SupahID Privacy Policy

Draft · August 19, 2026. This policy describes the SupahID public site, invitation onboarding, identity verification, authentication, owner portal, and published Personas.

Information SupahID processes

SupahID processes invitation state, the bounded Stripe verification outcome, alias and account setup, browser authentication ceremonies, owner-authorized Persona changes, and support requests. Ledgr—not the SupahID presentation layer—durably owns canonical identity, authentication metadata, sessions, and the Persona projection.

Identity verification

Stripe receives the government-ID and live-selfie submission. Supah stores only provider, external session reference, status, and verification time. Supah does not request or store the submitted images, expanded report, document fields, selfie details, or biometrics.

Authentication

Ledgr stores password verifiers and public WebAuthn credential metadata. Passkey private keys stay with the authenticator. SupahID's account cookie contains short-lived onboarding state and an opaque Ledgr customer session.

Personas

Personas begin private. If you publish, the selected Persona fields, connections, Verified Human mark, and bounded JSON projection become publicly available. Search engines and other people may copy information after publication.

Retention and deletion

Ledgr retains identity and authentication records according to its operating and legal obligations. Account deletion revokes sessions and removes customer-visible profile and authentication material under the deletion policy. Some security or legal audit records may be retained where required.

Your choices and contact

You control Persona publication and may request access, correction, or deletion by contacting privacy@supah.dev. Account and Persona controls are available in the owner portal.