Biometric data retention and destruction policy

This policy is published by Surf Platforms Inc., a corporation organized under the laws of the State of Delaware with its principal place of business in San Jose, California (“Elsin”, “we”). It sets out our retention schedule and guidelines for permanently destroying biometric identifiers and biometric information, as required by the Illinois Biometric Information Privacy Act (740 ILCS 14/15(a)), and as relevant to the Texas Capture or Use of Biometric Identifier Act, the Washington biometric identifiers law (RCW 19.375) and similar laws.

It applies to the identity checks in Elsin that use a person's face: the standard verification, the check at interview, and the day-one check. It applies to every candidate and new hire who uses them, whichever employer asked. The privacy policy covers all other personal data.

Done on the device, never sent to Elsin

• Camera frames used to follow the head as it turns.
• The photo of the ID document.
• The face measurements (a numeric description of each face) the device computes to compare the live face with the ID photo. They exist only in the browser's memory during the check and are dropped.

Received and kept by Elsin (“Biometric Data”)

Whether or not each item is a “biometric identifier” or “biometric information” under a given law, we treat both as Biometric Data under this policy.

Not Biometric Data

• The outcome of the comparison (matched, inconclusive or not matched) and whether a person is verified. These are results, shared with the employers the person chooses. The outcome of a day-one check is still deleted no later than 3 years after the check.
• A keyed code made from the ID number, which reveals nothing about the face.

We use Biometric Data only to:

• confirm that a real person is present during the check, rather than a photo, a video or a bot;
• confirm that the person's face matches the photo on their ID;
• confirm, at interview or on the first day of work, that it is the same person who verified;
• investigate and defend a disputed result, for as long as this policy allows us to keep it.

We do not use it for any other purpose, including advertising, profiling, or training models.

Before any Biometric Data is collected, Elsin tells the person in writing that the check uses their face, what it is for, what is kept, and for how long, and asks for their written consent. We record the version of the notice they agreed to and when. The check runs only if consent was given within the hour before it starts.

Nobody has to use the face check. A person can instead send a photo of their ID for a person at the employer to review, which uses no face check (section 9).

We do not sell, lease, trade or otherwise profit from Biometric Data. We do not disclose, redisclose or disseminate it, except:

• to Supabase, which stores it for us as our sub-processor (see sub-processors);
• where the person consents, which for employers covers only the outcome described in section 2, never the Biometric Data itself;
• where required by law, or by a valid warrant or subpoena.

We permanently destroy Biometric Data at the earliest of these events:

If we receive a valid legal hold, warrant or subpoena that covers specific Biometric Data, we keep only that data, only for as long as the law requires, and then destroy it.

Destruction means permanently deleting the record from Elsin's production database. Deleted data then rolls off the database backups held by our hosting provider within 7 days, as those backups expire. Every destruction deadline in this policy includes that roll-off. We do not restore Biometric Data from a backup after it is due for destruction; if a backup is ever restored, we delete it again before the system goes back into use.

• Biometric Data is stored in tables that database rules let only the person it belongs to read, or, for head-turn measurements, only Elsin's servers. No employer account can read either.
• It is protected with the same care, or more, as the other confidential and sensitive information we hold, and in line with the standard of care in our industry.
• Connections to Elsin use HTTPS.

A person who prefers not to use the face check may upload a photo of their ID for a reviewer at each employer to look at. No face measurement is made. A separate copy is kept for each employer, in private storage, and deleted as soon as that employer's reviewer decides, and in any case within 30 days of upload. Although a photograph is not a biometric identifier under Illinois law, we apply this policy's protections to it.

To withdraw consent, open Your data in your Elsin account and choose Withdraw and delete. Elsin records the withdrawal and at once destroys your Biometric Data, your verification record and any ID photo still waiting for review. Deleting your Elsin account destroys it too. You can also download what we hold in the app. To ask a question, or to withdraw or have it destroyed by email, write to contact@surfplatforms.com; we may need to confirm who you are first.

Surf Platforms Inc. reviews this policy at least once a year and whenever the identity check changes. We publish each change here with a new date. If a change would let us use or keep Biometric Data in a new way, we will ask for consent again before it applies.