Draft for legal review. This text is not in force until it has been reviewed and published.
How LegitFlash processes your data
Version 2026-11-06
You are reading this because an organisation asked you to verify your identity using LegitFlash. This page explains what LegitFlash does on that organisation's behalf.
Who is responsible for your data
The organisation that sent you the link (the "client") is the controller of your data. It decides why your data is collected and how it is used. The first screen of the verification shows its name, its purpose and a link to its privacy policy.
TrustID OÜ runs LegitFlash and acts only as the client's processor. We follow the client's instructions and never use your data for our own purposes or for any other organisation.
What we do
We receive the images, video and details you submit, store them encrypted, run automatic technical checks (image quality, reading the machine-readable lines of the document, expiry and age) and let a trained person review them. The person compares your photo with your document by eye. No face-recognition software is used and no biometric template is created.
We tell the client the result: approved, rejected or more information needed, with the reasons and the data read from your document, depending on how the client configured the check.
How long we keep it
Images and video are deleted automatically after the number of days set by the client (30 by default, never more than 90) counted from the decision. A minimal record of the result is kept for the period set by the client (5 years by default) and then deleted. If you do not finish, what you uploaded is deleted after 72 hours.
Your rights
You can ask the client to access, correct or delete your data, to restrict or object to its use, and to give you a copy. Contact the client first: it decides on your request. If you write to us, we will pass your message to the client without undue delay.
You can also complain to your data protection authority (in Spain, the Agencia Española de Protección de Datos, aepd.es).
Who else sees your data
Our sub-processors (hosting and email providers) only receive what they need to run the service, in the European Union. See the list of sub-processors for details. Reviewers are bound by confidentiality and every access to your documents is logged.
Contact
Questions about how LegitFlash processes data: support@example.com.
Data protection contact: support@example.com