Privacy Policy
Last updated: 8 October 2026
lumex.id ("we", "us") provides identity verification for websites and apps: a live scan of a national ID card or passport, a liveness check and a face match. This policy explains what personal data we handle, why, and for how long.
Two different roles
Visitors and customers. When you visit lumex.id, contact us or open a business account, we decide how your data is used.
People being verified. When a business (our customer) asks you to verify your identity through lumex.id, that business decides why your data is needed. We process it on their behalf and only to run the check. For questions about why you were asked to verify, contact that business first.
Data from our website
- Contact form: your name, company, work email, website, expected volume and message.
- Technical data: IP address, approximate country, browser type and request logs, used to run and protect the site.
- No advertising cookies. We do not use tracking or advertising cookies. Our pages load fonts from Google Fonts, which receives your IP address when the font is downloaded.
Data processed during a verification
- Images of your document: the front and back of an ID card, or the photo page of a passport.
- Data read from the document's code lines: name, document number, nationality, date of birth, sex and expiry date.
- Selfie frames captured during the liveness step, and the face-match similarity score.
- Technical signals about the capture, such as device and browser type, used to detect fraud.
- A record of your consent, with the time it was given.
Face images are biometric data. Our Biometric Data Notice explains how we handle them.
Why we use it
- To confirm that a document is readable and consistent, that a real person is present, and that the person matches the document photo.
- To send the result to the business that requested the check.
- To detect and prevent fraud and abuse of our service.
- To answer your messages and manage customer accounts and billing.
We do not sell personal data, use it for advertising, or use verification images to train models.
How long we keep it
- Document and selfie images are deleted once the result is decided. If a verification is started but not finished, its images are deleted within 24 hours.
- The result (decision, check outcomes, document type and country, and the data read from the code lines) stays in the customer's account until the customer deletes it or closes its account.
- Contact form messages are kept for up to 24 months, then deleted.
Who we share it with
- The business that asked you to verify receives the result.
- Cloudflare hosts, stores and processes our service on its global network.
- We may disclose data when required by law.
Security
Data travels over HTTPS and is stored encrypted, in private storage with no public links. Access is limited to what is needed to run the service.
Your rights
Depending on where you live, you may have the right to access, correct or delete your personal data, or to object to its use. For a verification, please contact the business that asked you to verify; we will help them answer. For anything else, contact us through the form below.
Changes
We will update this page when our practices change and show the new date at the top.
Contact
Use the contact form on our home page. We reply within one working day.