Privacy Policy

Effective Date: 27/08/2026

SafeJAM Ltd ("SafeJAM", "we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and disclose your personal data when you access or use our software-as-a-service platform (the “Service”).

This policy complies with applicable data protection legislation, including the UK Data Protection Act 2018 and the EU General Data Protection Regulation (EU) 2016/679 (“GDPR”).

1. Data Controller

The data controller is:

SafeJAM Ltd
Email: securityandcompliance@safejam.com
167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF

2. Data We Collect

We collect and process the following data for the purpose of delivering our Service:

Email address: Required for registration and authentication
Purchase data: Purchase/subscription status and transaction history
Technical data: Device/browser information and IP address
Usage data: Interactions with the Service, collected anonymously via analytics
Remote-session security data: Network requests and running software and processes, together with associated timestamps and session identifiers
Identity and age-verification data: When verification is required, our provider, Didit, processes identity-document images and the identity data shown on or extracted from them, such as your name, date of birth, nationality, document type and document number
Biometric and liveness data: Didit processes your selfie or liveness capture, facial characteristics derived from those images or video, face-match results and anti-spoofing signals
Verification technical and fraud-prevention data: Didit processes information such as your IP address, browser and device data, timestamps, session data, network-derived location and related fraud or integrity signals
Verification outcome: We receive and store whether the verification is pending, successful or unsuccessful, whether identity and over-18 checks passed, and limited administrative metadata such as the verification time and Didit session/workflow identifiers

The Service is not intended for anyone under the age of 18. An attempted age-verification check may nevertheless process data showing that a person is under 18, in which case access to restricted products will not be granted. If you are a parent or guardian and believe a child has provided us with personal data, please contact us.

We may collect personal data from you when you contact us for support or inquiries. This may include your name, email address, and any other information you provide.

Biometric data used uniquely to identify you is special category personal data. It is processed by Didit on our behalf only where identity or age verification is required. SafeJAM does not store copies of your identity document, document details, date of birth, selfie or liveness capture, biometric template, face-match score, IP/device analysis, or Didit's full verification report in its systems.

3. Lawful Basis for Processing

We process your personal data under the following legal bases:

Contractual necessity: To provide access to the Service (Art. 6(1)(b) GDPR)
Legitimate interests: To improve functionality, ensure security, and manage user subscriptions (Art. 6(1)(f) GDPR)
Legal obligations: Where required by applicable law (Art. 6(1)(c) GDPR)
Consent: For optional analytics cookies and processing that requires your permission (Art. 6(1)(a) GDPR)

For identity and age verification, we rely on contractual necessity and our legitimate interests in restricting eligible products to identity-verified adults and preventing fraud (Articles 6(1)(b) and 6(1)(f) GDPR, as applicable). Where the verification involves biometric data used uniquely to identify you, we rely on your explicit consent under Article 9(2)(a) GDPR. You may withdraw that consent before or during verification, but we may then be unable to provide products that require verification. Withdrawal does not affect processing already carried out lawfully.

We process remote-session security data on the basis of our legitimate interests in protecting the Service and others, detecting and investigating abuse, enforcing our terms, meeting compliance obligations, and establishing, exercising or defending legal claims. We limit access to authorised personnel and apply safeguards intended to reduce unnecessary access and use.

4. Payment Information

All payment processing is handled by Stripe, Inc. SafeJAM does not store or access your payment card data. You will be redirected to Stripe for payment processing, to access invoices, and manage subscription data. For more information, please see the Stripe Privacy Policy.

5. Use of Your Information

Your data is used for the following purposes:

User account management
Authentication and access control
Subscription billing and renewal
Technical delivery via AWS AppStream and associated support
Security monitoring and service analytics
Detecting, investigating and documenting suspected misuse, security incidents and violations of our terms
Confirming identity and that you are aged 18 or over before providing access to restricted products
Detecting impersonation, document tampering, spoofing, fraud and abuse

We will only use data collected for the purposes outlined, unless we reasonably consider that we need to use it for another reason and that reason is very similar and compatible with the original purpose.

6. Data Retention

We retain personal data only as long as necessary to fulfill the purposes outlined or as required by law. If you delete your account, your personal data will be permanently erased from our systems unless retention is legally required.

Remote-session security data is retained only for as long as reasonably necessary for security review, abuse prevention, compliance, dispute handling or legal claims. Relevant records may be preserved for longer where an incident is under investigation, a legal hold applies, or disclosure is required by law.

SafeJAM retains only the verification outcome and limited administrative metadata described above, for as long as needed to manage your access, demonstrate that the required check took place, prevent fraud, resolve disputes, and meet legal obligations. The underlying verification data is held by Didit rather than in SafeJAM's systems. We configure Didit to retain that data for one year from the verification session, subject to earlier deletion or any different period required or permitted by applicable law, a valid legal request, or dispute resolution. You may contact us to request deletion or exercise your rights in relation to a Didit verification.

7. Data Sharing and Processors

We do not sell your personal data, nor use it for any purposes other than listed in this policy. We do process your data using trusted third party platforms to support delivery of our Service, including:

Amazon Web Services (AWS) – Hosting, user authentication, streaming applications
Stripe – Payment processing
Google - Anonymized website usage data
Didit – Identity and age verification, biometric/liveness checks, and fraud prevention

SafeJAM generally acts as controller for deciding why verification is required and how the outcome is used. Didit generally acts as our processor when performing the configured checks, although it may act as an independent controller for limited purposes such as security, abuse prevention, legal compliance, audit logging and legal claims. Verification data is processed in the European Union by default. Where personal data is transferred internationally, we or our processors use an applicable lawful transfer mechanism.

Remote-session security data may be processed by infrastructure and security service providers acting on our behalf. We may disclose relevant records to law-enforcement authorities, regulators, courts, or other competent bodies where required by law or where otherwise lawful and necessary to investigate serious misuse, protect rights or safety, or establish, exercise or defend legal claims.

For details of the applicable checks and access rules, see our Identity and Age Verification Policy. For details of Didit's processing, see its Verification Privacy Notice.

8. Cookies

We use cookies to enhance your experience:

Essential Cookies: Required for login and application streaming functionality
Analytics Cookies: Help us understand user interaction (used with consent only)

We do not use cookies for marketing, profiling, or cross-site tracking. You can manage your cookie preferences via your browser settings or through our cookie banner.

9. Your Rights

You have the following rights regarding your personal data:

Right to access
Right to rectification
Right to erasure (“right to be forgotten”)
Right to restriction of processing
Right to data portability
Right to object
Right to withdraw consent
Right to challenge automated decision making and profiling
Right to lodge a complaint with a supervisory authority

To exercise any of these rights, please contact us at securityandcompliance@safejam.com.

10. Automated Verification

Didit uses automated systems to assess document authenticity, face match, liveness and fraud indicators. SafeJAM uses the resulting identity and over-18 outcome to decide whether restricted products can be made available. If verification is unsuccessful, you may try again and may contact us to request assistance or human review, or to contest a decision that significantly affects you.

11. Changes to This Policy

We reserve the right to amend this Privacy Policy to reflect changes in legal, technical, or business developments. Where required by law, we will notify you of any material changes via the Service or by email.

12. Contact Information

If you have any questions about this Privacy Policy or our data practices, please contact: