Privacy policy.

This Privacy Policy describes how ToTóo ("we," "us," or "our") collects, uses, processes, and discloses information when you use our website, applications, and identity verification services (collectively, the "Service").

We are committed to protecting your privacy and handling your data with the highest standard of care. By design, ToTóo minimises the personal data it collects and never has access to certain sensitive information (such as your biometric data or encrypted documents) due to the cryptographic architecture of the Service.

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described here, please do not use the Service.

ToTóo is the data controller responsible for the processing of personal data collected through the Service.

For any questions, requests, or concerns relating to this Privacy Policy or the handling of your personal data, please contact our Data Protection Officer at: privacy@totoo.id.

Where required by applicable law (including the EU General Data Protection Regulation), you may also lodge a complaint with your local data protection authority.

Account information: email address, display name, and authentication metadata used to create and secure your account.

Public key material: the credential ID and public cryptographic key generated by your device during biometric registration. These are required for the FIDO2 / WebAuthn verification flow.

Encrypted documents: any ID documents you choose to upload are encrypted in your browser using a device-bound AES-256-GCM key before they reach our servers. We hold only ciphertext and cannot decrypt it. Because the key is device-bound, encrypted documents are only readable from the device that encrypted them and are unrecoverable if that device is lost.

Verification records: who verified whom, when verification occurred, which attributes were shared, and cryptographic counters used to detect cloned authenticators.

Usage and operational data: IP address, browser type, timestamps, error logs, and feature usage needed to maintain security, prevent abuse, and improve reliability.

Raw biometric data: your fingerprint, face, or other biometric characteristics never leave your device. The authenticator returns a signed assertion only.

Private cryptographic keys: generated and stored exclusively within your device's secure hardware (Secure Enclave, TPM, or hardware security key). They are never transmitted to us.

Decrypted document contents: encryption keys are derived from device-bound material we do not possess. Decryption is mathematically impossible on our side and also impossible from any device other than the one that performed the original encryption.

Cross-site tracking data: we do not embed advertising networks, third-party analytics, or social media trackers. We do not sell or rent personal data.

To operate, maintain, and secure the Service.

To process identity verification requests initiated by you or by parties you interact with through the Service.

To detect, prevent, and respond to fraud, abuse, security incidents, and other harmful activities.

To communicate with you about important service announcements, security notices, and changes to our terms.

To comply with applicable legal obligations and respond to lawful requests from public authorities.

We do not use your personal data for marketing, advertising, profiling, or any automated decision-making that produces legal or similarly significant effects.

We do not sell, rent, or trade personal data to third parties for their commercial purposes.

Service providers: we share limited data with vetted infrastructure providers under strict data processing agreements — Supabase (hosting and authentication), Vercel (content delivery), Resend (delivering contact-form submissions: the name, email address, subject, and message you submit), and Didit (identity verification, described below).

Verification participants: when you initiate or participate in a verification, limited information (such as the attributes you choose to share) is revealed to the other party.

Legal compliance: we may disclose information when required by law, valid subpoena, court order, or to protect the rights, property, or safety of ToTóo, our users, or others.

Business transfers: if ToTóo is acquired or merges with another entity, your data may be transferred under continued protection of this Privacy Policy or a successor policy with equivalent protections.

We retain personal data only for as long as necessary to provide the Service and comply with legal obligations.

Account data: retained while your account is active. Upon account deletion, we delete or anonymise your data within 30 days, except where retention is required by law.

Verification records: retained to provide auditable proof of past verifications. You may request deletion of past verification records subject to legal record-keeping requirements.

Encrypted documents: stored only as ciphertext. Deleting your account removes the associated documents.

Backups: residual data in encrypted backups may persist for up to 90 days before being overwritten.

ToTóo uses infrastructure providers in multiple regions, which may result in your data being transferred to and processed in countries other than your country of residence.

Where required by applicable law (including GDPR), we use appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, or rely on adequacy decisions.

By using the Service, you understand that your data may be transferred to countries with different data protection standards than your home jurisdiction.

We implement industry-standard technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, and destruction.

These measures include encryption in transit and at rest, access controls, audit logging, security monitoring, and regular security reviews.

No system is perfectly secure. If a security breach affects your personal data, we will notify you and relevant authorities as required by law.

Your identity private key and your document encryption key are both bound to the device that created them. They are never sent to us and we cannot recover them on your behalf.

If you lose access to a device, the following is and is not recoverable: account credentials can be re-established from a new device by registering a new biometric or hardware key; profile data and verification history remain accessible from any device once you sign in. Encrypted ID documents uploaded on the lost device are not recoverable — neither by you nor by us — because the decryption key died with the device.

We recommend registering at least two devices (for example, your phone plus a hardware security key) so that losing one does not lock you out of your account. If you want your encrypted documents available on a new device, you must re-upload them there.

We may in the future offer an optional, user-controlled backup mechanism in which the document encryption key is wrapped with a passphrase only you know and stored as ciphertext on our servers. We will never have access to your passphrase or the unwrapped key. Until such a feature is available, encrypted documents remain strictly device-bound.

Access: you can request a copy of the personal data we hold about you.

Rectification: you can request correction of inaccurate or incomplete data.

Erasure: you can request deletion of your personal data, subject to legal retention requirements.

Restriction: you can request that we limit processing of your personal data in certain circumstances.

Portability: you can request a machine-readable copy of data you provided to us.

Objection: you can object to processing based on legitimate interests, including profiling.

Withdraw consent: where processing is based on consent, you may withdraw it at any time.

Lodge a complaint: you have the right to lodge a complaint with a supervisory authority in your jurisdiction.

To exercise these rights, contact privacy@totoo.id. We respond to verified requests within 30 days.

The Service is not directed to children under the age of 18, and we do not knowingly collect personal data from children.

If you believe a child has provided us with personal data, please contact privacy@totoo.id so we can take appropriate action.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law.

When we make material changes, we will notify you by email (where you have provided one) and by posting a notice within the Service at least 30 days before the changes take effect.

The "Last updated" date at the top of this policy indicates when the latest changes were made. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.