Privacy Policy
This Privacy Policy describes how Solar Identity, a product of Starlight Solutions, Inc. (a Delaware corporation), handles data. Biometric analysis is processed on our servers, not in your browser. Using Solar Identity also means agreeing to Starlight Solutions, Inc.’s corporate Privacy Policy and corporate Terms of Service.
Server-Side Data Processing
Solar Identity processes biometric data — including facial scans, voice recordings, ID document images, and personality assessment responses — on Starlight Solutions, Inc.'s servers, algorithmically and without human review. Media you submit for a scan is used only to generate that scan's result in memory and is discarded once the result is produced; our database only ever stores the derived result (scores, pass/fail outcomes, metadata), never the raw image, audio, or video itself. No employee or contractor of the Company views your face, voice, or ID document — there is no interface that would let anyone do so, because the raw media is never saved in the first place. It is not used to train models or shared with third parties.
What We Collect
We collect the account information you provide (email, optional name, organization name), scan results and their metadata (type, timestamp, summary metrics), API usage and credit balance, a monthly count of how many in-browser tool scans you have run against your plan's allowance, billing records processed through Stripe, your IP address, browser and device information for each login session, and — if you use the contact form — your name, email, and message. We do not retain the raw images, audio, or video you submit beyond what is needed to produce a result.
IP Address & Network Information
We log the IP address you sign up from, and record the IP address (along with browser/device information) associated with each login session so you can review and revoke your own active sessions. IP addresses are also used, on a best-effort basis, to rate-limit abusive traffic, to detect and block sign-ups from Tor exit nodes and known VPN/hosting providers, and — for organizations that enable it on their own verification checks — to flag connections from VPNs, proxies, or Tor for that specific check. We do not sell or share IP addresses with third parties, and organizations running a check only receive a pass/fail signal from this, never the raw IP.
Verification-Check Results
When an organization runs a verification check on you, such as an age or identity check, it receives only the result of that check and the specific fields it has configured: for example pass, fail or inconclusive for a minimum age, and an estimated age group if the organization asked for one. It never receives your face image, your ID image, or anything that could be used to rebuild them. Organizations choose which checks run and their thresholds; they cannot change how a check reaches its result.
Screen Mode & Proctoring
If an organization enables Screen Mode for a test you take, we detect and log tab switches, window focus loss, extended inactivity, and — only if the organization enables it and you consent via camera permission — webcam-based attention signals. This data is provided to the administering organization to assess test integrity. Screen Mode is disclosed to you before a session begins and camera-based signals are never used without your explicit permission grant.
Camera & Microphone Access
Solar Identity requests camera and microphone access only when you actively initiate a scan or a proctored session with Screen Mode's camera signal enabled. Access is granted per-session and can be revoked at any time through your browser settings.
Anti-Spoofing, Anti-Bot & Account Security
We protect accounts and checks with liveness detection, a human-verification challenge with a small proof-of-work step, rate limits on sign-in, password reset, two-step codes and other sensitive actions, and screening for automated, proxy and anonymized traffic. Passwords are stored only as bcrypt hashes, and API keys, session tokens and email links are stored only as SHA-256 hashes, so we cannot read them and can only reset or reissue them. No security measure can guarantee protection against every attack, and we keep improving these controls.
Integrity Signals
To protect the reliability of verification results, the site records a small number of integrity signals, such as interference with the page structure during a check. When one is recorded we store the type of signal, your IP address and, if you are signed in, your account. Signals are weighted, no single signal has any consequence, and only a repeated pattern over a rolling 24-hour window can lead to a temporary suspension that lifts automatically. We never act on an IP address alone. If you believe a restriction was applied in error, email legal@starsolenterprise.com and a person will review it.
Encryption & Storage Security
All traffic to and from the Service uses HTTPS (TLS) with HTTP Strict Transport Security, so browsers will not connect over an unencrypted link. Sensitive stored fields, including contact-form messages and results read from identity documents, are encrypted at rest with AES-256-GCM using a key that is held only in our server environment and is never sent to browsers or included in the website's code. Messages to the support assistant are encrypted in your browser with a new key for every message (ECDH on the P-256 curve with AES-256-GCM) and are decrypted only inside the assistant to produce a reply; they are not stored. Webhooks we send to organizations are signed with HMAC-SHA256 and a timestamp so they cannot be forged or replayed. API responses are marked no-store so that browsers and intermediaries do not keep copies. The table below summarises how each kind of data is protected.
Where Your Data Is Processed
Solar Identity is operated from the United States, and our hosting, database, payment, and email providers process data in the United States and potentially other regions in which they operate. If you access the Service from outside the United States, you are transferring your information to the United States, which may not offer the same level of data protection as your home jurisdiction. Where required for transfers out of the EEA or UK, we rely on the relevant provider's Standard Contractual Clauses.
Email & Confirmation Links
We use a third-party transactional email provider to send account-verification, password-reset, and contact-form-confirmation emails. New accounts and contact-form submissions must be confirmed via a emailed link before certain actions (like generating API keys, or delivering a contact message) are enabled — this proves you control the address and reduces spam and impersonation.
Payments
Credit purchases are processed by Stripe using Stripe's own secure card form. We never see or store your full card number. We retain a record of the transaction (amount, date, credits granted) for accounting and support purposes.
Third-Party Services
We use Stripe for payments, a transactional email provider for account emails, and our hosting and database providers to run the Service. All face, document, age and assistant processing runs on our own models on our own servers; we do not send your face, ID, voice or messages to any outside AI service. We do not sell your data. Any new third party that processes personal data will be listed here first.
Cookies & Local Storage
We set one essential cookie, which holds your login session and is HTTP-only, secure in production, and SameSite-restricted so it is not sent on cross-site requests. We also use your browser's local storage to remember your language preference. We do not use advertising cookies, analytics cookies, or third-party trackers, so there is no consent banner to dismiss. Stripe may set its own cookies within its payment form; those are governed by Stripe's privacy policy.
Our Role: Controller and Processor
For your own account, billing, the support assistant and this website, Starlight Solutions, Inc. decides how your data is used and is the controller (a "business" under California law). When an organization sends you a verification link or calls our API about you, that organization decides why the check runs and what happens with the result, so it is the controller and we act as its processor or service provider. In that role we process your data only on the organization's documented instructions and to run, secure and improve the reliability of the Service, never for our own advertising or to build profiles, and we do not sell or share it. Organizations can request a data processing agreement covering GDPR Article 28 and the CCPA service-provider terms from legal@starsolenterprise.com. If you want to exercise your rights over a check an organization ran, you can ask the organization or ask us, and we will pass the request on and help them answer it.
Biometric Data Policy and Retention Schedule
This section is our public written policy for biometric identifiers and biometric information, including for the purposes of the Illinois Biometric Information Privacy Act (740 ILCS 14), Texas Business and Commerce Code section 503.001, Washington RCW 19.375, the Colorado Privacy Act and similar laws. What we capture: images of your face during a face scan or selfie, and the photo on an identity document, together with facial landmark positions measured from those images. Why: only to check that a real person is present, to estimate an age or age group, to compare a selfie with a document photo where an organization asks for it, and to keep these checks secure. Consent: before the camera starts we tell you this in writing and ask you to tick a box agreeing to it, and the Service will not run a check without that agreement; organizations that call our API directly must collect the same written agreement and confirm it on every request. Retention schedule: images and landmark data exist only in server memory while the request is processed, which normally takes a few seconds, and are permanently destroyed as soon as the result is produced. We create no face template or faceprint, keep no database of faces and never use your images to identify you across checks. If any biometric data were ever held longer, for example because a request failed part-way, it is destroyed when the purpose for collecting it has been met and in all cases no later than three years after your last interaction with us, or one year after the purpose expires where Texas law applies, whichever is sooner. What we keep is the result, such as pass, fail or inconclusive and an age group, which cannot be used to rebuild your face. We never sell, lease, trade or otherwise profit from biometric data, and we disclose it only in the form of a result to the organization you agreed to be checked by, or where required by law, a valid warrant or a subpoena. We protect it with at least the same care we use for our other confidential and sensitive information.
Legal Bases for Processing
Where the GDPR or UK GDPR applies, we rely on these legal bases. Face, document and selfie checks can involve biometric data processed to uniquely identify a person, which is special category data under Article 9, so we treat every scan as special category data and process it only with your explicit consent, given in writing before the camera starts. You can withdraw consent at any time by stopping the check, by not starting further checks and by asking for existing results to be deleted; this does not affect processing already carried out. Where an organization is the controller, it is responsible for its own legal basis and, where the law requires it, for offering you a way to be verified that does not involve biometrics. Account creation, billing and delivering the Service are processed to perform our contract with you. Security logging, abuse prevention, rate limiting and integrity checks rely on our legitimate interest in keeping the Service and the people it checks safe. Billing records we must keep are processed to meet a legal obligation.
Your Rights
Wherever you live, you can ask for a copy of your data, ask us to correct or delete it, and refuse biometric processing by not starting a scan. Under the GDPR and UK GDPR you also have the rights to restrict or object to processing, to data portability, to withdraw consent at any time, and to complain to your local data protection authority. California residents have the rights to know what personal information we collect, use and disclose, to delete it, to correct it, and not to be discriminated against for using these rights. We use sensitive personal information, such as account login details and biometric data, only for the purposes the CCPA regulations allow and never to infer characteristics about you, so the right to limit its use does not apply. We do not sell personal information or share it for cross-context behavioural advertising. Residents of Virginia, Colorado, Connecticut, Texas, Oregon and other states with comprehensive privacy laws have similar rights to access, correct, delete and port their data and to opt out of targeted advertising, sale and profiling, and can appeal if we decline a request; email legal@starsolenterprise.com with the word Appeal and we will reply in writing within the time the law sets, and if the appeal is refused you can contact your state attorney general. You can use an authorized agent, and we will ask the agent for your signed permission. We verify every request before acting on it and respond within one month under the GDPR, which can be extended by two further months for complex requests, and within 45 days under US state laws, which can be extended once by 45 days where the law allows; we will tell you if we need the extra time.
Automated Decisions and Human Review
Verification checks produce results without a person involved, and the organization that asked for the check may act on them. Under Article 22 of the GDPR and UK GDPR you have the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects, unless it is based on your explicit consent, a contract or the law, and in those cases you have the rights to obtain human review, to express your point of view and to contest the decision. Organizations using our checks must give you a way to do this, and we support them by making each result explainable at the level of which check passed or failed. Face-based age estimates are approximate and can be several years out, so an organization that needs certainty about age should confirm it with an identity document. If you think a check went wrong, contact the organization that ran it, and email legal@starsolenterprise.com if you think the check itself malfunctioned; a person will look into it.
Children's Privacy
Accounts are for people aged 13 and over, and people under 18 should use the Service with the consent of a parent or guardian. We do not knowingly create accounts for children under 13. Organizations may use our age checks to confirm that someone meets a minimum age, which can mean briefly processing the face of a person who turns out to be younger. Since 2025 the US Children's Online Privacy Protection Rule treats biometric identifiers such as facial templates as personal information, so an organization whose service is directed to children, or which knows it is checking a child under 13, is responsible for obtaining verifiable parental consent where the rule requires it. For our part, the image is processed only in memory to produce the result, no template is created and nothing is kept. If you believe a child under 13 has an account or has been checked without the consent the law requires, email legal@starsolenterprise.com and we will delete the related data.
Data Breach Notification
If we become aware of a breach affecting personal data, we will contain it, investigate and take steps to prevent it happening again. Where the GDPR or UK GDPR applies, we notify the relevant supervisory authority within 72 hours of becoming aware of a breach unless it is unlikely to result in a risk to people, and we tell affected people without undue delay where the risk to them is high. Where US state laws apply, we notify affected residents and regulators within the deadlines those laws set. Where we act as an organization's processor, we tell that organization without undue delay so it can meet its own obligations. Each notice explains what happened, what data was involved, what we have done and what you can do.
Notice for California Residents
In the last 12 months we have collected these categories of personal information: identifiers (such as email address, name and IP address); customer records and commercial information (such as billing records and credits); internet or network activity (such as login sessions, browser and device details and security events); biometric information (face images and facial landmarks, held only in memory during a check); and sensitive personal information (account login credentials and biometric information). We collect it from you, from your device and from organizations that ask you to complete a check. We use it to provide and secure the Service, to process payments and to meet legal obligations, as described in this policy. We disclose it only to our service providers listed under Third-Party Services and to the organization that asked for a check, for these business purposes; we have not sold or shared personal information. How long each category is kept is set out under Data Retention and Deletion.
Data Retention and Deletion
Face images, document images, audio and facial landmarks are never written to our database. They exist only in memory while the request that uses them is processed and are destroyed when it finishes, normally within seconds; any temporary file is removed at the same time. Support-assistant messages are not stored; we keep only a daily count per account to enforce usage limits. Results of scans and verification checks, account records and usage counts are kept while your account is open, and verification results held for an organization are kept for as long as that organization's account is open or until it deletes them. Billing records are kept for seven years to meet tax and accounting law. Rate-limit counters are deleted after two days, login sessions expire after 30 days, and email links expire within one to 24 hours depending on their purpose. When you ask us to delete your account we delete your data within 30 days, keeping only billing records we must retain and results an organization is legally required to keep; copies in our database provider's encrypted backups are overwritten on its normal backup cycle and are never restored except to recover from a failure, after which deletions are applied again.