Biometric Data Retention and Destruction Policy
Effective date: on launch, following counsel approval · Member notice version biometric-notice/1.0.0
How Graxe collects, protects, retains, and permanently destroys the biometric information used to verify that members are real people.
1. Purpose and scope
This policy describes how Graxe.ai, Inc. collects, uses, protects, retains, and permanently destroys biometric identifiers and biometric information used for member identity verification in the United States. It applies to facial measurements generated from profile photographs, a verification selfie, and the portrait on government-issued identification.
This policy supplements Graxe's Privacy Policy and the written Biometric Privacy Notice presented before collection. Where applicable law is more protective, the more protective requirement controls.
2. Data and permitted purpose
Graxe may generate automated facial measurements, including a scan of face geometry, solely to verify that submitted photographs depict one person and that the member's selfie matches the portrait on the member's government-issued identification.
Graxe does not use biometric information for cross-member searches, duplicate-face detection, matchmaking, ranking, recommendations, advertising, model training, personal-trait inference, surveillance, or background-screening decisions.
3. Collection and written authorization
Before biometric collection or processing, Graxe provides a written notice identifying the data, purpose, uses, disclosures, and retention period. Graxe requires an initially unchecked authorization and a separate affirmative button. The record includes the notice version, cryptographic fingerprint, authorization text, member decision, date and time, and method of electronic signature.
The camera, image picker, and facial-analysis process remain unavailable unless the age gate and the current-session written authorization gate both pass.
4. Processing, storage, and disclosure
Facial comparison is performed locally on the member's device using Apple technology. Facial measurements and reusable biometric templates are not transmitted to Graxe servers or to a third-party biometric provider. Graxe receives only the verification status and records necessary to document the verification event and consent.
Graxe does not sell, lease, trade, disclose, or otherwise profit from biometric information. Disclosure is permitted only when required by a valid law, court order, warrant, or subpoena.
5. Retention schedule
| Data category | Normal retention | Maximum or trigger |
|---|---|---|
| Facial measurements or feature representations | Transient during comparison; not stored as a reusable template | Destroyed when the comparison completes |
| Graxe verification copy of selfie | Deleted when verification completes or is abandoned | No later than 30 days after capture |
| Graxe verification copy of ID image | Deleted when verification completes or is abandoned | No later than 30 days after capture |
| Ordinary profile photographs | Retained as member-selected account content | Until member deletion or account closure under the Privacy Policy; no derived facial measurements retained after verification |
| Verification status and consent evidence | Retained as non-biometric compliance and account records | According to the Privacy Policy and applicable recordkeeping requirements |
6. Permanent destruction
Graxe permanently deletes controlled verification copies from the dedicated application cache after verification. Leaving or abandoning the verification flow triggers deletion. A startup cleanup removes any verification copy that survives an interrupted session and reaches the 30-day maximum. Deletion removes the file rather than archiving or hiding it.
If deletion fails, the file remains queued for retry and is not treated as destroyed. Graxe documents and investigates repeated deletion failures. A valid preservation obligation may delay deletion only to the minimum extent and duration legally required.
7. Security and incident response
Graxe applies safeguards appropriate to biometric information, including on-device processing, controlled application storage, least-privilege access, encryption provided by the operating system, fail-closed capture gates, deletion testing, and prohibition of biometric data in analytics and logs.
A suspected compromise of biometric information is escalated immediately to Privacy, Legal, and Security. Graxe will preserve necessary evidence, contain the incident, determine applicable notification obligations, and document remediation.
8. Individual requests
A person may contact [email protected] to ask about Graxe's biometric practices or to request access, correction, deletion, or withdrawal of consent where applicable. Withdrawal prevents future biometric processing but does not alter processing lawfully completed before withdrawal. Because identity verification is required for membership, withdrawal may require closure or suspension of the account.
9. Restricted jurisdictions
Written consent does not override a prohibition on biometric use. Graxe will not enable biometric verification in a jurisdiction or setting where the activity is prohibited unless qualified counsel has confirmed that the activity is outside the prohibition or a valid exception applies. Portland and covered Erie County commercial settings are maintained as separate legal launch controls.
10. Governance and changes
Privacy and Legal review this policy at least annually and before any material change to biometric data, purpose, technology, recipient, retention period, or jurisdiction. A material change requires an updated notice version, new cryptographic fingerprint, technical review, and renewed consent where required.
11. Contact
Graxe.ai, Inc. · [email protected] · [email protected]