Message Domains

Biometric Information Policy

Version 1.0 · November 9, 2026

This policy explains how Osher Mevin, Inc., doing business as Message Domains (“we”), handles biometric information. It is our public written policy under the Illinois Biometric Information Privacy Act (740 ILCS 14/15(a)), and it is the notice we give before any biometric information is collected under that Act, the Texas law on the capture or use of biometric identifiers (Tex. Bus. & Com. Code § 503.001), Washington’s biometric identifier law (RCW 19.375) and other state laws. Washington residents should also read our Washington Consumer Health Data Privacy Policy.

1. When biometric information is collected

Only in one case: the own-name check. A label that names a person may be leased by the person whose legal name it is (Terms of Service, section 5.3(b)). To confirm that you are that person, Stripe Identity, our identity-check provider, photographs your government ID, takes a live selfie and compares your face in the selfie with the photo on the ID. To compare them, Stripe measures the geometry of the two faces. Those face measurements, and the face images they come from, are the biometric information this policy covers.

No other part of the service collects biometric information. The ID check without a selfie that some other leases need does not compare faces.

Before we send you to Stripe for an own-name check, we show you this notice in short and ask you to tick a box that says you agree. The box is your written release. Until you tick it, we do not start the check. We record your account, the person signed in, the version of this policy you agreed to, the time and the check it is for, in an append-only log. Stripe also asks for your consent in its own flow before it captures your face.

If you do not agree, you can still use every other part of the service. You cannot lease a label under section 5.3(b) without the check.

3. What we receive and what we do not

Stripe collects the ID images, the selfie and the face measurements, and processes them for us as our service provider. We never receive, see or store them. Stripe tells us whether the check passed and the first name and surname printed on the ID. The name and the result are not biometric information; our Privacy Notice covers them.

4. Purpose

The face comparison has one purpose: to confirm that the person taking the selfie is the person on the ID, so that only the person whose legal name a label is can lease it. We do not use biometric information, or let Stripe use it on our behalf, for any other purpose. We do not use it to identify you anywhere else, to track you or to advertise to you.

5. No sale and limited disclosure

We do not sell, lease, trade or otherwise profit from biometric information. We do not disclose it to anyone except:

  • Stripe, which collects and processes it for us as described above;
  • when you, or someone authorized to act for you, ask us to in writing;
  • when a federal, state or local law requires it; or
  • when a valid warrant or subpoena issued by a court requires it.

6. Retention and destruction

We ask Stripe to delete each check’s ID images, selfie, face measurements and other personal data (Stripe calls this “redaction”):

  • as soon as the check passes and we have recorded the result and the name, which happens within minutes; and
  • for a check that did not pass or was not finished, two days after it started, once its link has expired.

Stripe completes the deletion within 7 days of our request. In every case biometric information is destroyed no later than the earliest of: when the purpose in section 4 has been met; 1 year after that; and 3 years after your last interaction with us.

If, in Stripe’s own flow, you separately allowed Stripe to use your data to improve its verification technology, that permission is between you and Stripe under Stripe’s privacy policy. You can withdraw it, or ask Stripe to delete any copy it keeps, through Stripe’s support form at support.stripe.com.

7. How it is protected

Biometric information is stored, sent and protected with at least the care we, and Stripe, use for other confidential and sensitive information, and with the reasonable standard of care in our industry. Stripe encrypts it in transit and at rest and limits who can reach it. Our systems never hold it.

8. Your choices

You can ask us at any time to confirm that a check’s biometric information has been deleted, or to delete it now if it has not been. Write to privacy@messagedomains.us from the email address on your account. We act within 30 days and tell you when it is done.

9. Changes

We post changes here with a new version and date. A change that would let us use biometric information for a new purpose would take effect only after we ask for, and you give, a new consent.

10. Contact

privacy@messagedomains.us · Osher Mevin, Inc., 16192 Coastal Highway, Lewes, Delaware 19958