Deep-Check processes special-category biometric data. We are committed to full transparency about what we collect, why, and how we protect it.
Deep-Check Inc. (“Deep-Check”, “we”, “us”) is the data controller for personal data processed through this platform.
Contact: privacy@deep-check.io
Data Protection Officer (DPO): dpo@deep-check.io
| Data Type | Description | Purpose |
|---|---|---|
| Keystroke dynamics | Flight times (inter-key intervals), hold times, typing rhythm patterns | Identity verification sessions and enrollment |
| Facial landmarks | 68-point facial landmark vectors derived from camera feed | Liveness detection during active sessions only |
| Eye gaze vectors | Horizontal/vertical gaze ratio history | Anti-deepfake analysis during active sessions |
| Blink patterns | EAR (Eye Aspect Ratio) measurements, blink frequency | Liveness scoring during active sessions |
⚠ Raw video or images are never stored. Only derived numerical vectors are processed. Raw biometric signals exist only in browser memory during an active session and are discarded immediately after.
| Data Type | Description | Purpose |
|---|---|---|
| Image thumbnails | Low-resolution (320px) JPEG representation of uploaded images | Case reference and audit trail |
| ELA heatmap | Error Level Analysis visualization of uploaded image | Forensic evidence for the analysis report |
| EXIF metadata | Camera make/model, software, timestamps extracted from uploaded images | Anomaly detection |
| Forensic scores | Numerical risk scores (0–100) per analytical module | Fraud detection output |
| Data Type | Description | Purpose |
|---|---|---|
| Candidate name | Text field, provided by the operator | Session identification |
| Email address | Optional, provided during enrollment | Profile linking across sessions |
| Session metadata | Timestamps, session duration, alert counts | Audit and compliance |
| Category | Legal Basis | Notes |
|---|---|---|
| Biometric data (keystroke, facial) | Explicit consent (Art. 6(1)(a) + Art. 9(2)(a) GDPR) | Withdrawn at any time via account deletion request |
| Session metadata | Legitimate interest (Art. 6(1)(f)) / Contract (Art. 6(1)(b)) | Fraud prevention and service delivery |
| Document forensic data | Consent of the operator + data subject where applicable | Fraud detection in document workflows |
Deep-Check is architected to minimise biometric data exposure:
| Data Type | Retention Period | Notes |
|---|---|---|
| Enrollment biometric profiles | 90 days from creation | Automatic deletion on expiry |
| Session assessments | 12 months | Operator may request earlier deletion |
| Document forensic analyses | 24 months | Required for audit trail integrity |
| API keys | Until revoked by operator | Active key management required |
| Server logs | 30 days | Security and debugging only |
Data is stored in Supabase infrastructure hosted in the EU (eu-west-1, Ireland). No personal data is transferred to third countries outside the EEA without appropriate safeguards (Standard Contractual Clauses or adequacy decision).
Sub-processors:
| Right | Description |
|---|---|
| Access (Art. 15) | Request a copy of all personal data we hold about you |
| Rectification (Art. 16) | Correct inaccurate data |
| Erasure (Art. 17) | Request deletion of your data ("right to be forgotten") |
| Portability (Art. 20) | Receive your data in a machine-readable format |
| Object (Art. 21) | Object to processing based on legitimate interest |
| Withdraw consent (Art. 7(3)) | Withdraw consent for biometric processing at any time — without affecting prior lawful processing |
| Lodge a complaint | Contact your national supervisory authority (Spain: AEPD — www.aepd.es) |
To exercise any right: privacy@deep-check.io — we respond within 30 days.
Deep-Check uses only technically necessary cookies (session state, authentication tokens). We do not use advertising, tracking, or analytics cookies without your consent. A consent banner is shown on first visit for any non-essential cookies.
Deep-Check operates identity verification systems that may fall under the EU AI Act (Regulation 2024/1689) as high-risk AI systems in the context of employment and education access (Annex III). We are committed to:
Contact compliance@deep-check.io for AI Act compliance documentation requests.
We will notify operators of material changes 30 days in advance via email. The current version is always available at this URL. Previous versions are available on request.