Effective Date: 2 October 2026
At Check ID SA, we value your privacy and are committed to protecting personal information. This Privacy Policy explains how we collect, use, and safeguard data when you use https://checkid.co.za, the Check ID SA web app, APIs, and the Check ID SA Android mobile app.
1. Data We Collect
We collect the following data:
Account Information: Name, email address, authentication identifiers, team or organisation membership, and subscription status.
Payment Information: Payment and billing details are processed by Stripe. We do not store full card numbers.
Validation Inputs: ID numbers or document barcode data that you choose to validate.
Mobile App Data: Device identifiers generated by the app, device model and operating system information, app version, device name, mobile check-in activity, and mobile scan activity timestamps.
Feedback and Support: Name, email address, and messages you submit through contact or feedback forms.
Marketing Communications: Discount codes, special offers, product announcements, and service updates.
Analytics and Technical Information: Website or app pages viewed, selected feature events, operating system, app version and build number, language, screen size, and approximate country, region, or city derived from the network request.
2. How We Use Your Data
To provide account access, subscriptions, API access, team features, and mobile app access.
To perform structural South African ID validation, including format, date of birth, age, gender indicator, citizenship indicator, and checksum checks.
To register and manage mobile devices connected to your account or organisation.
To support offline mobile access windows and sync mobile scan activity when a device reconnects.
To respond to support requests and feedback.
To send product updates and promotional communications where permitted. You may opt out of marketing emails at any time.
To monitor, secure, debug, measure, and improve the service.
3. Data Sharing
We do not sell your personal data. We use trusted service providers where necessary to run the service, including authentication, hosting, database, email delivery, analytics, payments, and error monitoring providers. These providers process data only for the purposes of operating Check ID SA.
Ordinary structural validation does not query a government database. Paid Home Affairs verification orders are processed through our verification provider, VerifyNow. CheckID is not affiliated with the Department of Home Affairs.
4. Children's Privacy
CheckID does not knowingly collect any personal information from children under the age of 18.
5. Cookies
We use cookies to improve functionality and analyse website usage. By using our site, you consent to the use of cookies.
6. Analytics and Approximate Location
The Android app sends privacy-limited product analytics directly to our self-hosted Umami analytics service. Umami uses the IP address from the network request to estimate an approximate country, region, or city. Umami does not store the IP address as part of the analytics event. The app does not request or send GPS coordinates for analytics.
Mobile analytics may include:
App opens and app sections viewed.
Camera permission outcomes, such as granted or denied.
Successful scan category, barcode source, and free or Business access tier.
Free scan-limit events.
Completion of sign-in, sign-up, or sign-out, without an email address or account identifier.
Subscription check outcomes and non-personal error categories.
Upgrade-link opens.
Successful feedback submission, including only whether the user was signed in and the number of attachments.
Operating system, app version, build number, language, and logical screen size.
Mobile analytics does not include South African ID numbers, barcode contents, validation results, names, email addresses, account or organisation identifiers, feedback text, attachment names or contents, document images, GPS coordinates, or a persistent analytics/device identifier.
We use this information to understand broad usage patterns, diagnose problems, improve important app functions, and measure whether features are useful. Analytics data is retained only for as long as reasonably necessary for these purposes and remains under our control in our self-hosted Umami instance.
7. Mobile App Permissions and Local Storage
The Android app requests camera permission so it can scan supported South African ID document barcodes. Camera frames are processed for scanning functionality and are not uploaded as images by default.
The mobile app may store recent successful scan results, queued scan timestamps, account entitlement details, and the last signed-in email address locally on the device. This helps the app work offline and remember your sign-in context. You can clear local app data through Android system settings, and signing out clears stored entitlement details.
8. ID Validation and Retention
ID validation is structural and runs in memory. We do not intentionally persist ID numbers submitted for ordinary validation checks. Mobile scan activity syncing records timestamps and device/account metadata used for entitlement and usage management, not full ID document images.
8b. Automated ID Verification (match check and details)
For ID Verification, CheckID sends the ID number and the first name(s) and surname you enter (and, for a female ID number, a maiden name if you add one) to our verification provider, VerifyNow, which checks them against Home Affairs records on our behalf. CheckID is the POPIA responsible party and you remain responsible for having a lawful basis for the check.
We hold the ID number and the names you entered on your order only until the check finishes, the order is refunded, or it expires or is cleared as stale, and then remove them. The provider's answer is compared with your entry in memory. If the names match, we email you the details in the basic Home Affairs report (such as the person's names, date of birth, gender and citizenship; never a photo) to your verified email address, as a PDF attached to that email. The PDF also shows the ID number you entered. Those details are held in memory only to build that email and are not stored by CheckID, and we cannot send them again. The email is processed by our email provider and then sits in your mailbox, which we do not control, so you are responsible for protecting it and for using the details only for the lawful purpose you gave. If the names do not match, you receive nothing from the record: not the details and not which part failed. If there is no match, or the check cannot be completed, your payment is refunded in full. No biometric data is requested or stored.
Temporary exception, until 24 November 2026: if an ID Verification check fails (no match, no record, or the provider could not complete it), we may record the ID number with the error in our error monitoring service (Sentry), so we can rerun the check and fix the fault. It is not used for anything else and is deleted under that service's retention period. A check that matches is never recorded this way.
We keep an audit record: your name, verified email and account reference; a salted ID hash and masked ID; the product, price, payment references and status; the consent version and times; the provider request reference and a coarse outcome. We limit repeat checks of the same ID number and by the same account to protect the people whose details are checked. The provider keeps its own records under its own policies, and Stripe and SendGrid process payment and email data as described in this policy.
8c. Company Verification (CIPC)
For Company Verification, CheckID sends the company registration number you enter to our verification provider, VerifyNow, which looks it up on the CIPC register on our behalf. CheckID is the POPIA responsible party for the order and you remain responsible for having a lawful reason to check the company. Company records are public, and the report contains company-level details only: no directors, addresses or contact details.
We hold the registration number on your order only until the check finishes, the order is refunded, or it expires or is cleared as stale, and then remove it from the working record. The number stays visible in your order history, because it is a public register entry and tells you which company you checked. The provider's answer is held in memory only to build the PDF report, which we email to your verified email address. We do not store the report and cannot send it again. The email is processed by our email provider and then sits in your mailbox, which we do not control, so you are responsible for protecting it and for using it only for the lawful purpose you gave. If the company is not found or the check cannot be completed, you are refunded in full.
We keep an audit record: your name, verified email and account reference; a salted hash of the registration number; the product, price, payment references and status; the consent version and times; the provider request reference and a coarse outcome. We limit repeat checks of the same company and by the same account to protect the service. The provider keeps its own records under its own policies, and Stripe and SendGrid process payment and email data as described in this policy.
8d. Bank Account Verification
For Bank Account Verification, CheckID sends the bank, account number and account type you enter, and the account holder's name with their ID number (or passport number, for a holder who is not South African) or company registration number, to our verification provider, VerifyNow, which asks the holder's bank on our behalf. CheckID is the POPIA responsible party for the order, and you remain responsible for having the holder's authority or another lawful reason for the check, which you state when you order. The bank answers yes or no to each check: whether the account exists, is open, belongs to the ID, passport or registration number, matches the account type, and accepts payments and debit orders. No balances, transactions or other details about the holder are requested.
We hold the account number and the holder's name and ID, passport or registration number on your order only until the check finishes, the order is refunded, or it expires or is cleared as stale, and then remove them. The bank's answers are held in memory only to build the PDF report, which we email to your verified email address. We do not store the report and cannot send it again. The email is processed by our email provider and then sits in your mailbox, which we do not control, so you are responsible for protecting it and for using it only for the lawful purpose you gave. If the bank cannot be reached or the check cannot be completed, you are refunded in full.
We keep an audit record: your name, verified email and account reference; the bank, the account type and the last four digits of the account; salted hashes of the account number and of the ID, passport or registration number; a masked ID or passport number, or the registration number as entered; the purpose you stated; the product, price, payment references and status; the consent version and times; the provider request reference and a coarse outcome (verified, not verified and the first check that failed, or could not be completed). We limit repeat checks of the same account, of the same ID, passport or registration number, and by the same account to stop stolen bank details being tested. The provider keeps its own records under its own policies, and Stripe and SendGrid process payment and email data as described in this policy.
8e. Sanctions & PEP Screening
For Sanctions & PEP Screening, CheckID sends the name of the person or company you enter to our verification provider, VerifyNow, which screens it against sanctions lists and politically exposed person (PEP) lists on our behalf. No ID number is requested for this check. CheckID is the POPIA responsible party for the order and you remain responsible for having a lawful basis for the screen; you choose a stated purpose, which we keep with the order.
Criminal records are not part of this product. If the provider returns anything about criminal records, CheckID discards it in memory before the report is built: it is never shown to you, emailed or stored.
We hold the name on your order only until the screen finishes, the order is refunded, or it expires or is cleared as stale, and then remove it. The provider's answer is held in memory only to build the PDF report, which we email to your verified email address. The report may contain personal information about the person screened, such as a matched name, a public position, a country and a date of birth from a list entry. We do not store the report or the match details and cannot send them again. The email is processed by our email provider and then sits in your mailbox, which we do not control, so you are responsible for protecting it and for using it only for the lawful purpose you gave. If the screen cannot be completed, you are refunded in full.
We keep an audit record: your name, verified email and account reference; your stated purpose; whether a person or company was screened; a masked name (initials for a person) and a salted hash of the name; whether the screen was clear or found a possible match, without the match details; the list version; the product, price, payment references and status; the consent version and times; and the provider request reference. We limit repeat screens of the same name and by the same account. The provider keeps its own records under its own policies, and Stripe and SendGrid process payment and email data as described in this policy.
8f. Director Verification (CIPC)
For Director Verification, CheckID sends the South African ID number you enter to our verification provider, VerifyNow, which searches CIPC director records on our behalf. CheckID is the POPIA responsible party for the order. You must have a lawful reason for the check, which you select before paying, such as due diligence on a supplier or customer, screening a prospective director or employee, or fraud prevention, and you remain responsible for using the report only for that purpose.
The provider's answer includes more than directorships, such as contact details, addresses, employment and credit information. CheckID reads only the person's names, to compare them with the names you entered, and a fixed list of directorship details: company name, registration number and status, the person's role and director status, and appointment and resignation dates. Everything else is discarded in memory and never stored, shown or emailed. If the names you entered do not match the record, nothing from the record is released and you are refunded in full.
We hold the ID number and the names on your order only until the check finishes, the order is refunded, or it expires or is cleared as stale, and then remove them. The directorships are held in memory only to build the PDF report, which we email to your verified email address. The PDF also shows the ID number and names you entered. We do not store the report and cannot send it again. The email is processed by our email provider and then sits in your mailbox, which we do not control, so you are responsible for protecting it.
We keep an audit record: your name, verified email and account reference; a masked ID number and a salted hash of it; the purpose you selected; the product, price, payment references and status; the consent version and times; the provider request reference and a coarse outcome. We limit repeat checks of the same ID number and by the same account to protect the person being checked and the service. The provider keeps its own records under its own policies, and Stripe and SendGrid process payment and email data as described in this policy.
8g. Vehicle History Check
For the Vehicle History Check, CheckID sends the South African registration number you enter, and the VIN if you add one, to our verification provider, VerifyNow, which looks up the vehicle record on our behalf. CheckID is the POPIA responsible party for the order. You must have a lawful reason for the check, such as buying, selling, financing, insuring or managing the vehicle, or preventing fraud, and you agree not to use it to trace or contact the vehicle's owner.
The check is about the vehicle only. CheckID reads a fixed list of vehicle details: the vehicle's identity and identifiers, registration and licensing, specifications, roadworthy and security status, and guide values and history where the source returns them. Owner, driver and title holder details, addresses and contact details are discarded in memory wherever they appear, and never stored, shown or emailed. If no vehicle record is found, or the check cannot be completed, you are refunded in full.
A registration number on its own is generally not personal information, but it can become linked to a person, so we treat it with care. We keep the registration number on your order so you can tell which vehicle you checked in My orders, with a salted hash of it for daily limits. We hold the VIN only until the check finishes, the order is refunded, or it expires or is cleared as stale, and then remove it. The vehicle details are held in memory only to build the PDF report, which we email to your verified email address. We do not store the report and cannot send it again. The email is processed by our email provider and then sits in your mailbox, which we do not control, so you are responsible for protecting it.
We keep an audit record: your name, verified email and account reference; the registration number and its salted hash; the product, price, payment references and status; the consent version and times; the provider request reference and a coarse outcome. We limit repeat checks of the same registration number and by the same account. The provider keeps its own records under its own policies, and Stripe and SendGrid process payment and email data as described in this policy.
9. Marketing Communications
By creating an account, you agree to receive promotional emails, discount codes, and special offers. You may opt-out of marketing communications at any time by clicking the unsubscribe link in any email, or by emailing [email protected].
10. Security
We use commercially reasonable safeguards such as HTTPS, access controls, authentication, and service provider security controls to protect data. No internet-connected service can guarantee absolute security.
11. Updates to the Privacy Policy
We may update this Privacy Policy from time to time. Users may be notified of material updates by email, in-product notice, or by changes to this page. Continued use of our services indicates acceptance of any changes.
12. Contact Information
If you have any questions or concerns about this Privacy Policy, email [email protected] or use our contact page at https://checkid.co.za/contact.
Thank you for trusting Check ID SA with your information.
By using Check ID SA, you consent to the terms of this Privacy Policy.