Privacy Policy
IDPhotoPass, a JTools product · Last updated 8 October 2026
The short version
- We keep your photo only for your order. When you check out, we store a copy of the photos in your order, so we can email you a download link.
- We delete that copy 7 days later, automatically. The download link stops working at the same moment.
- We never see your card details. Payment is handled by Link, a Stripe service, which is the seller of record. Your card statement will show
LINK.COM*. - No analytics, no tracking, no advertising, no accounts. There is no tracking script of any kind on this site.
- We never use your photo for anything but your order. Not to train models, not to improve the product, not shared with anyone.
What happens to your photo
This is the part most people want to know, so here it is as a timeline.
- You choose and edit a photo. Background removal, cropping and the compliance checks prepare your photo to the specification you picked. The measurements involved — head size, eye position, head angle, and so on — are used only to produce the check results you see on screen, and are never stored.
- You press Check out. We store a copy of each photo in your order so that we can give you a download link that works on any device — including if you lose the browser you made them in. The copy is stored when checkout opens, before payment completes, so that a buyer whose payment succeeds always has something to recover.
- You pay. Stripe, through its Link checkout, collects your payment details and your email address. We receive your email address so we can send you your download link and recovery code. We do not receive your card number.
- 7 days later, our copy is deleted. Automatically, by a storage rule, and the download link expires at the same time. The photos you bought are cleared from your cart at the same point.
Face measurements and biometric data
To check whether a photo meets a government specification, the app has to measure the face in it — where the eyes sit, how large the head is relative to the frame, whether it is tilted.
What this means concretely:
- The face measurements are used only while you are using the app, to produce the check results, and are discarded when you close the page.
- The face measurements themselves are never stored — not in your cart, not on our servers, not anywhere. Only the photo is kept: in your cart, and on our side for 7 days after checkout, as described above. Your cart holds the photo plus the check results (scores and messages), nothing more.
- We do not create, store or use a faceprint or facial template, and we cannot identify a person from anything we hold.
- We do not use face recognition, and we do not attempt to determine your age, gender, race or identity.
If you are in Illinois, Texas, Washington or another state with a biometric privacy law: we do not collect, capture, store, or profit from biometric identifiers or biometric information as those laws define them. The photograph you upload is a photograph, and for the seven days we hold it, it is held only to deliver your order.
What we collect
| What | When | Why | How long |
|---|---|---|---|
| Your order's photos | When you press Check out | So your download link works, on any device | 7 days if you pay; within about a day if you don't finish paying |
| Email address | At payment, from Stripe | To send your download link and recovery code | Kept by Stripe as your purchase record; we do not maintain a separate mailing list |
| Order record (amount, quantity, order ID) | At payment | Receipts, refunds, tax and accounting obligations | As long as tax law requires, via Stripe |
| IP address and standard request data | Whenever you load the page | Unavoidable in serving a website; used for security and abuse prevention | Short-term, by our hosting provider |
| Error logs | If something fails | To diagnose faults | Short-term. These record order IDs, never your email address or your photos |
What we do not collect
- No accounts, usernames or passwords — there is nothing to sign up for.
- No analytics, no cookies for tracking, no advertising identifiers, no session recording, no fingerprinting. There is no third-party tracking script on this site.
- No card numbers, expiry dates or security codes. Those go to Stripe and never reach us.
- No newsletter list. We email you about your order and nothing else.
Saved in your browser
So the app works, it saves your cart, your recovery code, your chosen language and the order you are viewing in this browser. These are needed for the app to work and are never used for tracking. Your cart clears itself automatically, and clearing your browser's site data removes everything. Your photos can be downloaded again from the link in your email for 7 days after your order.
Who else is involved
We use these companies to run the product. We have not added anyone whose job is to watch you.
| Company | What they do | What they see |
|---|---|---|
| Cloudflare (US) | Hosting, the storage that holds your order for 7 days, and sending our emails to you | Your IP address and request data; your order's photos during those 7 days; your email address and the emails we send you |
| Stripe (US), including its Link service | Payment processing. Stripe, through Link, is the seller of record and handles sales tax and VAT | Your name, email, billing address and payment details |
| jsDelivr (CDN) | Delivers software files the site uses | Your IP address, when those files are downloaded. No photo data |
| Hugging Face (US) | Delivers software files the site uses | Your IP address, when those files are downloaded. No photo data |
| Google (US) | Delivers software files the site uses, and hosts our support and privacy inbox (Gmail) | Your IP address, when those files are downloaded (no photo data); and anything you email us, including your email address |
Because our providers are in the United States, personal data is processed there. Where transfers out of the UK, EU or Switzerland are involved, our providers rely on the European Commission's Standard Contractual Clauses and their own certifications.
Why we are allowed to do this (legal bases)
If the UK GDPR or EU GDPR applies to you, these are the grounds we rely on:
- Performance of a contract — receiving your order's photos and your email address, so we can deliver what you bought.
- Legitimate interests — keeping the site up, preventing abuse, and diagnosing faults.
- Legal obligation — keeping records of sales for tax purposes.
We do not rely on consent for anything, because we do not do anything that needs it: no marketing, no profiling, no tracking.
Your rights
Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to our using it. You can also ask us not to sell or share your personal information — though we should say plainly that we do not sell or share personal information, and never have. We do not discriminate against anyone for exercising a privacy right.
Email privacy@idphotopass.getjtools.com and we will respond within 30 days. Two practical notes:
- Deleting your photos is faster than asking us. Our copy deletes itself 7 days after your order regardless. If you want it gone sooner, tell us your order ID and we will remove it.
- Photos still in your cart are removed from the cart itself. Use the delete button on each photo, or clear your browser's site data for this site.
In the UK you may complain to the ICO; in the EU, to your national data protection authority.
Children
The product is for adults, and we do not knowingly collect personal information from anyone under 13. Parents do legitimately use it to make passport photos of their children — in that case the photo is handled exactly as described above, and the account holder is the adult making the purchase.
Security
Everything is served over HTTPS. Your order's photos are stored in a private bucket that is not publicly listable and not indexed by search engines. Download links are cryptographically signed, expire after 7 days, and stop working immediately if the order is refunded.
We should be honest about the limit of any such promise: no system is perfectly secure. What reduces the risk most here is that we hold very little — no accounts, no passwords, no card numbers, and photos for one week rather than indefinitely.
Language
The app is available in 15 languages. This policy is published in English only, because translating a legal document risks changing its meaning. The English text is the governing version.
Changes
If we change this policy we will update the date at the top. If a change materially affects how we handle your photos, we will say so prominently in the app rather than quietly editing this page.
Contact
IDPhotoPass is operated by Jarithan Commerce LLC (United States).