Privacy Policy

1. Information We Collect

Information you provide: email address, password (hashed), and business or team details you enter when setting up a team or multi-location account.

Identity document data: when you upload or capture a photo of an ID, we process the document image to extract the name, date of birth, address, and other fields shown on it. Uploaded document images are stored in private, access-controlled platform storage and are never made publicly accessible. Base44 does not publish a guaranteed retention period for these private uploads, and ID Oracle does not currently have a supported way to delete an individual uploaded file immediately after processing.

Public records search data: the name and address extracted from the ID are used to query public records databases to help assess whether the document is genuine.

Scan history: if scan history is enabled, verification results and extracted identity details are stored in your account so you can review them later. You can disable new scan-history storage or configure automatic purging from Settings.

Location data: for team and multi-location accounts, we use device GPS coordinates to verify that scans are performed near an authorized venue. Location is used only for this geofence check and is not stored long-term.

Device information: a device fingerprint is generated to help prevent abuse of the free trial across multiple accounts. We also collect standard technical data such as IP address, browser type, and operating system.

Usage data: pages viewed, actions taken, and other analytics events that help us improve the Service.

2. How We Use Your Information

• To provide the identity verification and fake-ID detection features of the Service.
• To create and manage your account, including team memberships and multi-location access.
• To enforce scan limits, geofencing, and free-trial eligibility.
• To process payments and manage subscriptions.
• To send service-related emails such as verification codes and account notifications.
• To detect, prevent, and address fraud, abuse, and security issues.
• To analyze and improve the Service and develop new features.

3. What This App Does NOT Do

ID Oracle is a fake-ID detection tool. It does not perform background checks, criminal record searches, credit checks, or employment verification. Results should be used as a screening aid, not as a definitive determination of identity.

3a. DMV / State Motor Vehicle Verification

For an additional per-scan fee, ID Oracle can verify the details shown on a scanned ID against the issuing state's motor vehicle (DMV) records. When you run a DMV verification, we send the name, date of birth, driver's license number, and state shown on the ID to IDScan.net, our third-party identity verification provider, which queries the relevant state DMV database on our behalf. Some states (such as Pennsylvania) require the ID holder's consent before a DMV record check is performed; in those states, you must check a consent box before the scan can proceed, and we record that consent was given for at least one year to comply with state retention requirements. The driver's license number is stored in your scan history only for scans in states that legally require consent records.

4. Legal Basis for Processing (GDPR)

If you are in the European Economic Area, we process your personal data under the following legal bases: performance of a contract (providing the Service you requested), consent (for optional data like location), legitimate interests (security and abuse prevention), and compliance with legal obligations.

5. Data Sharing and Third Parties

We do not sell your personal information. We share data with the following categories of service providers:

• Cloud infrastructure & authentication — the Base44 platform that hosts the app, stores data, and manages user accounts and email verification.
• Payment processing — our payment provider handles checkout and subscription billing. We do not store your full card number.
• Public records providers — third-party databases queried with the name and address extracted from the ID. The specific provider is not disclosed.
• DMV verification provider — IDScan.net receives the name, date of birth, driver's license number, and state from the scanned ID to verify it against state motor vehicle records, as described in section 3a above.
• Device fingerprinting — FingerprintJS is used to generate a device identifier for abuse prevention.
• Analytics & advertising — Google Ads and analytics tools that help us measure performance and show relevant ads. See the Cookies section below.

We may also disclose information when required by law or to protect our rights, safety, or property.

6. Google Ads and Cookies

We use Google Ads to measure ad performance, including conversion tracking. Google may set cookies or use device identifiers to track conversions from ads you interact with. You can opt out of personalized advertising by visiting Google Ads Settings or aboutads.info. For more information about how Google uses data, see Google's Privacy & Terms.

7. Data Retention

Scan history is retained according to the retention preference you choose in Settings (daily, weekly, monthly, or indefinite). If you disable scan history storage, new scan-history records are not saved. Photos uploaded or captured for ID extraction are stored separately in private platform storage. Base44 does not publish a guaranteed retention period for those private uploads, and ID Oracle does not currently have a supported per-file deletion method. Deleting a scan-history record or removing an app user therefore does not guarantee deletion of the underlying uploaded image. Account data is otherwise retained for the life of your account, subject to the exceptions described in this policy and applicable legal requirements.

8. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data or your entire account (available in Settings).
• Object to or restrict certain processing.
• Withdraw consent for optional processing such as location.
• Export your data in a portable format where applicable.

If you have questions about this Privacy Policy or your data, contact us at support@idoracle.app.

8a. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA), gives you the right to:

• Know what personal information we collect about you, the categories of sources, how we use it, and whether we sell or share it. We do not sell your personal information, and we do not share it for cross-context behavioral advertising as those terms are defined by California law. Data shared with our service providers (hosting, payment processing, identity verification, analytics) is shared only to provide and improve the Service.
• Request a copy of the personal information we have collected about you.
• Request correction of inaccurate personal information.
• Request deletion of your personal information, subject to certain legal exceptions.
• Limit the use and disclosure of sensitive personal information to what is necessary to provide the features you request.

You will not be discriminated against for exercising any of these rights. To exercise them, contact us at support@idoracle.app, and we will respond as required by California law.

9. Children's Privacy

The Service is not directed to children under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Contact Us

If you have questions about this Privacy Policy or your data, contact us at support@idoracle.app.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date above.