Client portal

Privacy policy

Updated on October 23, 2026

Last updated: 20 October 2026

VerifAge was designed to prove that you are of legal age while collecting as little data as possible. This policy explains, in plain terms, which data we process, why, for how long, and what your rights are.

It applies to the website verifage.com, the platform app.verifage.com and the VerifAge mobile application (iOS and Android).

1. Who is responsible for your data?

  • SAS INOVA DIGI-TECH
  • 16 rue de la Côte – Bâtiment D1 – 54000 Nancy, France
  • RCS Nancy 918 907 809 – SIRET 918 907 809 00027
  • E-mail: contact@verifage.com – Telephone: +33 6 26 44 26 99

Data protection officer (DPO): Mr Kamaloddin SHAYKHIAN – dpo@verifage.com

2. Our commitments in brief

  • We ask neither for your surname nor for your first name.
  • The video of your face and the photograph of your identity document are deleted as soon as the operator has made a decision, and at the latest 15 days after they are sent.
  • We do not know on which websites, vending machines or points of sale you prove that you are of legal age: we keep no history of your uses.
  • Partner websites and vending machines receive only the information “of legal age”, never your identity.
  • Your data is never sold or used for advertising purposes.

3. Which data do we collect?

3.1 If you are a User

  • Account data: e-mail address, telephone number, date of birth.
  • Validation data: registration date, chosen validation method, account status (pending, verified, refused, suspended).
  • Method 1 (video) only: a video of your face and a photograph of your identity document, kept temporarily for the duration of the check.
  • Method 3 (France Identité): only the attestation that you are over 18 years of age.
  • Technical data: device identifier for notifications, connection and security data (IP address, technical logs), application crash reports.

3.2 If you are a Business customer or the holder of an Operator account

  • Company data: company name, SIRET, address, VAT number.
  • Contact data: surname, first name, position, e-mail address, telephone number.
  • Billing data: SEPA direct debit mandate and bank details, invoices.
  • Usage data: number of verifications carried out per website or vending machine, with no link to the identity of Users.

3.3 If you contact us

  • The information contained in your message.

4. Why do we use your data?

  • To create and manage your account: necessary for the performance of the Terms of Use.
  • To verify your age by video (method 1): your explicit consent, obtained before recording. You may withdraw it at any time and choose another method.
  • To allow you to prove that you are of legal age to partners: performance of the Terms of Use.
  • To prevent fraud and secure the service: our legitimate interest in protecting Users, partners and minors.
  • To invoice Business customers: performance of the contract and accounting obligations.
  • To respond to your requests: our legitimate interest or the performance of the Terms of Use.
  • To comply with our legal obligations and respond to the authorities: legal obligation.

5. Who has access to your data?

Your data is accessible only:

  • to authorised personnel of INOVA DIGI-TECH and to the Operators responsible for validation, within the limits of their duties;
  • to our technical service providers, who act on our instructions and are bound by confidentiality:
    • Scaleway – data hosting (France);
    • Amazon Web Services (AWS Bedrock, Europe region) – automated analysis of the video and the identity document (European Union);
    • Brevo – sending of e-mails (European Union);
    • Twilio – sending of confirmation SMS messages (United States);
    • Viva – collection of direct debits from Business customers (European Union);
    • Google (Firebase) and Apple – application notifications and crash reports;
  • to the French National Agency for Secure Documents (Agence nationale des titres sécurisés – France Identité), if you choose method 3;
  • to administrative or judicial authorities, where required by law.

Partner websites, vending machines and points of sale receive only the information that you are of legal age.

6. Does your data leave the European Union?

Your data is hosted in France. The video of your face and the photograph of your identity document are analysed exclusively within the European Union.

Certain service providers (Twilio for sending SMS messages, Google and Apple for notifications and crash reports) may process limited data in the United States, in particular your telephone number for the sending of a code. These transfers are governed by the EU–US Data Privacy Framework and, where applicable, by the European Commission’s standard contractual clauses or binding corporate rules.

7. How long do we keep your data?

  • Video of the face and photograph of the identity document: deleted as soon as the operator has made a decision, at the latest 15 days after they are sent.
  • User account (e-mail, telephone, date of birth, registration date, validation method): for as long as the account is active, then deletion after 3 years of inactivity or as soon as you delete your account.
  • Confirmation codes: 15 minutes. Security links (password, copy of your data): 24 hours.
  • Account refused because the person is a minor: deletion of the validation data and of the account.
  • Business customer data: for the duration of the business relationship, then 5 years for evidentiary purposes.
  • Invoices and accounting records: 10 years, in accordance with the French Commercial Code (Code de commerce).
  • Technical security logs: 12 months at most.

8. How do we protect your data?

  • encryption of communications (TLS) and of sensitive data;
  • hosting in France and analysis of the video within the European Union;
  • access restricted to authorised persons only, with authentication and traceability;
  • automatic deletion of the video and the identity document;
  • no storage of sensitive data on your telephone.

9. What are your rights?

You have the following rights:

  • access to your data and obtaining a copy of it;
  • rectification of inaccurate data;
  • erasure of your data;
  • restriction of and objection to processing;
  • portability of your data;
  • withdrawal of your consent at any time, for verification by video;
  • obtaining human intervention, expressing your point of view and contesting a refusal decision;
  • setting out instructions regarding the fate of your data after your death.

To exercise your rights: dpo@verifage.com, or by post to DPO – SAS INOVA DIGI-TECH – 16 rue de la Côte – Bâtiment D1 – 54000 Nancy. We respond within one month.

If you consider that your rights are not being respected, you may lodge a complaint with the CNIL (Commission nationale de l’informatique et des libertés): www.cnil.fr – 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

10. Minors

VerifAge is reserved for persons of legal age. Where a verification reveals that a person is a minor, their registration is refused and their data is deleted.

11. Changes

We may update this policy. Any significant change will be notified to you by e-mail or in the application before it comes into force.

12. Find out more

Details of the processing operations, legal bases and security measures are set out on the GDPR compliance page.