Privacy Policy — BioSeal Reader
This policy explains how the BioSeal Reader mobile app (Android and iOS, identifier codes.bioseal.reader), published by id3 Technologies, processes your data, in compliance with the General Data Protection Regulation (GDPR) and French law. The app reads and verifies Visible Digital Seals (VDS) and 2D-Doc codes.
1. Data controller
The BioSeal Reader app is published by:
5 rue de la Verrerie, 38120 Fontanil-Cornillon, France
Data Protection Officer: dpo@id3.eu
2. Data processed
a) Camera images
The camera reads codes (DataMatrix, QR Code) and captures the holder's face or fingerprints. Images are analysed in real time, in memory, then deleted; they are neither stored nor transmitted.
b) Holder's face and fingerprints GDPR art. 9
Only when the seal contains biometric data and the person accepts the consent screen shown before each verification. The computed templates are compared on the device with those in the seal, then erased. The seal can be viewed without biometric verification.
c) Seal content
Identity, portrait, dates and document fields encoded in the seal. They are shown on the device and erased when you return home or scan again.
d) Photo library image (iOS)
If you pick an image to read a code from, it is read in memory; it is neither copied nor transmitted.
e) Licence and customer account
To activate or renew the licence, a technical device identifier (hardware code, not personal) is sent to id3's licence server. If you sign in with your id3 customer account, your credentials are sent to the id3 customer portal.
f) Account request
If you fill in the account request form: name, company, email, phone, message, plus the device's hardware code and platform, so that id3's sales team can contact you.
g) Technical exchanges
Downloading trust lists, certificates, presentation templates and revocation lists; reading the free licence from a Firebase database protected by Firebase App Check; activating the CodeCorp reading engine licence; checking for updates. These exchanges expose the device's IP address.
h) Export and contacts
The result PDF is created on the device and shared by you only. A contact card from a seal is added to your contacts only at your request; the temporary file is purged at the next start.
The app uses no analytics, advertising or crash-reporting tool, and does no tracking.
3. Purposes and legal bases (GDPR)
| Purpose | Legal basis |
|---|---|
| Reading and verifying a seal (main function) | Performance of the requested service (art. 6-1-b) |
| Verifying the holder's identity by biometrics | Explicit consent (art. 9-2-a), asked before each verification; it can be refused |
| Managing the licence and customer account | Performance of the licence agreement (art. 6-1-b) |
| Answering an account request | Pre-contractual steps taken at your request (art. 6-1-b) |
| Securing the app and service (integrity, certificate revocation) | Legitimate interest (art. 6-1-f) |
4. Data retention
5. Recipients and processors
| Recipient | Role | Location |
|---|---|---|
| id3 Technologies | Licences, support, handling account requests | France |
| Google (Firebase Realtime Database, App Check) | Free licence, account requests, app integrity check | EU (europe-west1) |
| Cloudflare (Workers) | Receiving the account request form | Global network |
| Brevo | Emailing the account request to id3 | EU |
| Code Corporation | Activating the code reading engine licence | United States |
| Apple, Google | App updates and integrity attestation | Per their policies |
| Trust list operators | Publishing certificates and revocation lists | Per operator |
We do not sell or share your data for advertising. Transfers to providers based in the United States rely on the EU–US Data Privacy Framework or, failing that, on the European Commission's standard contractual clauses.
6. Security
- Biometric templates are never written to storage nor sent over the network.
- Network exchanges are encrypted (HTTPS).
- Each seal's signature is cryptographically verified (ECDSA) against the official trust lists.
- Keys are protected by system mechanisms (Android Keystore, iOS Keychain).
- No biometric or personal data is written to the app's logs.
- On iOS, the licence and cache are excluded from iCloud backup.
7. Permissions requested
8. Your rights (GDPR)
You have the rights of access, rectification, erasure, restriction, objection and portability, and may withdraw your consent at any time by declining the consent screen. As biometric data is never retained, id3 can neither disclose nor erase it: it no longer exists after the verification.
To exercise your rights, write to dpo@id3.eu. You may also lodge a complaint with the CNIL (cnil.fr) or your local data protection authority.
9. Minors
The app is intended for professionals who verify documents. It is not intended for children under 15.
10. Changes
Any change to this policy is published on this page; the last update date is shown at the top.