This privacy policy describes how we collect, use, and safeguard your personal information when you use our website and services.
We collect information that you provide directly to us, such as when you create an account, make a purchase, or contact us for support. This may include your name, email address, mailing address, phone number, and payment information. We also collect a selfie you provide when you create a Korrald account, as described in Section 2 below.
When you create a Korrald account, you take a one-time selfie inside the app. We use that selfie, together with the third-party services described below, to generate a scan of your face geometry and search for other images of you appearing elsewhere online. That scan of your face geometry is biometric information, and we obtain your informed written consent before your first selfie is captured, through the consent screens described in the app.
Your selfie is transmitted to and stored on our servers, hosted by Google Firebase, and is encrypted at rest using customer-managed encryption keys. We keep one current copy of your selfie for as long as your subscription remains active, because we use it to run your scans on an ongoing basis. The moment you cancel your subscription, we stop using your selfie for scanning and delete it from our servers — cancellation itself triggers deletion of your selfie, not a later account-closure step. Your scan results are handled on the separate schedule described in Section 4 below.
To search for matches, we send your selfie to a third-party facial recognition and image-matching service provider. As of the date of this policy, that provider is Amazon Web Services’ Rekognition service, which checks the confidence of any match our system finds. We also generate a brief, temporary link to your selfie so that a general-purpose reverse-image search provider can check for additional matches, which involves submitting your image to Google, through Google Lens, and Bing, through Bing Reverse Image Search; that link is disabled immediately after each scan. We may add, remove, or change these service providers as our technology needs change. When we do, any new provider performing facial recognition matching or confidence scoring will be bound by an agreement limiting its use of your image to providing that service to us, and this policy will continue to describe the category of service being performed even as the specific provider changes.
We do not sell your selfie or any information derived from it. We do not use your selfie to train machine learning models. We do not collect government-issued identification.
We use the information we collect to:
Your selfie is retained for as long as your subscription is active and is deleted immediately when you cancel your subscription. The URLs, screenshots, and other details of any matches we find are retained for as long as your account remains open and are deleted within thirty days of account closure, plus whatever additional time is needed to resolve any removal request you have already started. If you use Express Lasso, the evidence dossier generated for you, including its chain-of-custody information, is retained only until the purpose for which it was generated has been satisfied, and in any event no later than three years after your last interaction with us, unless you ask us to delete it sooner. Records showing that you consented to our collection and use of your information, and any attestations you make within the app, are retained for as long as your account exists and for a period afterward sufficient to demonstrate our compliance with applicable law, even after other data associated with your account has been deleted.
Canceling your subscription stops all scanning, stops us from sending your selfie to any third-party service provider, and deletes your stored selfie immediately. It does not delete your account or your other stored data, such as scan results — your account remains available if you choose to resubscribe. If you want the rest of your data deleted, you can request that at any time using the mechanism described in Section 6 below, or by closing your account entirely.
We do not sell, trade, or rent your personal information to third parties. We work with service providers who help us operate Korrald. These currently include: a facial recognition and image-matching provider (Amazon Web Services’ Rekognition service), a general-purpose reverse-image search provider (SerpAPI, which queries Google Lens and Bing Reverse Image Search), our hosting and database provider (Google Firebase / Google Cloud), our email delivery provider (SendGrid), our SMS provider (Twilio), and our subscription billing provider (RevenueCat). If we add a data broker scanning service to search for your other personal information, such as your name, phone number, or address, on data broker and people-search sites, we will identify that category of service here once it is in place. We may change which specific company performs any of these functions; when we do, the category of service being performed will stay the same and this policy will be updated to reflect the change. We require each of these service providers to use your information only to provide their service to us, and not for their own independent purposes.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.
We implement appropriate security measures to safeguard your personal information against unauthorized access, alteration, disclosure, or destruction.
You have the right to access, update, or delete your personal information at any time. You may also opt out of receiving marketing communications from us.
If you are a California resident, you have the right to ask us what personal information we have collected about you, to ask us to delete that information, to correct inaccurate information, and to opt out of the sale or sharing of your personal information. We do not sell your personal information. You can submit any of these requests at korrald.com/privacy-request or by emailing privacy@korrald.com. We will respond to a verified request within thirty days. We treat your selfie and any biometric information derived from it as sensitive personal information and do not use it for any purpose beyond providing the Korrald service to you.
If you reside in Illinois or another state with a biometric privacy law, this section provides the disclosures required under those laws in addition to the biometric information described above. We generate a scan of your face geometry from your selfie only after you provide informed written consent through the in-app consent screens described above, which tell you the specific purpose and length of time for which your biometric information will be collected, stored, and used. We do not sell, lease, trade, or otherwise profit from your biometric information. We destroy your biometric information when the purpose for collecting it has been satisfied, and in any event no later than three years after your last interaction with us, using industry-standard secure deletion practices. We protect your biometric information using the same or a higher standard of care that we use to protect other confidential and sensitive information.
We use cookies to enhance your experience on our website. You can choose to disable cookies through your browser settings, though this may affect the functionality of the site.
We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page.
If you have any questions about this Privacy Policy, please contact us.