Privacy Policy

Last updated: September 30, 2026

‍This Persona Identities, Inc. (“Persona,” “we”, “us”, or “our”) Privacy Policy applies to individuals verifying their age through our age assurance service (“Service”) provided to our business customer, Reddit.

Privacy Policy applicable to individuals verifying their age through the Service

Reddit uses Persona’s Service to verify the age of individuals (“you”). Persona processes your personal data at the direction of Reddit. This Privacy Policy is intended to provide information about how Persona processes your personal data as a processor when it provides its Service to Reddit. You should also look at the privacy disclosures provided by Reddit with whom you have a direct relationship for specific information regarding your personal data.

‍Personal Data Processed and How It Is Used

This section describes the personal data we collect and how we use it in order to provide the Service to Reddit. Personal data means information that relates to an identified or identifiable individual.

The personal data we collect on behalf of Reddit may not include all of which is listed below, and varies based on what personal data is available to process, including what you choose to provide.

You may directly provide:

Name;
Demographic data, including birthdate and age;
Government documents, barcodes, and identifiers, such as government ID, passport or driver’s license;
Video and Photos of you, namely from the selfie or video you provide and from your government identification document;
Biometric Data, only with your express consent, including a scan of your facial geometry based on the photos or video you provide. As part of the age assurance process, Persona collects your selfie and runs an analysis against it to determine your estimated age. In some circumstances we will also collect a government ID and compare the image from the government ID against your selfie. For more information about Biometric Data, see the Facial Scan and Biometrics Information section below.

Our Service may also collect the following from you, Reddit, or third parties:

Email information to generate age inferences where applicable;
Device information, including IP address, device type, your device’s operating system, browser, cookie and device identifiers, and other software including type, version, language, settings, and configuration;
Publicly available data, including data from governmental public records;
Geolocation data as we may infer your general geographic location (such as city, state, and country) based on your IP address;
Age threshold information: For users located in Australia, Reddit offers an additional age verification option through ConnectID, an identity service operated by Australian Payments Plus (AP+) and supported by major Australian banks. When a user selects ConnectID as their verification method, they authenticate directly with their bank, which confirms an age threshold (such as 16+ or 18+) to Persona. Neither Persona nor ConnectID sees, accesses, or stores any banking information or personal data beyond the specific age claim consented to by the user.

We use personal data to provide Reddit with the Service so it can verify the age of individuals and prevent fraud. This processing is necessary to perform our contract with Reddit. We do not use your personal data for any other purposes, including to improve our Service or for any AI model training.

Third party subprocessors

We may disclose personal data to service providers, including hosting, cloud services and other information technology services providers; SMS software providers; and mobile device operators. Pursuant to our instructions, these parties will access or process personal data while performing their duties to us. Specific subprocessors we use are: Amazon Web Services, Inc., Google LLC (Google Cloud Platform), MongoDB, Inc., Snowflake Inc., Confluent, Inc., Elasticsearch Inc., Sigma Computing, Inc., and dbt Labs, Inc.

Facial Scan and Biometrics Information

This section describes how Persona treats scans of facial geometry extracted from the uploaded images of your identity documents and your selfie. Biometric information is generally understood to be unique physical characteristics such as your face geometry through which you can be identified or recognized.

Persona, acting as a processor or service provider to Reddit, compares the data from a scan of facial geometry extracted from the government identification document that you upload to the data from a scan of facial geometry extracted from the photo of your face that you upload (“Scan Data”), in order to help verify your age (“Verification”).

The uploaded images and Scan Data are collected and used directly by Persona on behalf of Reddit as Reddit’s service provider.

Persona’s third party vendors / subprocessors may have access to the Scan Data to provide their services, including to provide some or all of the analysis and to service the systems on which such data is accessed.

Persona and any applicable subprocessors will permanently destroy all personal data, including Scan Data collected for age verification purposes, immediately after the Verification process ends, consistent with Reddit’s instructions unless Persona is otherwise required by law or legal process to retain the data.

Data Subject Rights

Persona is the data processor for the processing of personal data on behalf of Reddit. If you would like to exercise your data subject rights, you may do so through Reddit’s webform here.

Location of personal data

The personal data we collect may be processed in your country or region, or in any other country where we or our affiliates, subsidiaries, or service providers process data. For Reddit, we use data centers in the United States. We take steps designed to ensure that personal data is processed and protected as described in this policy wherever the data is located.

Location of Processing European personal data. We transfer personal data from the European Economic Area (EEA), United Kingdom (UK), and Switzerland to other countries, some of which have not been determined by the European Commission to have an adequate level of data protection. When we do so, we use legal mechanisms, including contracts, to help ensure your rights and protections.

Compliance With Data Privacy Framework Principles. Persona complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Persona has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Persona has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/

We are subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission. If third-party agents process personal data on our behalf in a manner inconsistent with the Data Privacy Framework Principles, we remain liable unless we prove we are not responsible for the event giving rise to any damages. If you have a question or complaint related to our compliance with the Data Privacy Framework Principles, please contact us as described in the Contact Us section below.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Persona commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.jamsadr.com/dpf-dispute-resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.

Finally, under limited circumstances and after other available dispute resolution mechanisms have been exhausted, binding arbitration is available to address certain residual complaints under the EU-U.S. Data Privacy Framework Principles, Swiss-U.S. DPF Principles, and the UK-Extension Framework not resolved by other means.

Class Action Waiver - US Residents Only

YOU (IF YOUR ARE A RESIDENT OF THE UNITED STATES) AND PERSONA IDENTITIES, INC., INCLUDING ITS PARENTS, SUBSIDIARIES, AFFILIATES, SUCCESSORS, AND ASSIGNS (“COMPANY”) AGREE THAT ANY PROCEEDINGS TO RESOLVE OR LITIGATE ANY DISPUTE WILL BE CONDUCTED SOLELY ON AN INDIVIDUAL BASIS, AND THAT NEITHER YOU NOR COMPANY WILL SEEK TO HAVE ANY DISPUTE HEARD AS A CLASS ACTION, A REPRESENTATIVE ACTION, A COLLECTIVE ACTION, A PRIVATE ATTORNEY-GENERAL ACTION, OR IN ANY PROCEEDING IN WHICH YOU OR COMPANY ACTS OR PROPOSES TO ACT IN A REPRESENTATIVE CAPACITY. YOU AND COMPANY FURTHER AGREE THAT NO PROCEEDING WILL BE JOINED, CONSOLIDATED, OR COMBINED WITH ANOTHER PROCEEDING WITHOUT THE PRIOR WRITTEN CONSENT OF YOU, COMPANY, AND ALL PARTIES TO ANY SUCH PROCEEDING. THIS CLASS ACTION WAIVER COVERS ALL DISPUTES BETWEEN YOU AND COMPANY AND ALSO INCLUDES ANY DISPUTE BETWEEN YOU AND ANY OFFICER, DIRECTOR, BOARD MEMBER, AGENT, EMPLOYEE, VENDOR, AFFILIATE, OR CLIENT OF COMPANY, IF COMPANY COULD BE LIABLE, DIRECTLY OR INDIRECTLY, FOR SUCH DISPUTE.

THE TERM “DISPUTE” SHALL BE INTERPRETED AS BROADLY AS PERMITTED UNDER THE LAW AND SHALL APPLY TO ALL PAST, PRESENT, AND FUTURE LEGAL DISPUTES AND LEGAL CLAIMS BETWEEN YOU AND COMPANY THAT ARE NOW IN EXISTENCE OR THAT MAY ARISE IN THE FUTURE, INCLUDING, BUT NOT LIMITED TO LEGAL DISPUTES OR LEGAL CLAIMS ARISING OUT OF OR RELATING IN ANY WAY TO THESE TERMS, THE COLLECTION OF FACIAL SCANS OR BIOMETRIC INFORMATION, THE PRIVACY POLICY OR COMPANY’S SERVICES; YOUR RELATIONSHIP WITH COMPANY; YOUR USE OF ANY COMPANY PRODUCT OR SERVICE; COMPANY’S CONDUCT; AND ANY FEDERAL, STATE, OR LOCAL STATUTE, LAW, RULE, REGULATION OR ORDINANCE APPLICABLE TO THE RELATIONSHIP BETWEEN YOU AND COMPANY AS TO WHICH A COURT WOULD BE AUTHORIZED BY LAW TO GRANT RELIEF IF THE CLAIM WERE SUCCESSFUL (“DISPUTE” OR “DISPUTES”).

Changes to the Privacy Policy

We will update this Privacy Policy when necessary to reflect changes in our Service, how we use personal data, or the applicable law. When we post changes to the Privacy Policy, we will revise the “Last Updated” date at the top of the Privacy Policy. If we make material changes to the Privacy Policy, we will provide notice or obtain consent regarding such changes as may be required by law.

Contact Us

If you have a privacy concern, complaint, or a question for Persona, please feel free to use this portal or contact us via email at privacy@withpersona.com.

Our postal address is Persona Identities, Inc., 981 Mission Street #95, San Francisco, CA 94103, United States.

Our data protection representative for the European Economic Area and Switzerland is Darina Byrne, 88 Harcourt Street, Dublin 2, DUBLIN, Ireland, D02 DK18. To make an inquiry to Darina Byrne, please contact idv-privacy@withpersona.com.

Our data protection representative for the UK is: S. Alec Lawton, Graigwen, Plasycoed road, Pontypool Torfaen, NP4 6QH, UK. To make an inquiry to S. Alec Lawton, please contact idv-privacy@withpersona.com.

To contact our data protection office (DPO) please feel free to contact them at dpo@withpersona.com.