- Account Information — Your name, email address, username, and password.
- Identity Verification Data — A government-issued ID (passport, driver's license, national ID) and a live selfie photo for facial verification.
- Profile Information — Bio, profile photo, preferences, and any other information you add to your profile.
- User Content — Photos, videos, comments, messages, and TrueShop marketplace listings you post.
- Usage Data — Your interactions with the Platform, including likes, follows, time spent, and features used.
- Device & Technical Data — IP address, browser type and version, device type, operating system, and cookie identifiers.
- Directly from you — When you register, complete verification, set up your profile, post content, or contact us.
- Automatically — Through cookies, analytics tools, server logs, and device fingerprinting when you use the Platform.
- From third parties — From identity verification service providers and, if applicable, payment processors.
- Verify your identity and confirm you are a real human being.
- Operate, maintain, and improve the Platform.
- Moderate content and enforce our Terms of Service.
- Communicate with you about your account, updates, and policy changes.
- Analyze usage patterns to improve user experience.
- Comply with legal obligations and respond to lawful requests.
- What we collect: Your government ID (image) and a live selfie. During verification, the selfie is analyzed to generate a facial recognition template (biometric data) to match you to your ID photo.
- Why: Solely to confirm you are a real human and that the ID belongs to you. This is the core feature of True Circle — ensuring every account is a verified human.
- How long we keep it: Biometric data (facial recognition data derived from your selfie) is deleted within 30 days after verification is complete. Your ID image is encrypted, reviewed once by our team, and never displayed publicly.
- Third-party verification providers: We may use third-party services to process verification. These providers are contractually prohibited from storing, reusing, or sharing your biometric data for any purpose beyond verification.
- What we do NOT do: We do not sell, rent, or share biometric data. We do not use it for surveillance, advertising, marketing, or any purpose other than identity verification. We do not retain it longer than necessary.
- Verification providers — Limited to identity verification data. Contractually required to delete after processing.
- Law enforcement — If required by valid legal process (subpoena, court order, or other lawful request).
- Service providers — Companies that help us operate the Platform (cloud hosting, analytics, customer support). These providers are contractually bound to protect your data and use it only for the services they provide.
- Business transfers — In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before this occurs.
- We do NOT sell your personal information to third parties. We do NOT share biometric data with advertisers, marketers, or any third party not necessary for verification.
- Biometric data (facial recognition) — Deleted within 30 days of verification.
- Government ID image — Deleted within 30 days of verification.
- Account information — Retained while your account is active.
- User content (posts, messages) — Retained while your account is active.
- Deleted account data — Deleted within 90 days of account deletion.
- Backup data — May persist up to 6 months after deletion.
- Records required by law — Retained as long as legally required.
- Access — Request a copy of the data we hold about you.
- Correction — Update inaccurate or incomplete data.
- Deletion — Delete your account and associated data.
- Data portability — Export your data in a machine-readable format.
- Withdraw consent — Withdraw consent for biometric processing (note: this may affect your ability to use the Platform).
- Opt out — Opt out of non-essential cookies.
- Object — Object to processing where applicable.
- To exercise these rights, visit your Account Settings or email notify@truecircle.com. We will respond to all requests within 30 days.
- California (CCPA/CPRA): California residents have the right to know what personal information we collect, use, and share; request deletion of their personal information; opt out of the sale of their personal information (we do not sell personal information); and not face discrimination for exercising their rights.
- Illinois (BIPA): Under the Illinois Biometric Information Privacy Act, we disclose that we collect biometric data (facial geometry from selfies) for identity verification. This data is not sold, leased, traded, or otherwise profited from. It is deleted within 30 days of verification. A written retention and destruction policy is available upon request.
- Colorado, Connecticut, Virginia, Utah, Texas: Residents of these states may have additional rights under applicable state privacy laws. Please contact us at notify@truecircle.com for more information.
- If you are located in the European Economic Area (EEA) or the United Kingdom, this section applies to you.
- Legal bases for processing: Consent (for biometric data processing and cookies); Contract performance (to provide the Platform and verification services); Legitimate interests (for security, fraud prevention, and platform improvement); Legal obligation (to comply with applicable laws).
- Your GDPR rights: Access, rectification, erasure, restriction of processing, data portability, and objection to processing.
- International transfers: Your data may be transferred to and processed in the United States. We use Standard Contractual Clauses (SCCs) approved by the European Commission as the legal mechanism for these transfers.
- Complaints: You have the right to lodge a complaint with your local data protection authority.
- True Circle is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13.
- If we discover that we have collected personal data from a child under 13, we will delete it promptly.
- If you believe your child has provided us with personal data, please contact us at notify@truecircle.com.
- If the Platform evolves to allow users under 13, a separate parental consent mechanism compliant with COPPA will be implemented.
- Encryption in transit (TLS) for all data moving between your device and our servers.
- Encryption at rest for all stored data, including verification documents.
- Strict access controls and authentication for internal systems.
- Regular security audits and vulnerability testing.
- Limited employee access to personal data on a need-to-know basis, with every access to verification data logged.
- No system is 100% secure, but we take reasonable and appropriate precautions to protect your information.
- We may update this Privacy Policy from time to time.
- We will notify you of material changes via email or Platform notification at least 30 days before they take effect.
- Your continued use of the Platform after the changes take effect constitutes your acceptance of the updated Policy.
- The "Last updated" date below reflects the most recent revision.
- For privacy-related inquiries: notify@truecircle.com
- For legal inquiries: legal@truecircle.com
- Mailing address: [Company Address]
- Data Protection Officer: [Name/Title]
Data Retention Quick Reference
| Data Type | Retention Period |
|---|---|
| Biometric data (facial recognition) | Deleted within 30 days of verification |
| Government ID image | Deleted within 30 days of verification |
| Account information | Retained while your account is active |
| User content (posts, messages) | Retained while your account is active |
| Deleted account data | Deleted within 90 days of account deletion |
| Backup data | May persist up to 6 months after deletion |
| Records required by law | Retained as long as legally required |
Questions about your privacy?
Contact us at notify@truecircle.com or exercise your rights in Account Settings.