Biometric Data Policy

Identity verification on Hardline is performed by Stripe, Inc. (“Stripe”), our identity-verification service provider. Stripe captures an image of your government-issued identification and a short video selfie, generates a biometric face template, and compares it to your ID photo to confirm your identity.

Hardline does not receive, store, possess, or have access to any biometric identifier, biometric information, source images, or any data from which a biometric template could be reconstructed. Hardline receives only (i) a pass/fail verification result, (ii) a Stripe-assigned session reference number, and (iii) certain non-biometric document fields you authorize Stripe to release (such as the name, date of birth, and document number printed on your identification).

Stripe is the controller of any biometric template generated during verification, and Stripe’s handling of biometric data is governed by Stripe’s privacy policy and applicable law.

Biometric data is collected by Stripe solely to verify your identity to Hardline. The purposes of collection are: (a) to confirm your identity for purposes of marketplace participation; (b) to detect and prevent fraud; and (c) to comply with applicable anti-money-laundering, sanctions-screening, and contractual due-diligence obligations.

Stripe retains biometric data only as long as necessary to perform identity verification and as required by Stripe’s published retention schedule. Hardline retains the verification result and session reference for the duration of your account and for five (5) years thereafter, consistent with the recordkeeping requirements of 31 C.F.R. § 1010.430 and applicable state anti-fraud rules. Hardline never retains biometric identifiers or biometric information.

Neither Hardline nor, to Hardline’s knowledge, Stripe sells, leases, trades, or otherwise profits from biometric identifiers or biometric information.

Neither Hardline nor, to Hardline’s knowledge, Stripe will disclose, redisclose, or otherwise disseminate biometric data unless: (i) the subject consents; (ii) disclosure completes a financial transaction the subject authorized; (iii) disclosure is required by law; or (iv) disclosure is required by a valid warrant or subpoena.

Hardline does not currently make the Service available to residents of Illinois and does not direct Illinois residents into the Stripe Identity verification flow. If you believe you are an Illinois resident and have nevertheless been routed into identity verification, please contact privacy@hardlinelending.com immediately. If Hardline expands to Illinois in the future, we will obtain informed written consent and release in compliance with 740 ILCS 14/15(b) before any biometric collection begins.

Hardline is not the entity that captures or possesses biometric identifiers; Stripe is. To the extent that Tex. Bus. & Com. Code § 503.001 (CUBI) or RCW 19.375 imposes obligations on persons who “capture” or are “in possession of” biometric identifiers, those obligations attach to Stripe. Hardline nevertheless represents that it does not sell biometric identifiers, does not retain biometric identifiers, and uses biometric verification results only for identity verification and fraud prevention.

Biometric-data questions: privacy@hardlinelending.com