternative processing workflow, the Customer may terminate the affected portion of the Service without penalty and receive a pro-rata refund of any prepaid, unused fees.",[52,1898],{},[55,1900,1902],{"id":1901},"_4-revision-history","4. Revision History",[15,1904,1905],{},"Every published version of this document remains permanently archived.",[324,1907,1908,1920],{},[327,1909,1910],{},[330,1911,1912,1914,1917],{},[333,1913,335],{"align":1745},[333,1915,1916],{"align":1745},"Effective Date",[333,1918,1919],{"align":1745},"Summary of Changes",[343,1921,1922],{},[330,1923,1924,1928,1930],{},[348,1925,1926],{"align":1745},[23,1927,25],{},[348,1929,354],{"align":1745},[348,1931,1932],{"align":1745},"Initial publication of the ZeroTrust Subprocessor Directory.",{"title":359,"searchDepth":360,"depth":360,"links":1934},[1935,1936,1937,1941],{"id":1735,"depth":360,"text":1736},{"id":1796,"depth":360,"text":1797},{"id":1845,"depth":360,"text":1846,"children":1938},[1939,1940],{"id":1856,"depth":1627,"text":1857},{"id":1871,"depth":1627,"text":1872},{"id":1901,"depth":360,"text":1902},"Version: 2026-10-01  ·  Effective: October 1, 2026",{},"/legal/subprocessors/2026_10_01",{"title":1710,"description":1942},"legal/subprocessors/2026_10_01","wW_9_0VIQ3f-WwvlGg4_7qzIOlxXwrllllgNKqobrv8",{"id":1949,"title":1950,"body":1951,"description":377,"extension":378,"meta":2884,"navigation":380,"path":2885,"seo":2886,"stem":2887,"__hash__":2888},"legal/legal/terms/2026_10_01.md","Terms of Service — ZeroTrust",{"type":8,"value":1952,"toc":2788},[1953,1956,1966,1973,1976,1982,1995,1997,2001,2033,2035,2039,2042,2046,2049,2053,2073,2075,2079,2083,2086,2090,2093,2097,2105,2107,2111,2115,2122,2126,2129,2133,2136,2140,2143,2147,2150,2154,2157,2161,2164,2166,2170,2174,2177,2181,2184,2188,2191,2195,2198,2202,2205,2208,2211,2213,2217,2221,2228,2232,2235,2239,2242,2250,2254,2257,2268,2272,2275,2279,2282,2284,2288,2291,2317,2320,2322,2326,2329,2333,2340,2344,2347,2350,2353,2357,2360,2364,2367,2369,2373,2377,2380,2384,2391,2395,2398,2402,2405,2407,2411,2415,2418,2422,2425,2429,2432,2434,2438,2443,2446,2460,2462,2466,2470,2473,2477,2480,2484,2487,2491,2494,2496,2500,2503,2505,2509,2513,2516,2520,2523,2527,2530,2532,2536,2540,2545,2548,2552,2557,2561,2564,2567,2571,2574,2576,2580,2583,2590,2592,2596,2599,2601,2605,2608,2610,2614,2618,2621,2625,2628,2632,2635,2639,2642,2646,2654,2658,2661,2665,2668,2672,2675,2679,2682,2684,2688,2692,2695,2699,2704,2708,2711,2715,2722,2726,2729,2731,2735,2738,2744,2749,2751,2756,2758,2760,2764],[11,1954,1950],{"id":1955},"terms-of-service-zerotrust",[15,1957,1958,21,1960,26,1962,30,1964,34],{},[18,1959,20],{},[23,1961,25],{},[18,1963,29],{},[18,1965,33],{},[36,1967,1968],{},[15,1969,40,1970,44],{},[23,1971,1972],{},"zerotrust.entrinsia.com/terms/\u003Cversion>",[15,1974,1975],{},"These Terms of Service (\"Terms\") are a binding agreement between Entrinsia Inc. (\"Entrinsia,\" \"we,\" \"us,\" or \"our\") and the person or entity accessing or using ZeroTrust (the \"Customer,\" \"you,\" or \"your\"). They govern your access to and use of ZeroTrust, including our website, API, JavaScript widget, dashboard, and related documentation (collectively, the \"Service\").",[15,1977,1978,1981],{},[18,1979,1980],{},"By creating an account, subscribing via AWS Marketplace, integrating the Service into your website or application, or otherwise using the Service, you agree to these Terms."," If you are agreeing on behalf of a company or other legal entity, you represent that you have authority to bind that entity, and \"you\" refers to that entity. If you do not agree, do not use the Service.",[15,1983,1984,1985,1990,1991,1994],{},"Our collection and handling of personal data is described in our ",[191,1986,1989],{"href":1987,"rel":1988},"https://zerotrust.entrinsia.com/privacy-policy",[195],"Privacy Policy",". Our obligations to you as a processor of End User personal data are set out in our ",[191,1992,1014],{"href":1012,"rel":1993},[195],", which is incorporated into these Terms by reference.",[52,1996],{},[55,1998,2000],{"id":1999},"_1-definitions","1. Definitions",[92,2002,2003,2009,2015,2021,2027],{},[95,2004,2005,2008],{},[18,2006,2007],{},"\"End User\""," means an individual whose identity or age is verified through the Service as part of your website, app, or business process.",[95,2010,2011,2014],{},[18,2012,2013],{},"\"Verification Session\""," means one attempt by an End User to complete identity or age verification through the Service, as defined in Section 6.",[95,2016,2017,2020],{},[18,2018,2019],{},"\"Verification Result\""," means the data ZeroTrust returns to you following a Verification Session, for example a pass or fail result, an age-over-threshold confirmation, or other fields you have configured us to return.",[95,2022,2023,2026],{},[18,2024,2025],{},"\"Documentation\""," means our published technical documentation, integration guides, and API references, as updated from time to time.",[95,2028,2029,2032],{},[18,2030,2031],{},"\"Your Data\""," means data you submit to the Service in configuring or operating your account, such as domain registrations, configuration settings, and billing information. End User personal data is addressed separately in Section 9, the Privacy Policy, and the Data Processing Addendum.",[52,2034],{},[55,2036,2038],{"id":2037},"_2-the-service","2. The Service",[15,2040,2041],{},"ZeroTrust verifies a government-issued ID and confirms, through a live selfie, that the person submitting the ID is the person depicted on it and is physically present. Based on your configuration, ZeroTrust returns a Verification Result to you, which may be as simple as a pass or fail flag, or may include specific data fields extracted from the ID.",[504,2043,2045],{"id":2044},"_21-what-zerotrust-is","2.1 What ZeroTrust Is",[15,2047,2048],{},"A tool for real-time document authentication, liveness detection, and age and identity verification, supporting United States state driver's licences, state identification cards, and United States passports, as described in our Documentation. Where enabled for your account, ZeroTrust may also accept a mobile driver's licence or other digital identity credential presented from a device wallet, subject to these same Terms.",[504,2050,2052],{"id":2051},"_22-what-zerotrust-is-not","2.2 What ZeroTrust Is Not",[92,2054,2055,2061,2067],{},[95,2056,2057,2060],{},[18,2058,2059],{},"Not full \"Know Your Customer\" (KYC) compliance."," ZeroTrust does not retain identity records in the manner required for banking, money transmission, cryptocurrency, or similarly regulated KYC obligations. In particular, we do not retain dates of birth, readable document numbers, or street addresses. If your business requires traditional KYC recordkeeping, the Service will not satisfy your regulatory requirements on its own. Contact us before relying on it for that purpose.",[95,2062,2063,2066],{},[18,2064,2065],{},"Not legal advice, and not a compliance guarantee."," Using the Service does not, by itself, guarantee compliance with any law applicable to your business, including age-verification statutes, privacy laws, or industry-specific regulations. See Section 8.",[95,2068,2069,2072],{},[18,2070,2071],{},"Not infallible."," Identity verification technology, including liveness detection and document authentication, is not 100% accurate. See Section 11.",[52,2074],{},[55,2076,2078],{"id":2077},"_3-eligibility-and-accounts","3. Eligibility and Accounts",[504,2080,2082],{"id":2081},"_31-business-use-only","3.1 Business Use Only",[15,2084,2085],{},"The Service is intended for use by businesses and other organisations verifying their own End Users, not for personal, non-commercial use.",[504,2087,2089],{"id":2088},"_32-account-registration","3.2 Account Registration",[15,2091,2092],{},"To use the Service, you must register an account, register the domains from which you will call the Service, and provide accurate account and billing information. You are responsible for maintaining the confidentiality of your account credentials and API keys, and for all activity that occurs under your account, whether or not authorised by you.",[504,2094,2096],{"id":2095},"_33-notify-us-of-unauthorized-use","3.3 Notify Us of Unauthorized Use",[15,2098,2099,2100,2104],{},"You will notify us promptly at ",[18,2101,2102],{},[191,2103,304],{"href":303}," if you become aware of any unauthorised access to or use of your account.",[52,2106],{},[55,2108,2110],{"id":2109},"_4-fees-and-payment","4. Fees and Payment",[504,2112,2114],{"id":2113},"_41-pricing","4.1 Pricing",[15,2116,2117,2118,2121],{},"The Service is billed on a per-Verification-Session basis at the rate published at zerotrust.entrinsia.com/#pricing at the time of your subscription, currently ",[18,2119,2120],{},"$0.60 per billable Verification Session",", unless you have a separate signed agreement with different pricing. Pricing for usage exceeding 10,000 Verification Sessions per month is available by contacting us.",[504,2123,2125],{"id":2124},"_42-billing-method","4.2 Billing Method",[15,2127,2128],{},"You may pay for the Service either (a) directly, with Entrinsia invoicing you or charging a payment method on file, generally on a monthly basis for the prior month's usage, or (b) through AWS Marketplace, in which case billing terms are also subject to your AWS Marketplace agreement. If there is a conflict between AWS Marketplace's billing terms and these Terms regarding payment mechanics, AWS Marketplace's terms govern billing mechanics, while these Terms continue to govern your use of the Service itself.",[504,2130,2132],{"id":2131},"_43-what-youre-billed-for","4.3 What You're Billed For",[15,2134,2135],{},"You are billed for each billable Verification Session initiated through your account, as defined in Section 6, regardless of whether the result is a pass, a fail, or an abandonment after capture has begun.",[504,2137,2139],{"id":2138},"_44-free-verifications","4.4 Free Verifications",[15,2141,2142],{},"New accounts receive a set number of free Verification Sessions, currently 50, as described at the time of sign-up. Free Verification Sessions are subject to these Terms in all other respects.",[504,2144,2146],{"id":2145},"_45-no-refunds","4.5 No Refunds",[15,2148,2149],{},"Fees for billable Verification Sessions are non-refundable, except as required by law, as provided in Sections 5.4, 6.6 and 16, or as we otherwise agree in writing.",[504,2151,2153],{"id":2152},"_46-taxes","4.6 Taxes",[15,2155,2156],{},"Fees are exclusive of applicable taxes. You are responsible for any sales, use, VAT, or similar taxes associated with your use of the Service, other than taxes on Entrinsia's net income.",[504,2158,2160],{"id":2159},"_47-late-payment","4.7 Late Payment",[15,2162,2163],{},"Amounts not paid when due, for direct billing arrangements, may accrue interest at the lesser of 1.5% per month or the maximum rate permitted by law, and we may suspend the Service for non-payment after notice.",[52,2165],{},[55,2167,2169],{"id":2168},"_5-term-cancellation-and-suspension","5. Term, Cancellation, and Suspension",[504,2171,2173],{"id":2172},"_51-term","5.1 Term",[15,2175,2176],{},"These Terms remain in effect for as long as you maintain an account or otherwise use the Service.",[504,2178,2180],{"id":2179},"_52-cancellation","5.2 Cancellation",[15,2182,2183],{},"You may cancel your account at any time through your account settings, your AWS Marketplace subscription, or by contacting us. Cancellation takes effect at the end of the then-current billing period. There are no cancellation penalties, but fees already incurred remain payable.",[504,2185,2187],{"id":2186},"_53-suspension","5.3 Suspension",[15,2189,2190],{},"We may suspend or restrict your access to the Service, with notice where reasonably practicable, if (a) you fail to pay amounts due, (b) we reasonably believe your use of the Service violates Section 7 or poses a security risk, (c) we are required to do so to comply with law or a governmental request, or (d) continued provision of the Service to you would expose us to liability we reasonably consider unacceptable.",[504,2192,2194],{"id":2193},"_54-termination","5.4 Termination",[15,2196,2197],{},"Either party may terminate these Terms for the other party's uncured material breach following thirty (30) days' written notice, or immediately if the other party becomes insolvent or ceases operating in the ordinary course. We may also terminate these Terms on thirty (30) days' notice for convenience, in which case we will refund any prepaid, unused fees for future service.",[504,2199,2201],{"id":2200},"_55-effect-of-termination","5.5 Effect of Termination",[15,2203,2204],{},"Upon termination, your right to access the Service ends, and any amounts owed to us become immediately due.",[15,2206,2207],{},"Within thirty (30) days after termination, Entrinsia will delete Your Data and any End User verification data associated with your account, except for (a) compliance records that remain within their retention period under the Privacy Policy, which we retain so that you or we can evidence that verifications occurred, and (b) records we are required by law to retain. On written request made before termination takes effect, we will provide you with an export of the compliance records associated with your account in a machine-readable format.",[15,2209,2210],{},"Sections that by their nature should survive termination, including Sections 4, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, and 19, will survive.",[52,2212],{},[55,2214,2216],{"id":2215},"_6-verification-sessions","6. Verification Sessions",[504,2218,2220],{"id":2219},"_61-definition","6.1 Definition",[15,2222,2223,2224,2227],{},"A ",[18,2225,2226],{},"Verification Session"," is a single attempt by one End User to complete verification through your account. It begins when the verification flow is opened and ends when it returns a pass or fail result, is abandoned, or expires.",[504,2229,2231],{"id":2230},"_62-when-a-session-becomes-billable","6.2 When a Session Becomes Billable",[15,2233,2234],{},"A Verification Session becomes billable at the moment the Service first submits an image or video for processing. An End User who opens the verification flow and leaves without capturing anything does not create a billable Verification Session.",[504,2236,2238],{"id":2237},"_63-one-session","6.3 One Session",[15,2240,2241],{},"The following count as a single billable Verification Session:",[92,2243,2244,2247],{},[95,2245,2246],{},"Repeated attempts by the same End User against the same transaction or order reference within sixty (60) minutes, where the repeat follows a failed capture, an unreadable image, or a network interruption;",[95,2248,2249],{},"A verification begun on a desktop and completed on a phone through our device handoff.",[504,2251,2253],{"id":2252},"_64-separate-sessions","6.4 Separate Sessions",[15,2255,2256],{},"The following count as separate billable Verification Sessions:",[92,2258,2259,2262,2265],{},[95,2260,2261],{},"Attempts against different transaction or order references;",[95,2263,2264],{},"A further attempt by the same End User more than sixty (60) minutes after the previous attempt;",[95,2266,2267],{},"A further attempt following a completed pass or fail result, where you permit the End User to try again.",[504,2269,2271],{"id":2270},"_65-billed-regardless-of-outcome","6.5 Billed Regardless of Outcome",[15,2273,2274],{},"You are billed for each billable Verification Session whether it results in a pass, a fail, or an abandonment after capture has begun. A failed session has performed the Service's function by identifying a non-matching or fraudulent attempt.",[504,2276,2278],{"id":2277},"_66-changes","6.6 Changes",[15,2280,2281],{},"We may change this Section on thirty (30) days' notice. If a change would increase the number of Verification Sessions billed for the same volume of End User activity, you may terminate without penalty before it takes effect, and the refund provision in Section 5.4 applies.",[52,2283],{},[55,2285,2287],{"id":2286},"_7-acceptable-use","7. Acceptable Use",[15,2289,2290],{},"You will not, and will not permit any third party to:",[92,2292,2293,2296,2299,2302,2305,2308,2311,2314],{},[95,2294,2295],{},"Use the Service for any unlawful purpose, or to facilitate fraud, discrimination, or harassment",[95,2297,2298],{},"Use the Service to verify an individual without that individual's knowledge, where such knowledge is legally required, or in a manner inconsistent with the notice and consent obligations in Section 8",[95,2300,2301],{},"Attempt to reverse-engineer, decompile, or extract the underlying models, algorithms, or biometric processing techniques used by the Service",[95,2303,2304],{},"Attempt to circumvent, probe, or test the security of the Service other than through a good-faith, coordinated disclosure process",[95,2306,2307],{},"Introduce malware, or interfere with or disrupt the integrity or performance of the Service",[95,2309,2310],{},"Use the Service to build a directly competing product or service, or to benchmark the Service publicly without our prior written consent",[95,2312,2313],{},"Exceed reasonable rate limits or attempt to bypass usage-based billing",[95,2315,2316],{},"Misrepresent your identity, your business, or the domains from which you are authorised to call the Service",[15,2318,2319],{},"We may investigate and take appropriate action, including suspension under Section 5.3, for suspected violations of this Section.",[52,2321],{},[55,2323,2325],{"id":2324},"_8-your-compliance-responsibilities","8. Your Compliance Responsibilities",[15,2327,2328],{},"This section is important, and we want to be direct about it.",[504,2330,2332],{"id":2331},"_81-you-are-responsible-for-your-own-compliance","8.1 You Are Responsible for Your Own Compliance",[15,2334,2335,2336,2339],{},"You are solely responsible for determining whether, and how, your use of the Service satisfies any law, regulation, or industry requirement applicable to your business, including age-verification statutes such as California AB 1263 or similar laws in other states, general privacy laws such as the CCPA and the GDPR, and biometric privacy laws such as BIPA. ",[18,2337,2338],{},"Entrinsia is not a law firm, does not provide legal advice, and nothing in the Service, our Documentation, our marketing materials, or any communication from us should be construed as legal advice or a guarantee of compliance."," You should consult your own legal counsel regarding your specific obligations.",[504,2341,2343],{"id":2342},"_82-notice-and-consent-to-end-users","8.2 Notice and Consent to End Users",[15,2345,2346],{},"ZeroTrust displays a biometric notice to every End User before it requests camera access, and requires the End User to accept that notice before any image or video is captured. The notice is described in Section 9.3 of our Privacy Policy. It covers the biometric processing that ZeroTrust itself performs. We retain a record of each acceptance, including the version of the notice shown and the time of acceptance, and we will make that record available to you on request for verifications run under your account.",[15,2348,2349],{},"That notice does not, and is not intended to, satisfy every notice or consent obligation that applies to you. You remain responsible for providing End Users with any notice, and obtaining any consent or written release, that applicable law requires of you. This includes any disclosure specific to your industry or jurisdiction, any disclosure required by the age-verification statute you are relying on, and any written release required of you as the party collecting biometric identifiers under a state biometric privacy statute.",[15,2351,2352],{},"If you are uncertain whether the notice built into ZeroTrust is sufficient for your circumstances, you should assume that it is not, and obtain your own.",[504,2354,2356],{"id":2355},"_83-use-of-verification-results","8.3 Use of Verification Results",[15,2358,2359],{},"You are responsible for how you use, store, and act on Verification Results after we return them to you, including any further retention obligations that apply to your business once data is in your possession. Our own retention practices are described in the Privacy Policy and do not extend to data you separately store.",[504,2361,2363],{"id":2362},"_84-age-thresholds-and-document-types","8.4 Age Thresholds and Document Types",[15,2365,2366],{},"You are responsible for configuring the correct age threshold and accepted document types for your use case, and for confirming that configuration meets your legal requirements.",[52,2368],{},[55,2370,2372],{"id":2371},"_9-data-protection","9. Data Protection",[504,2374,2376],{"id":2375},"_91-roles","9.1 Roles",[15,2378,2379],{},"With respect to End User verification data, Entrinsia acts as a processor and you act as the controller. We process that data only on your documented instructions, which for these purposes comprise these Terms, the Data Processing Addendum, and the configuration you set for your account.",[504,2381,2383],{"id":2382},"_92-processing-addendum","9.2 Processing Addendum",[15,2385,2386,2387,2390],{},"Our obligations as a processor are set out in the Data Processing Addendum at ",[191,2388,1379],{"href":1012,"rel":2389},[195],", which is incorporated into these Terms by reference. Where that Addendum and these Terms conflict in respect of the processing of personal data, the Addendum controls.",[504,2392,2394],{"id":2393},"_93-privacy-policy","9.3 Privacy Policy",[15,2396,2397],{},"Our collection, use, retention, and deletion of data is described in our Privacy Policy. We may update that policy as described in it. We will not make a change that materially reduces the protections applying to End User data already collected under your account without giving you prior notice, and where such a change would materially reduce those protections going forward we will give you at least thirty (30) days' notice before it takes effect.",[504,2399,2401],{"id":2400},"_94-breach-notification","9.4 Breach Notification",[15,2403,2404],{},"We will notify you without undue delay, and in any event within seventy-two (72) hours of becoming aware, of any personal data breach affecting End User data processed for you, and will provide the information you reasonably require in order to meet your own notification obligations.",[52,2406],{},[55,2408,2410],{"id":2409},"_10-service-availability","10. Service Availability",[504,2412,2414],{"id":2413},"_101-target-availability","10.1 Target Availability",[15,2416,2417],{},"We target 99.9% monthly uptime for the Service's API and widget, excluding scheduled maintenance, for which we will provide advance notice where practicable, and events outside our reasonable control (see Section 18). We will notify affected Customers of significant service disruptions by email or through the Service. This target is an operational goal, not a binding service-level guarantee, unless you have a separate signed agreement that includes a specific SLA with associated remedies.",[504,2419,2421],{"id":2420},"_102-fallback-behavior","10.2 Fallback Behavior",[15,2423,2424],{},"You are responsible for configuring appropriate fallback behaviour in your own application for periods when the Service is unavailable, for example queuing verifications, routing to manual review, or otherwise handling End Users appropriately, consistent with your own compliance obligations under Section 8.",[504,2426,2428],{"id":2427},"_103-security-and-compliance-documentation","10.3 Security and Compliance Documentation",[15,2430,2431],{},"Upon reasonable written request, no more than once per calendar year, Entrinsia will provide an executive summary of then-available third-party security audit reports, such as a SOC 2 report if and when obtained, or other compliance documentation reasonably requested to support your own compliance review. This Section applies to Customers with a current subscription, and to prospective Customers evaluating the Service under a mutual non-disclosure agreement. Any such materials are Confidential Information under Section 13 and may be shared only with your personnel and advisors who need them for that purpose. This Section does not obligate Entrinsia to obtain any particular certification or audit it does not otherwise choose to pursue.",[52,2433],{},[55,2435,2437],{"id":2436},"_11-disclaimers","11. Disclaimers",[15,2439,2440],{},[18,2441,2442],{},"THE SERVICE, INCLUDING ALL VERIFICATION RESULTS, IS PROVIDED \"AS IS\" AND \"AS AVAILABLE,\" WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.",[15,2444,2445],{},"Without limiting the foregoing, we do not warrant that:",[92,2447,2448,2451,2454,2457],{},[95,2449,2450],{},"The Service will be uninterrupted, error-free, or secure",[95,2452,2453],{},"Any Verification Result will be accurate in every instance. Identity verification and liveness detection technology, including ours, can produce false positives and false negatives, and a pass result is not a guarantee that a submitted document or selfie is genuine",[95,2455,2456],{},"The Service will detect every instance of fraud, document forgery, or spoofing",[95,2458,2459],{},"The Service satisfies the specific legal or regulatory requirements applicable to your business (see Section 8)",[52,2461],{},[55,2463,2465],{"id":2464},"_12-intellectual-property","12. Intellectual Property",[504,2467,2469],{"id":2468},"_121-our-ip","12.1 Our IP",[15,2471,2472],{},"The Service, including its underlying software, models, documentation, and branding, is owned by Entrinsia or our licensors and is protected by intellectual property laws. Subject to your compliance with these Terms, we grant you a limited, non-exclusive, non-transferable, revocable licence to access and use the Service during the term of these Terms, solely for your internal business purposes.",[504,2474,2476],{"id":2475},"_122-your-ip-and-your-instructions","12.2 Your IP and Your Instructions",[15,2478,2479],{},"You retain all rights to Your Data and to your own website, application, and branding. You grant us a limited licence to use Your Data solely as necessary to provide the Service to you. You instruct us to process End User personal data as necessary to perform verifications for you and to meet our obligations under these Terms and the Data Processing Addendum, and you represent that you have the authority to give that instruction.",[504,2481,2483],{"id":2482},"_123-feedback","12.3 Feedback",[15,2485,2486],{},"If you provide feedback or suggestions about the Service, we may use them without restriction or obligation to you.",[504,2488,2490],{"id":2489},"_124-no-model-training","12.4 No Model Training",[15,2492,2493],{},"Entrinsia will not use Your Data, End User ID images, video selfies, biometric data, or any data extracted from an ID to train or improve any machine learning model, whether our own or a third party's. Our agreements with the cloud processing providers described in Section 16 impose the same restriction on them. We may use aggregated, de-identified operational metrics, such as error rates, processing latency, and step completion rates, to improve the Service.",[52,2495],{},[55,2497,2499],{"id":2498},"_13-confidentiality","13. Confidentiality",[15,2501,2502],{},"Each party may have access to the other's non-public business, technical, or financial information (\"Confidential Information\"). Each party agrees to use the other's Confidential Information only to perform its obligations under these Terms, and to protect it using at least the same degree of care it uses for its own confidential information of similar importance, but no less than reasonable care. This Section does not apply to information that is or becomes public through no fault of the receiving party, was already known to the receiving party without restriction, or is independently developed. Either party may disclose Confidential Information as required by law, provided it gives the other party reasonable notice where legally permitted.",[52,2504],{},[55,2506,2508],{"id":2507},"_14-indemnification","14. Indemnification",[504,2510,2512],{"id":2511},"_141-your-indemnification-of-entrinsia","14.1 Your Indemnification of Entrinsia",[15,2514,2515],{},"You will defend, indemnify, and hold harmless Entrinsia and its officers, directors, employees, and agents from and against any third-party claims, damages, liabilities, costs, and expenses, including reasonable attorneys' fees, arising out of or related to: (a) your actual or alleged non-compliance with any law applicable to your use of the Service, including age-verification or privacy laws; (b) your failure to provide required notice or obtain required consent from End Users; (c) your use of Verification Results, including decisions made or not made based on a Verification Result; (d) Your Data or your instructions to us; or (e) your violation of these Terms.",[504,2517,2519],{"id":2518},"_142-our-indemnification-of-you","14.2 Our Indemnification of You",[15,2521,2522],{},"We will defend, indemnify, and hold you harmless from third-party claims that the Service, as provided by us and used in accordance with these Terms, infringes a third party's US intellectual property rights, and will pay resulting damages finally awarded, subject to Section 15. This obligation does not apply to claims arising from your modification of the Service, your combination of the Service with other products not provided by us, or your use of the Service in violation of these Terms.",[504,2524,2526],{"id":2525},"_143-process","14.3 Process",[15,2528,2529],{},"The indemnified party will promptly notify the indemnifying party of any claim, give the indemnifying party control of the defence and settlement, except that any settlement requiring the indemnified party to admit fault or take action must be approved by the indemnified party, and provide reasonable cooperation at the indemnifying party's expense.",[52,2531],{},[55,2533,2535],{"id":2534},"_15-limitation-of-liability","15. Limitation of Liability",[504,2537,2539],{"id":2538},"_151-exclusion-of-certain-damages","15.1 Exclusion of Certain Damages",[15,2541,2542],{},[18,2543,2544],{},"TO THE FULLEST EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOSS OF DATA, OR BUSINESS INTERRUPTION, ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE, REGARDLESS OF THE THEORY OF LIABILITY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.",[15,2546,2547],{},"Without limiting the foregoing, Entrinsia is not liable for regulatory fines or penalties assessed against you, costs of any recall, credit monitoring, or breach notification you undertake, or damages arising from your failure to satisfy your compliance responsibilities under Section 8.",[504,2549,2551],{"id":2550},"_152-liability-cap","15.2 Liability Cap",[15,2553,2554],{},[18,2555,2556],{},"TO THE FULLEST EXTENT PERMITTED BY LAW, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS WILL NOT EXCEED THE GREATER OF (A) THE FEES YOU PAID TO ENTRINSIA IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (B) ONE THOUSAND DOLLARS ($1,000).",[504,2558,2560],{"id":2559},"_153-exceptions","15.3 Exceptions",[15,2562,2563],{},"The limitation in Section 15.2 does not apply to: (a) your indemnification obligations under Section 14.1; (b) your payment obligations under Section 4; (c) either party's breach of Section 13; or (d) either party's gross negligence, willful misconduct, or fraud.",[15,2565,2566],{},"Entrinsia's indemnification obligations under Section 14.2 are not subject to Section 15.2, but are subject to a separate aggregate cap equal to the greater of (i) three (3) times the fees you paid to Entrinsia in the twelve (12) months preceding the first claim under Section 14.2, or (ii) fifty thousand dollars ($50,000).",[504,2568,2570],{"id":2569},"_154-basis-of-the-bargain","15.4 Basis of the Bargain",[15,2572,2573],{},"The parties acknowledge that the fees charged for the Service reflect the allocation of risk in this Section 15, and that this allocation is an essential basis of the parties' agreement.",[52,2575],{},[55,2577,2579],{"id":2578},"_16-third-party-services-and-subprocessors","16. Third-Party Services and Subprocessors",[15,2581,2582],{},"The Service relies on third-party infrastructure and AI processing providers, currently Amazon Web Services, to perform document authentication, liveness detection, and facial comparison, under contract terms consistent with those described in our Privacy Policy and our Data Processing Addendum. We are not responsible for the availability or performance of third-party services outside our control, except to the extent caused by our failure to properly configure or maintain our use of them.",[15,2584,2585,2586,2589],{},"We maintain a current list of the subprocessors that process End User personal data at ",[191,2587,196],{"href":193,"rel":2588},[195],". We will give you at least thirty (30) days' notice before adding or replacing a subprocessor that processes End User personal data. If within that period you object on reasonable data protection grounds, and we cannot make available a commercially reasonable alternative, you may terminate the affected portion of the Service without penalty and receive a refund of any prepaid, unused fees. We impose on each subprocessor obligations no less protective than those in our Data Processing Addendum, and we remain responsible to you for each subprocessor's performance.",[52,2591],{},[55,2593,2595],{"id":2594},"_17-export-control","17. Export Control",[15,2597,2598],{},"The Service may be subject to US export control and economic sanctions laws. You represent that you are not located in, or a national or resident of, any country subject to a US embargo, and are not on any US government restricted-party list. You will not use the Service in violation of applicable export control or sanctions laws.",[52,2600],{},[55,2602,2604],{"id":2603},"_18-force-majeure","18. Force Majeure",[15,2606,2607],{},"Neither party is liable for any failure or delay in performance, other than payment obligations, resulting from causes beyond its reasonable control, including natural disasters, war, terrorism, labour disputes, internet or utility failures, acts of government, or failures of third-party infrastructure providers such as AWS.",[52,2609],{},[55,2611,2613],{"id":2612},"_19-general-provisions","19. General Provisions",[504,2615,2617],{"id":2616},"_191-governing-law-and-venue","19.1 Governing Law and Venue",[15,2619,2620],{},"These Terms are governed by the laws of the State of Delaware, without regard to conflict of laws principles. For any dispute not subject to arbitration under Section 20, the parties consent to the exclusive jurisdiction and venue of the state and federal courts located in Santa Clara County, California, and waive any objection to venue there.",[504,2622,2624],{"id":2623},"_192-modifications-to-these-terms","19.2 Modifications to These Terms",[15,2626,2627],{},"We may update these Terms from time to time. For material changes, we will provide notice through the Service, by email, or by publishing a new version with a new effective date. Continued use of the Service after changes take effect constitutes acceptance. If you do not agree to updated Terms, your remedy is to stop using the Service and cancel your account.",[504,2629,2631],{"id":2630},"_193-modifications-to-the-service","19.3 Modifications to the Service",[15,2633,2634],{},"We may modify, update, or discontinue features of the Service from time to time. We will provide reasonable advance notice of any change that materially reduces core functionality you rely on, where practicable.",[504,2636,2638],{"id":2637},"_194-assignment","19.4 Assignment",[15,2640,2641],{},"You may not assign these Terms without our prior written consent, except to a successor in a merger, acquisition, or sale of substantially all assets, provided the successor is not a direct competitor of Entrinsia. We may assign these Terms without restriction. Any attempted assignment in violation of this Section is void.",[504,2643,2645],{"id":2644},"_195-notices","19.5 Notices",[15,2647,2648,2649,2653],{},"We may provide notice to you via the email address associated with your account or through the Service. You may provide notice to us at ",[18,2650,2651],{},[191,2652,304],{"href":303},", or in writing to the address in Section 21.",[504,2655,2657],{"id":2656},"_196-severability","19.6 Severability",[15,2659,2660],{},"If any provision of these Terms is held unenforceable, the remaining provisions will remain in full force and effect, and the unenforceable provision will be modified to the minimum extent necessary to make it enforceable.",[504,2662,2664],{"id":2663},"_197-no-waiver","19.7 No Waiver",[15,2666,2667],{},"Failure to enforce any provision of these Terms is not a waiver of our right to enforce it later.",[504,2669,2671],{"id":2670},"_198-entire-agreement","19.8 Entire Agreement",[15,2673,2674],{},"These Terms, together with the Privacy Policy, the Data Processing Addendum, and any Documentation incorporated by reference, constitute the entire agreement between you and Entrinsia regarding the Service, and supersede any prior agreements regarding the same subject matter, except that a separately signed written agreement between you and Entrinsia, such as a negotiated subscription agreement, will govern to the extent it conflicts with these Terms.",[504,2676,2678],{"id":2677},"_199-relationship-of-the-parties","19.9 Relationship of the Parties",[15,2680,2681],{},"The parties are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency, or employment relationship.",[52,2683],{},[55,2685,2687],{"id":2686},"_20-dispute-resolution-and-arbitration","20. Dispute Resolution and Arbitration",[504,2689,2691],{"id":2690},"_201-agreement-to-arbitrate","20.1 Agreement to Arbitrate",[15,2693,2694],{},"Except for claims that may be brought in small claims court, and except as provided in Section 20.3, you and Entrinsia agree that any dispute arising out of or relating to these Terms or the Service will be resolved through binding arbitration rather than in court, on an individual basis.",[504,2696,2698],{"id":2697},"_202-class-action-waiver","20.2 Class Action Waiver",[15,2700,2701],{},[18,2702,2703],{},"YOU AND ENTRINSIA AGREE THAT EACH MAY BRING CLAIMS AGAINST THE OTHER ONLY IN AN INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS OR REPRESENTATIVE PROCEEDING.",[504,2705,2707],{"id":2706},"_203-exceptions","20.3 Exceptions",[15,2709,2710],{},"Either party may bring an individual action in court seeking injunctive or other equitable relief for actual or threatened infringement, misappropriation, or violation of a party's intellectual property or confidentiality rights.",[504,2712,2714],{"id":2713},"_204-procedure","20.4 Procedure",[15,2716,2717,2718,2721],{},"Unless a separately signed order form or enterprise agreement between you and Entrinsia designates a different administrator, arbitration will be administered by ",[18,2719,2720],{},"JAMS"," under its Comprehensive Arbitration Rules and Procedures then in effect. The arbitration will be seated in Santa Clara County, California, and governed by the substantive law specified in Section 19.1.",[504,2723,2725],{"id":2724},"_205-end-users-are-not-parties","20.5 End Users Are Not Parties",[15,2727,2728],{},"End Users are not parties to these Terms. Nothing in this Section 20 limits any right of an End User, and no End User is required by these Terms to arbitrate any claim. As between you and Entrinsia, claims brought by an End User arising from your notice or consent practices, or from your use of a Verification Result, are allocated by Sections 14 and 15.",[52,2730],{},[55,2732,2734],{"id":2733},"_21-contact-information","21. Contact Information",[15,2736,2737],{},"If you have questions about these Terms, contact us at:",[15,2739,2740,21,2742],{},[18,2741,300],{},[191,2743,304],{"href":303},[15,2745,2746,2748],{},[18,2747,310],{},"\nEntrinsia Inc.\n559 S El Monte Ave\nLos Altos, CA 94022",[52,2750],{},[15,2752,2753],{},[1618,2754,2755],{},"These Terms apply specifically to ZeroTrust. Other Entrinsia products, such as MementoBook, are governed by their own terms of service. If you have a separately signed subscription agreement with Entrinsia for ZeroTrust that conflicts with these Terms, that agreement controls.",[52,2757],{},[55,2759,317],{"id":316},[15,2761,320,2762,197],{},[23,2763,1972],{},[324,2765,2766,2776],{},[327,2767,2768],{},[330,2769,2770,2772,2774],{},[333,2771,335],{},[333,2773,338],{},[333,2775,341],{},[343,2777,2778],{},[330,2779,2780,2784,2786],{},[348,2781,2782],{},[23,2783,25],{},[348,2785,354],{},[348,2787,357],{},{"title":359,"searchDepth":360,"depth":360,"links":2789},[2790,2791,2795,2800,2809,2816,2824,2825,2831,2837,2842,2843,2849,2850,2855,2861,2862,2863,2864,2875,2882,2883],{"id":1999,"depth":360,"text":2000},{"id":2037,"depth":360,"text":2038,"children":2792},[2793,2794],{"id":2044,"depth":1627,"text":2045},{"id":2051,"depth":1627,"text":2052},{"id":2077,"depth":360,"text":2078,"children":2796},[2797,2798,2799],{"id":2081,"depth":1627,"text":2082},{"id":2088,"depth":1627,"text":2089},{"id":2095,"depth":1627,"text":2096},{"id":2109,"depth":360,"text":2110,"children":2801},[2802,2803,2804,2805,2806,2807,2808],{"id":2113,"depth":1627,"text":2114},{"id":2124,"depth":1627,"text":2125},{"id":2131,"depth":1627,"text":2132},{"id":2138,"depth":1627,"text":2139},{"id":2145,"depth":1627,"text":2146},{"id":2152,"depth":1627,"text":2153},{"id":2159,"depth":1627,"text":2160},{"id":2168,"depth":360,"text":2169,"children":2810},[2811,2812,2813,2814,2815],{"id":2172,"depth":1627,"text":2173},{"id":2179,"depth":1627,"text":2180},{"id":2186,"depth":1627,"text":2187},{"id":2193,"depth":1627,"text":2194},{"id":2200,"depth":1627,"text":2201},{"id":2215,"depth":360,"text":2216,"children":2817},[2818,2819,2820,2821,2822,2823],{"id":2219,"depth":1627,"text":2220},{"id":2230,"depth":1627,"text":2231},{"id":2237,"depth":1627,"text":2238},{"id":2252,"depth":1627,"text":2253},{"id":2270,"depth":1627,"text":2271},{"id":2277,"depth":1627,"text":2278},{"id":2286,"depth":360,"text":2287},{"id":2324,"depth":360,"text":2325,"children":2826},[2827,2828,2829,2830],{"id":2331,"depth":1627,"text":2332},{"id":2342,"depth":1627,"text":2343},{"id":2355,"depth":1627,"text":2356},{"id":2362,"depth":1627,"text":2363},{"id":2371,"depth":360,"text":2372,"children":2832},[2833,2834,2835,2836],{"id":2375,"depth":1627,"text":2376},{"id":2382,"depth":1627,"text":2383},{"id":2393,"depth":1627,"text":2394},{"id":2400,"depth":1627,"text":2401},{"id":2409,"depth":360,"text":2410,"children":2838},[2839,2840,2841],{"id":2413,"depth":1627,"text":2414},{"id":2420,"depth":1627,"text":2421},{"id":2427,"depth":1627,"text":2428},{"id":2436,"depth":360,"text":2437},{"id":2464,"depth":360,"text":2465,"children":2844},[2845,2846,2847,2848],{"id":2468,"depth":1627,"text":2469},{"id":2475,"depth":1627,"text":2476},{"id":2482,"depth":1627,"text":2483},{"id":2489,"depth":1627,"text":2490},{"id":2498,"depth":360,"text":2499},{"id":2507,"depth":360,"text":2508,"children":2851},[2852,2853,2854],{"id":2511,"depth":1627,"text":2512},{"id":2518,"depth":1627,"text":2519},{"id":2525,"depth":1627,"text":2526},{"id":2534,"depth":360,"text":2535,"children":2856},[2857,2858,2859,2860],{"id":2538,"depth":1627,"text":2539},{"id":2550,"depth":1627,"text":2551},{"id":2559,"depth":1627,"text":2560},{"id":2569,"depth":1627,"text":2570},{"id":2578,"depth":360,"text":2579},{"id":2594,"depth":360,"text":2595},{"id":2603,"depth":360,"text":2604},{"id":2612,"depth":360,"text":2613,"children":2865},[2866,2867,2868,2869,2870,2871,2872,2873,2874],{"id":2616,"depth":1627,"text":2617},{"id":2623,"depth":1627,"text":2624},{"id":2630,"depth":1627,"text":2631},{"id":2637,"depth":1627,"text":2638},{"id":2644,"depth":1627,"text":2645},{"id":2656,"depth":1627,"text":2657},{"id":2663,"depth":1627,"text":2664},{"id":2670,"depth":1627,"text":2671},{"id":2677,"depth":1627,"text":2678},{"id":2686,"depth":360,"text":2687,"children":2876},[2877,2878,2879,2880,2881],{"id":2690,"depth":1627,"text":2691},{"id":2697,"depth":1627,"text":2698},{"id":2706,"depth":1627,"text":2707},{"id":2713,"depth":1627,"text":2714},{"id":2724,"depth":1627,"text":2725},{"id":2733,"depth":360,"text":2734},{"id":316,"depth":360,"text":317},{},"/legal/terms/2026_10_01",{"title":1950,"description":377},"legal/terms/2026_10_01","WvnJJwc4McCkgfG8T8pLCvVymJ_7fmouUgdxaglWRvI",1791485240782]