Jobchain ID · Legal
Privacy Policy
Version 2.1 · in force since
The essentials
- Your keys, your face and your document stay on your phone. Face matching and the liveness check run on the device and images of your face never reach us.
- To check that your document is genuine, our server receives the signed chip data once, issues your credentials and does not keep your name, your date of birth, the document number or the photo. It keeps only keyed fingerprints (HMAC) and minimal document data.
- Your messages and mail are end-to-end encrypted. We cannot read them.
- So are voice and video calls: neither we nor LiveKit, which carries them, can hear or see them, and they are not recorded. We do log who calls whom and when (see "Messaging, mail and calendar").
- Our servers are in the European Union (Amazon Web Services, Frankfurt).
- We do not sell your data, we do no advertising and we do not track you.
- When you share data with a business, that business is the controller; we process it on its behalf.
Who the controller is
The controller of the data described in this policy is Jobchain ID, S.L.U. (Tax ID B10734804), with registered office at Calle Tarongers 3, 46680 Algemesí (Valencia), Spain, registered in the Commercial Registry of Valencia, volume 11197, folio 13, sheet V-205198. In this policy, "Jobchain ID", "we" and "us" refer to that company, which is different from the companies providing other services on jobchain.com.
Privacy contact: privacidad@jobchain.com.
When a business uses Jobchain ID to process your data, that business is the controller: see "Businesses that use Jobchain ID".
What data we process
You can start using the app without giving your name, your email or your phone number: your identity is created on the phone from a recovery phrase. On our servers we process only what each feature needs:
- Decentralised identifier (DID) and public key, to create and protect your identity and your sessions.
- Email and phone number (optional), if you verify them: we send you a link or a code and issue you a credential that proves it.
- Verification of your document (optional). The phone reads the document's chip and sends us once the data it contains, signed by the issuing country: the data on the identity page (name, surnames, date of birth, nationality, number, type, issuing country and expiry) and the chip photo. With it we check that the document is genuine and has not been tampered with, and we issue your identity credentials. We do not keep it: it lives, encrypted, only during issuance (a few minutes at most). What we do keep:
- two keyed fingerprints (HMAC): one of the document (country, type and number) and one of the identity data (surnames, name, date of birth and expiry). They ensure that the same document cannot verify several identities at once. They cannot be reversed without a secret key that we keep separately, but they are pseudonymised personal data and we protect them as such;
- the issuing country, the type and expiry of the document, your nationality, the date and method of verification and the result of the chip authentication;
- the result of the face match and the liveness check (scores) and a fingerprint (hash) of the facial template computed on your phone, which does not allow your face to be reconstructed and which remains in the technical logs.
- Credentials we issue to you (identity, document, email, phone): we sign them and deliver them to you. For identity and document credentials we keep a record with the type, the dates, the status and a cryptographic fingerprint, not their content. For email and phone credentials we keep the full credential, with your address or your number, until you delete your account. If you change them, the previous one is revoked and kept in the same way.
- Device attestation (Apple App Attest or Google Play Integrity), to prevent verifications from tampered apps.
- Country of residence (optional), if you complete the residence verification.
- Wallet. The wallet is non-custodial: we do not keep your keys or your funds. We process the public addresses that the app registers to show you balances and history and so that people can pay you and, if you switch it on, the payee name that whoever pays you can see. If you take payments as a business with Jobchain Pay: the people you authorise to take payments on your behalf (their DID and the name you give them), the encrypted receipts of each payment linked to its transaction signature, and your product catalogue. For payments, a flag showing whether the address is affected by international sanctions and the date of the check.
- Messaging profile: your alias and, if you add them, the name and picture you choose, together with your DID, the wallet address people write to you at and your identifier on the messaging network.
- Voice and video calls, from the app or from the web version: who calls whom, when, whether it is a video call, whether it was answered and whether it was made from the app or from the web, and your phone's notification token and whether it is an iPhone or Android, so that the call rings even when the app is closed. If we ask you to confirm a browser on your phone, also a temporary copy of its type and its operating system. Never the voice, the video or the call key.
- Notifications (push), if you switch them on: your device token, the conversations you want notifications for and a log of each notification (who writes to whom, when and whether it was delivered; never the content).
- Signature count: an identifier of each signature and the month (never the document), to apply your plan's limits.
- Encrypted copy of your history of messages, only when you link a browser (see "Messaging, mail and calendar").
- Browsers you link: for each one, together with your identifier, its type and its operating system, its public keys, its identifier on the messaging network and when you linked it or removed it, to show it to you on your phone. Disconnecting it does not delete this data: it stays until you delete your account. While you approve a QR sign-in, also the approximate country and city of the browser and a keyed fingerprint of its IP, to show you where the request comes from; they are deleted within a day at most.
- QR sessions (signing in or sharing data with a business): a record with your identifier, its status and the IP address of the phone that scans the QR code.
- Paid plans: your DID and the purchase data the store or Stripe gives us (product, dates, status and amount). If you buy on the web, your email and billing details.
- Business dashboard: for the people who manage an organisation, their DID, name, email, role and a log of what they do (with the IP address). For the organisation, its company name, tax ID, address, domain and verification data.
- Technical and security data: the IP address, the browser and the date of requests to our servers, in their technical logs, and of sensitive operations, in the security logs.
- What you write to us when you ask for help or report content.
What is mandatory? Only the DID and the public key, which the app creates for you. Everything else is optional: if you do not provide it, the app keeps working and you only lose the corresponding feature (for example, without verifying your document you will not have the verified identity level).
Biometrics: only on your phone
Matching your face against the chip photo and the liveness check are done only on your phone. We never receive or keep images of your face. We only receive the result (the scores) and a fingerprint of the facial template that does not allow it to be reconstructed. The chip photo reaches us once, to check the document's signature, and is not used to recognise you or kept.
The legal basis for this processing is your explicit consent (art. 9(2)(a) GDPR). You may withdraw it at any time, without affecting what was done before: by deleting your account from the app (Settings › "Delete account"), which removes the scores and the verification data from our server, or by writing to privacidad@jobchain.com. The hash left in the technical logs is deleted after 90 days. Without this consent you cannot have the verified identity level.
What we use it for, on what basis and for how long
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Creating and operating your identity, your sessions and your wallet | DID, public key, public addresses and, if you switch it on, payee name | Performance of the contract (art. 6(1)(b)) | For as long as you keep your account |
| Verifying your email or phone and issuing its credential | Email, phone number and the full credential | Performance of the contract (art. 6(1)(b)): it is a feature you request | Until you delete your account or ask us to remove them; codes expire after 10 minutes |
| Verifying your document and issuing your identity credentials | Chip data (in transit only); keyed fingerprints, minimal document data and results | Performance of the contract (art. 6(1)(b)) | Chip data: only during issuance. The rest, for as long as you keep your account or until the same document is verified in another identity |
| Matching your face and checking that you are a live person, on your phone | Image of your face (does not leave the phone); scores and facial template fingerprint | Explicit consent (art. 9(2)(a)) | Images: only during the check, on the phone. Scores, for as long as you keep your account; the fingerprint, in the server's technical logs, 90 days |
| Residence verification | Location (on your phone) and country of residence | Consent (art. 6(1)(a)) | Samples on your phone: 90 days. Country, until you withdraw it or delete your account |
| Preventing fraud, duplicates and attacks | Device attestation, document fingerprints, IP and security logs | Legitimate interest (art. 6(1)(f)): preventing impersonation, false verifications and attacks | IP and browser of requests, in the servers' technical logs: 90 days. IP in the audit log: 90 days; the log, 2 years. Issuance and verification records of a credential: for as long as the credential exists |
| Messaging, mail, calendar and notifications | Messaging profile, token and conversations with notifications, notification log | Performance of the contract (art. 6(1)(b)); notifications, consent (art. 6(1)(a)) | The notification log, 90 days. The profile, the token and the conversations with notifications, for as long as your messaging profile exists (see "Retention") |
| Voice and video calls | Who calls whom, when, whether it is a video call, whether it was answered and whether it was made from the app or from the web; the phone's notification token and whether it is an iPhone or Android; if we ask you to confirm a browser on your phone, a temporary copy of its type and its operating system | Performance of the contract (art. 6(1)(b)) | Call logs: up to 90 days. Call data in the database: about 1 hour. Notification token: until you sign out or delete the account and, at most, 60 days after the app last renewed it. Copy in a browser confirmation: a few days after the session. In backups, up to 35 more days |
| Moving your history to the browser you link | Encrypted copy that we cannot read | Performance of the contract (art. 6(1)(b)) | The file, 72 hours; its technical record, 30 days |
| Linking browsers and using the QR code | For each linked browser, its type and operating system, public keys, identifier on the messaging network and dates; for the QR code, your identifier, the session status, the IP of the phone that scans it and, while it is being approved, the approximate country and city of the browser and a keyed fingerprint of its IP | Performance of the contract (art. 6(1)(b)); the IP, legitimate interest in security (art. 6(1)(f)) | Linked browser: until you delete your account, even if you disconnect it. Record of each QR session you complete, with the IP: at most, until you delete your account. Attempts not completed: they are not deleted with your account and may stay longer, with that IP and sometimes your identifier. Country, city and IP fingerprint: at most, one day |
| Taking payments with Jobchain Pay as a business | Authorised people, encrypted receipts, catalogue, sanctions check | Performance of the contract (art. 6(1)(b)); data on authorised people and the sanctions check, legitimate interest (art. 6(1)(f)) and legal obligation (art. 6(1)(c)) | For as long as you keep your account |
| Applying your plan's limits | Signature count | Performance of the contract (art. 6(1)(b)) | For as long as you keep your account |
| Paid plans | DID and purchase data; on the web, email and billing details | Performance of the contract (art. 6(1)(b)) and legal obligation (art. 6(1)(c)) | For as long as the plan lasts and then 6 years (art. 30 of the Spanish Commercial Code) plus the periods set by tax law |
| Business dashboard accounts | DID, name, email, role and activity log with IP | Performance of the contract with the business (art. 6(1)(b)) and legitimate interest in the security of the dashboard (art. 6(1)(f)) | For as long as the account exists; the activity log, 2 years, and its IP, 90 days |
| Verifying organisations and preventing impersonation | Company name, tax ID, domain, representatives, sanctions check and name review | Legitimate interest in protecting people against phishing (art. 6(1)(f)) and legal obligation (art. 6(1)(c)) | For as long as the organisation exists and then the limitation period for possible claims |
| Charging and invoicing businesses | Company name, tax ID, address, billing email, payments and invoices | Performance of the contract (art. 6(1)(b)) and legal obligation (art. 6(1)(c)) | 6 years (art. 30 of the Spanish Commercial Code) plus the periods set by tax law |
| Handling enquiries and reports | What you write to us and your email | Legitimate interest in assisting you (art. 6(1)(f)), performance of the contract (art. 6(1)(b)) or legal obligation (art. 6(1)(c)) for reports of unlawful content | As long as needed to resolve it and then the limitation period for possible claims |
When we process data on behalf of a business, the legal basis is decided by that business: see "Businesses that use Jobchain ID".
We do not take decisions based solely on automated processing that produce legal effects on you or similarly significantly affect you. If a verification is not completed, you can repeat it or write to us to have a person review it.
Residence verification
It is optional: it only works if you switch it on and give the app location permission.
- While it is on and the app is open, the app takes your location at most every 4 hours, also at night, because where you sleep is what shows where you live.
- Only a fingerprint of the area (about 5 km), the country and the time of each sample are stored on your phone, for 90 days. We do not receive your location; if you complete the verification, only the country reaches us.
- To know which country each sample is in, the app sends the coordinates of that moment, together with your IP address, to the Nominatim service of the OpenStreetMap Foundation (United Kingdom), which returns the country.
- You can stop it in the app or remove the location permission at any time.
Messaging, mail and calendar
- Messages, mail and calendar invitations are end-to-end encrypted on your device and travel over the open XMTP network, run by third parties: neither we nor they can read their content, although the network does see technical data (which identifiers communicate and when).
- To notify the recipient of a message, the sender's app calls our notification server, which receives who is writing, to whom, in which conversation and the message identifier, never its content, and delivers it to the recipient as a notification.
- When you link a browser, your phone can upload to our server an encrypted copy of your history to pass it to that browser. It is encrypted on your phone with a key we do not have, stored in Amazon Web Services in Frankfurt (Germany) and deleted after 72 hours.
- Voice and video calls. You can call from the app and, when it is available, from the web version (id.jobchain.com). The voice and video are end-to-end encrypted on your device with a key of their own for each call, which is created on the caller's device and travels over the encrypted messaging: neither we nor LiveKit, the company that carries the calls, can hear or see them. They are not recorded. The app and the web only play what arrives encrypted. To call or answer from the web, your browser asks you for permission to use the microphone and, in video calls, the camera; the browser may remember that permission for id.jobchain.com until you remove it in its settings. What is not encrypted is the data needed to connect the call:
- Jobchain ID logs who calls whom, when, whether it is a video call, whether it was answered and whether it was made from the app or from the web, with pseudonyms that change every day and that we can link to your account. Those logs are kept for up to 90 days. In the database, whom you called is forgotten within a few minutes and the rest of the call is deleted after about an hour. Our servers neither receive nor log how long the call lasts: the duration travels encrypted, like the chat, and stays in the history of both people.
- If we ask you to confirm a browser on your phone before you call or answer from it, we also keep in the database, together with your identifier, a temporary copy of the type of browser and operating system and of when you linked it and started the session, to show them to you on your phone. That copy is deleted a few days after the session; what we keep about the linked browser stays until you delete your account.
- The IP address. The call logs do not contain your IP address or your browser; those written before this version may contain them and are deleted after 90 days. The access log of our servers does keep, for these requests as for any other, the IP, the browser and the address requested, for 7 days (deletion may take a day or so longer). If our firewall blocks a request or flags it as suspicious, its log keeps that request's IP and headers, including the browser, for 30 days. Other requests to our servers leave the IP and the browser in their technical logs for 90 days.
- LiveKit sees when each device joins and leaves, and therefore how long the call lasts, the IP address, the approximate location and the connection type. From the phone, it knows whether you use an iPhone or Android. From the web, it receives what your browser sends when it connects (the browser, the operating system and the device type, with their versions) and knows that the call comes from id.jobchain.com. It receives a different pseudonym in each call, never your name or your Jobchain ID identifier. That technical data for each room can be consulted in the dashboard of our LiveKit account, and we can link it to your account.
- Apple or Google deliver the incoming-call notification to your phone, which carries the room identifier, whether it is a video call and when it expires, without your name or the caller's. The web version does not use that notification: if you have it open and allow it, it is your browser that shows you the notification.
- Documents. When the feature to store and share documents is available, documents will be stored encrypted with keys we do not have. Before switching it on we will complete this policy with its retention periods.
Businesses that use Jobchain ID
Some businesses use Jobchain ID (the business dashboard or the API) to check the identity of their customers, request data from them, let them sign in to their website, issue them credentials or send them documents.
- You decide what you share. Your phone shows you which data the business is requesting, who is requesting it and its verified domain, and nothing is shared without your approval.
- The business is the controller of the data it requests from you, issues to you and receives: it decides what it uses it for and how long it keeps it. Check its privacy policy.
- Jobchain ID, S.L.U. acts as the business's processor (art. 28 GDPR), under a data processing agreement that the business accepts when signing up. We follow its instructions and do not use that data for our own purposes.
- When you share data with a business, the response you approve passes through our servers: we check that it is authentic and deliver to the business the result and the data you agreed to share. We keep that response, to be able to resolve incidents, until you delete your account or the business asks us to delete it. If you want us to delete it earlier, write to soporte@jobchain.com.
- When a business issues you a credential, we keep a copy on behalf of that business, to deliver it to you and so that it can manage or revoke it, until you delete your account, even if the business revokes it.
- To exercise your rights over the data a business holds, contact that business. If you write to us, we will pass your request on to it.
Payments
- Purchases in the App Store or Google Play: payment is handled by the store with your account; we do not receive your payment details. To know whether your plan is active we use RevenueCat, which receives your DID and the purchase data the store gives it, not your name or your payment details.
- Web purchases and charges to businesses: processed by Stripe. Stripe acts as our processor for processing payments and as an independent controller for what the law requires of it (for example, fraud prevention and anti-money-laundering). We do not receive or store full card details.
What we do NOT do
- We do not sell your data or use it for advertising.
- We do not track you in other apps or websites and we do not use analytics or advertising cookies.
- We do not receive images of your face and we do not keep your name, your date of birth, your document number or its photo.
- We do not use the data you share with a business for anything else.
- We do not use your data to train artificial intelligence models. No feature open to users uses an artificial intelligence provider today; before opening one, we will update this policy.
Providers and recipients
Providers that process data on our behalf (processors, under contract):
- Amazon Web Services EMEA SARL: servers, database, storage, encryption keys, backups, temporary copy of the history and sending of verification emails (Amazon SES) and, when active, verification text messages (Amazon SNS). Frankfurt (Germany).
- Cloudflare, Inc.: DNS and protection against attacks. Global network; US company.
- Vercel Inc.: hosting of jobchain.com and the web version (id.jobchain.com). USA.
- Google (Firebase Cloud Messaging): delivery of push notifications. USA.
- RevenueCat, Inc.: status of your plans bought in the stores. USA.
- Stripe (Stripe Payments Europe, Ltd.): web payments and charges to businesses (also as an independent controller; see "Payments"). Ireland and USA.
- Jobchain group companies, when they provide us with shared technical means (for example, the corporate email we use to assist you). Spain and Austria.
- Microsoft Ireland Operations Limited (Microsoft 365): the corporate email we use to assist you (soporte@jobchain.com and privacidad@jobchain.com). EU, with possible access from the USA.
Third-party services the app connects to when you use a feature, and which process the data under their own responsibility (we do not give them your name):
- Apple and Google: device attestation, app stores and delivery of notifications, including call notifications. USA.
- LiveKit, Inc.: call servers, from the app and from the web version. It carries the encrypted voice and video without being able to open them, and processes their technical data (see "Messaging, mail and calendar") under its own responsibility and with its own retention periods. A US company: we cannot guarantee that the encrypted voice and video, or that data, do not pass through servers outside the European Union.
- The XMTP network and its history service: they carry your encrypted messages and see their technical data. Nodes in several countries.
- Alchemy Insights, Inc.: blockchain network access provider. When you use the wallet, from the app or from the web version, it looks up your wallet's balances and transactions and broadcasts the transactions you sign to the network (it receives the public addresses, the signed transactions and, when the app connects directly, your IP address). USA.
- Nodes and explorers of blockchain networks (for example, PublicNode, Solana, Blockstream or Blockscout): they receive the public addresses your wallet looks up and your IP address. Several countries.
- CoinGecko: market prices; receives your IP and which assets are looked up, not your addresses. Singapore.
- LATOKEN (LAtrade Limited): price of the JOB token; receives your IP and that lookup, not your addresses. Saint Vincent and the Grenadines.
- OpenStreetMap Foundation (Nominatim): only in the residence verification; coordinates and IP. United Kingdom.
- The businesses with which you decide to share data.
- Authorities, when the law obliges us.
Transfers outside the European Economic Area
- United States (Cloudflare, Vercel, Google, Apple, Microsoft, RevenueCat and Stripe): transfers are based on the EU-US Data Privacy Framework when the company participates in it and, otherwise, on the European Commission's standard contractual clauses.
- United Kingdom (OpenStreetMap Foundation): European Commission adequacy decision.
- Nodes of the blockchain and XMTP networks, Alchemy (USA), LiveKit (USA), CoinGecko (Singapore) and LATOKEN (Saint Vincent and the Grenadines): the app or the web version connect to them only when you use the wallet, messaging or calls, because without that connection we cannot provide those features to you (article 49(1)(b) GDPR: transfer necessary for the performance of the contract you ask us for).
You can ask us for information about these safeguards, or a copy, at privacidad@jobchain.com.
Retention and deletion
- The data on your phone (keys, biometrics, document, credentials and location samples) is under your control and is deleted when you reset your identity or delete the app.
- The data on our servers is kept for the periods in the table "What we use it for".
- If you delete your account in the app (Settings › "Delete account"), we delete from our identity server your record (DID, public key, email, phone, wallet addresses, payee name, verification data and fingerprints), your credentials, your sessions (not QR attempts you did not complete, which may stay longer), your linked browsers, your temporary history, your signature count, the call notification tokens of your phones (if calls are not active on our server at that moment, they are deleted on their own within 60 days at most) and, if you take payments as a business, your authorisations, receipts and catalogue. The audit log is not deleted with your account: the link to your account is removed, but its entries may keep your DID until they are 2 years old (the IP address, 90 days).
- Two records are also not deleted with your account and, for now, have no deletion period. If your email moved from one identity to another, the record of that transfer, with both identifiers (DIDs), a keyed fingerprint of the email and its dates. Until the transfer is closed (normally 72 hours after we send you the notice to undo it), it also keeps the email address, encrypted, even if you delete your account in the meantime. And a fingerprint of your identifier with the date of deletion, so that the account does not reactivate on its own from another phone; it is removed if you register it again with your recovery phrase.
- Your messaging profile, your notification token and the notification log are on another server and are not yet deleted when you delete the account: write to soporte@jobchain.com and we will delete them within one month.
- Backups are made every day, encrypted, at Amazon Web Services (Frankfurt), with a duplicate in a separate account used only for backups, and are deleted after 35 days: what you delete disappears from them at the latest 35 days later.
- Billing data is kept for six years (art. 30 of the Spanish Commercial Code), in addition to the periods set by tax law.
Your rights
- You can exercise the rights of access, rectification, erasure, restriction, portability and objection (the latter against processing based on legitimate interest).
- Where we process data with your consent (notifications, location for the residence verification and on-phone biometrics), you may withdraw it at any time, without affecting what was done before.
- As a self-sovereign identity, you directly control the data on your phone. You can delete your account from the app. For everything else, write to privacidad@jobchain.com. We will reply within one month.
- If you think we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or with the data protection authority of your country.
Minors
Jobchain ID is not aimed at children under 14. If we learn that a person under 14 has given us data without the permission of their parents or guardians, we will delete it.
Changes
We will publish each version of this policy here with its number and date. If a change significantly affects how we process your data, we will tell you in the app or by email before it applies.