Effective Date: 2 October 2026
At Check ID SA, we value your privacy and are committed to protecting personal information. This Privacy Policy explains how we collect, use, and safeguard data when you use https://checkid.co.za, the Check ID SA web app, APIs, and the Check ID SA Android mobile app.
1. Data We Collect
We collect the following data:
Account Information: Name, email address, authentication identifiers, team or organisation membership, and subscription status.
Payment Information: Payment and billing details are processed by Stripe. We do not store full card numbers.
Validation Inputs: ID numbers or document barcode data that you choose to validate.
Mobile App Data: Device identifiers generated by the app, device model and operating system information, app version, device name, mobile check-in activity, and mobile scan activity timestamps.
Feedback and Support: Name, email address, and messages you submit through contact or feedback forms.
Marketing Communications: Discount codes, special offers, product announcements, and service updates.
Analytics and Technical Information: Website or app pages viewed, selected feature events, operating system, app version and build number, language, screen size, and approximate country, region, or city derived from the network request.
2. How We Use Your Data
To provide account access, subscriptions, API access, team features, and mobile app access.
To perform structural South African ID validation, including format, date of birth, age, gender indicator, citizenship indicator, and checksum checks.
To register and manage mobile devices connected to your account or organisation.
To support offline mobile access windows and sync mobile scan activity when a device reconnects.
To respond to support requests and feedback.
To send product updates and promotional communications where permitted. You may opt out of marketing emails at any time.
To monitor, secure, debug, measure, and improve the service.
3. Data Sharing
We do not sell your personal data. We use trusted service providers where necessary to run the service, including authentication, hosting, database, email delivery, analytics, payments, and error monitoring providers. These providers process data only for the purposes of operating Check ID SA.
Ordinary structural validation does not query a government database. Paid Home Affairs verification orders are processed manually through an upstream verification provider. CheckID is not affiliated with the Department of Home Affairs.
4. Children's Privacy
CheckID does not knowingly collect any personal information from children under the age of 18.
5. Cookies
We use cookies to improve functionality and analyse website usage. By using our site, you consent to the use of cookies.
6. Analytics and Approximate Location
The Android app sends privacy-limited product analytics directly to our self-hosted Umami analytics service. Umami uses the IP address from the network request to estimate an approximate country, region, or city. Umami does not store the IP address as part of the analytics event. The app does not request or send GPS coordinates for analytics.
Mobile analytics may include:
App opens and app sections viewed.
Camera permission outcomes, such as granted or denied.
Successful scan category, barcode source, and free or Business access tier.
Free scan-limit events.
Completion of sign-in, sign-up, or sign-out, without an email address or account identifier.
Subscription check outcomes and non-personal error categories.
Upgrade-link opens.
Successful feedback submission, including only whether the user was signed in and the number of attachments.
Operating system, app version, build number, language, and logical screen size.
Mobile analytics does not include South African ID numbers, barcode contents, validation results, names, email addresses, account or organisation identifiers, feedback text, attachment names or contents, document images, GPS coordinates, or a persistent analytics/device identifier.
We use this information to understand broad usage patterns, diagnose problems, improve important app functions, and measure whether features are useful. Analytics data is retained only for as long as reasonably necessary for these purposes and remains under our control in our self-hosted Umami instance.
7. Mobile App Permissions and Local Storage
The Android app requests camera permission so it can scan supported South African ID document barcodes. Camera frames are processed for scanning functionality and are not uploaded as images by default.
The mobile app may store recent successful scan results, queued scan timestamps, account entitlement details, and the last signed-in email address locally on the device. This helps the app work offline and remember your sign-in context. You can clear local app data through Android system settings, and signing out clears stored entitlement details.
8. ID Validation and Retention
ID validation is structural and runs in memory. We do not intentionally persist ID numbers submitted for ordinary validation checks. Mobile scan activity syncing records timestamps and device/account metadata used for entitlement and usage management, not full ID document images.
8a. Paid Home Affairs Verification Orders
CheckID is the POPIA responsible party for this separately purchased service. Before checkout we require a signed-in buyer, verified email, first and last names, and explicit acknowledgements of lawful entitlement for fraud prevention/detection, audit storage and manual processing within one business day. The buyer remains responsible for their lawful basis and use, retention and deletion of the report.
We retain the raw ID number only while the order is unfulfilled, so the owner can manually request the selected check from our upstream provider. Payment sends the owner a fulfilment email containing a masked ID, the product, the price paid and the buyer email; CheckID holds the full number only in the order record shown in the owner's order dashboard, and it is redacted on fulfilment, refund or cancellation/expiry. Unpaid order records are also kept. Closing Stripe Checkout does not itself cancel the order. An unpaid checkout session expires, and the ID is removed when the order expires or is cleared as stale, so a failed or abandoned attempt may hold the ID for a limited period first.
The retained audit record contains the buyer's name, verified email and account reference; a salted ID hash and masked ID; selected product, price, payment references and status; consent version and acceptance timestamps; provider request reference, coarse outcome (found, not found or source error), and lifecycle timestamps. We also retain and use connection country and card issuing country to block or flag suspected fraudulent orders. These records are used for audit, legal, billing and dispute purposes. Contact us about access or deletion; records required for legal or accounting obligations may be retained as described in our account deletion policy.
The original provider PDF passes through application memory only as a SendGrid email attachment. CheckID does not save a report copy, any returned Home Affairs fields, or decoded lookup results in its application, database, disk or object storage. SendGrid processes the attachment for delivery and keeps email activity data under its own retention policy, and your email provider receives it; your own mailbox may retain the report. Removing the ID from the live order does not delete these provider and mailbox copies or historical database backups. There is no report download or archive in CheckID. Support delivery issues are handled manually by the owner. The owner deletes temporary local PDFs and raw-ID fulfilment notifications after completing the workflow.
We do not put ID numbers or report contents into analytics, logs, error tracking, Stripe metadata or URL query strings. This limited paid-order processing is separate from the zero-storage ordinary structural validator.
9. Marketing Communications
By creating an account, you agree to receive promotional emails, discount codes, and special offers. You may opt-out of marketing communications at any time by clicking the unsubscribe link in any email, or by contacting us at [email protected].
10. Security
We use commercially reasonable safeguards such as HTTPS, access controls, authentication, and service provider security controls to protect data. No internet-connected service can guarantee absolute security.
11. Updates to the Privacy Policy
We may update this Privacy Policy from time to time. Users may be notified of material updates by email, in-product notice, or by changes to this page. Continued use of our services indicates acceptance of any changes.
12. Contact Information
If you have any questions or concerns about this Privacy Policy, please contact us at [email protected].
Thank you for trusting Check ID SA with your information.
By using Check ID SA, you consent to the terms of this Privacy Policy.