Privacy policy

Effective 7 August 2026 · Last updated 7 August 2026

This policy covers two groups of people. Customers are the website owners who hold a DeSpoof account. Visitors are the people who complete a liveness check on a customer's website. The rules are different for each, so both are set out below.

1. The camera, in full

DeSpoof exists to confirm that a live person is present. Because that involves a camera, this section says exactly what happens, ahead of everything else.

What happens during a check

• The camera opens inside a frame served from despoof.com. The website you are visiting never receives the camera stream.
• The view is measured on your own device, frame by frame, while you follow the prompts.
• What leaves your device is a short set of numbers: how far your head turned, how far your eyes closed, how large your face was in the frame, how long each response took, and how much the reading varied.
• Those numbers are compared against the thresholds for that website and then discarded. The result is a pass or a fail, plus a confidence score.
• The camera is released the moment the check ends.

What is never collected

• No photographs. Not on our servers, not in any dashboard, not as a thumbnail.
• No video, and no frames from video.
• No face templates, face geometry, face maps, or biometric identifiers of any kind.
• No searchable library of faces, because there is nothing in it to search.

This is a limit on what the product can do, not only a promise about what we choose to keep. Neither we nor the website you are using can retrieve an image of your face, because one was never created. A breach of DeSpoof cannot expose the people who used a customer's website.

What is recorded about a check

One row is written per attempt, containing the date and time, the IP address the request came from, the user agent string your browser sent and the browser, operating system and device type read from it, the website that asked for the check, the customer's own reference for the action, which prompts were asked, how long each took, whether it passed, and the reason if it did not.

This is kept so the customer can see what happened on their own site, investigate abuse, and enforce their own limits. It is the same category of record a web server keeps.

Consent

The camera opens only after you agree to it, on a screen shown before it starts. The wording is set by the website you are using. If you would rather not, close the check. The website should offer another way through, and it is their responsibility to provide one.

2. Information we collect from customers

• Name and email address
• A hashed password
• Website addresses, widget settings and callback URLs
• Sign-in times, IP address and browser at sign-in, and session records
• Billing details, where a paid plan is taken, handled by our payment provider

3. How the information is used

• Running the checks a customer has asked for
• Enforcing a customer's own throttling and approved website settings
• Counting usage against a plan
• Securing accounts, preventing abuse and investigating faults
• Answering support requests and sending service notices

Personal information is not used for advertising or profiling.

4. No sale, no sharing, no tracking

We do not sell, rent or trade personal information, and we do not share it with advertisers. We do not use third-party analytics or advertising platforms, and there are no behavioural tracking cookies on this site. Cookies are used only to keep a customer signed in to the dashboard and to protect forms against cross-site request forgery.

5. Third parties

DeSpoof runs on infrastructure we operate. Fonts, scripts and the liveness engine are served from our own servers, so loading a page or a check does not tell anyone else that you were here. Where we use an outside provider for payments or email delivery, that provider acts only on our instructions and only for that purpose.

6. Retention

• Attempt records are kept for 90 days and then deleted.
• Throttling records are kept for 2 days.
• Monthly totals are kept as counts only, with nothing identifying in them.
• Account information is kept while the account is open, and removed when it is closed.
• Camera images are not retained at all, as set out in section 1.

7. Roles under data protection law

For information about visitors completing a check, the customer whose website asked for the check decides why it happens, and DeSpoof processes it on their instructions. Customers are responsible for having a lawful basis, for telling their visitors, and for offering an alternative route for anyone who cannot or will not use a camera.

For customer account information, DeSpoof decides how it is handled.

8. Your rights

Subject to local law, you may ask to see the information held about you, correct it, have it deleted, receive a copy, withdraw consent, or object to how it is handled. Visitors should contact the website that asked for the check first, since they hold the account. Customers can contact us directly.

9. Security

• Encryption in transit for every request
• Passwords and secret keys stored only as hashes
• Widget access limited to the website addresses a customer has approved
• Single-use codes with a short lifetime
• Restricted administrative access, firewalling and monitoring

No system connected to the internet can be guaranteed secure, and we do not claim otherwise.

10. Children

DeSpoof is sold to website operators, not to children. Customers are responsible for whether it is appropriate to ask a given visitor to use a camera, and for meeting any age-related rules that apply to them.

11. International transfers

Our servers are located in Australia. Using the service from elsewhere means the information described here is handled there.

12. Legal disclosure

We disclose information only where required to comply with the law, to answer a valid legal request, to protect our rights, or to prevent fraud or a threat to safety. There is no camera image to disclose in any of those cases.

13. Changes

We may update this policy. Material changes will be posted here and, where appropriate, emailed to customers.

14. Contact

DeSpoof
Email: office@despoof.com
Website: despoof.com