Privacy Policy
What personal data Leagle.id processes, why, for how long, and the rights you have over it.
Last updated
The short version
Leagle.id is built so that we don't hold your data. Your identity, your Licence, your contacts and your history live in your Wallet, on your device, encrypted under a passkey only you have. Services receive proofs you approve, not your documents.
Our servers only handle what they need to issue your Licence, connect you to a Service, and deliver notifications, and most of that is deleted within minutes or days. This website sets no cookies and runs no analytics.
The rest of this policy gives the details.
Who we are
Enof Solutions B.V., trading as Leagle.id, registered with the Dutch Chamber of Commerce (KvK) under number [KvK number], at [registered address], is the controller of the personal data described in this policy.
For anything about your data, email hello@leagle.id.
This website
When you visit leagle.id, our hosting provider (Google Firebase Hosting) receives the technical data your browser sends with every request: your IP address, browser and device type, the page requested and the time. We use it only to deliver the website and keep it secure, and it is kept in server logs for a limited time.
The website sets no cookies, uses no analytics or advertising tools, and loads no third-party trackers. Fonts are served from our own domain. See the Cookie Policy.
If you email us, we use your email address and message to reply, and keep the conversation for as long as needed to handle it.
The Wallet
What stays on your device
Your Wallet stores your Licence, Passports, contacts, personas, certificates and activity history in your device's storage, encrypted with a key derived from your passkey. We cannot read it. Your passkey itself is managed by your device or password manager; we only ever receive its public key and credential ID.
Verifying your identity
To issue your Licence, you verify your identity with Didit, our identity verification provider. During that check, Didit processes:
- images of your identity document and the data on it (such as name, date of birth, nationality and document number);
- a live selfie, compared to the photo on your document (biometric data);
- technical data about the session, to detect fraud.
When Didit approves the check, our server fetches the result, including your document photo, and builds your Licence from it. The Licence also contains attributes derived from your document, such as "older than 18" and the country that issued it. Our server sends the signed Licence straight to your device and does not keep a copy.
Because the check uses biometric data, we only run it with your explicit consent, which you give when you start the verification. Didit processes this data on our behalf under a data processing agreement and keeps it only as long as needed for the check, fraud prevention and its legal obligations.
Connecting to a Service
When you connect to a Service, your Wallet and the Service exchange certificates through a short-lived session on our server. The session holds the certificates being exchanged and expires after 5 minutes (30 minutes when you are reviewing a plan from an AI agent).
To stop Services from linking you across each other, each Service gets its own Passport with its own identifiers. To issue one, our server checks a signed request from your Wallet and signs the new Passport; it stores nothing about it.
What Services receive
A Service only receives what you approve in your Wallet: usually a proof, such as "this person is over 18", and sometimes specific data you choose to share. From then on, the Service is responsible for that data as its own controller, under its own privacy policy.
Notifications
If you turn on notifications, your browser or phone gives the Wallet a push address at its push service (for example Google, Apple or Mozilla). We store that address on our server, linked to your Wallet's holder ID, so we can deliver messages to your devices. Services never see it; they only get a sealed address that only our server can open.
Messages waiting for your Wallet to pick them up are kept in an inbox on our server for up to 7 days. Turning notifications off, or a push service reporting a device as gone, removes that device's address.
Why we can process it
| Purpose | Legal basis |
|---|---|
| Delivering and securing the website | Our legitimate interest in running a secure website |
| Verifying your identity and issuing your Licence | Performing our agreement with you; your explicit consent for biometric data |
| Connecting you to Services you choose | Performing our agreement with you |
| Notifications | Your consent, which you can withdraw at any time in the Wallet |
| Answering your emails | Our legitimate interest in responding to you |
| Preventing fraud and abuse | Our legitimate interest, and our legal obligations |
Who we share it with
We don't sell personal data, and we don't share it for advertising. We use these providers, each bound by a data processing agreement:
| Provider | What for |
|---|---|
| Google Cloud (Firebase Hosting, Cloud Functions, Firestore) | Hosting the website and Wallet, and running our servers |
| Didit | Identity verification |
| Your device's push service (Google, Apple, Mozilla) | Delivering notifications |
We may also disclose data where the law requires it, for example to comply with a court order.
Some providers may process data outside the European Economic Area. Where they do, the transfer is protected by an adequacy decision, such as the EU–US Data Privacy Framework, or by the European Commission's standard contractual clauses.
How long we keep it
| Data | How long |
|---|---|
| Wallet contents | On your device, until you delete them; we never hold them |
| Didit verification | As long as Didit needs it for the check, fraud prevention and its legal obligations |
| Connection sessions | 5 minutes, or 30 minutes for AI agent plans |
| Inbox messages | Up to 7 days |
| Push addresses | Until you turn off notifications or the push service reports the device gone |
| Website server logs | A limited period, for security |
| Emails with us | As long as needed to handle your question |
Your rights
Under the GDPR you have the right to access your personal data, have it corrected or deleted, restrict or object to its processing, and receive it in a portable format. Where we rely on your consent, you can withdraw it at any time.
Most of your data is only in your Wallet, where you can view, export or delete it yourself. For anything we or our providers hold, email hello@leagle.id. We will answer within one month.
You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or the authority in the country where you live.
Children
If you are under 16, you need permission from a parent or guardian to use the Wallet.
Security
The Wallet encrypts your data on your device, and Services receive proofs instead of data wherever possible. On our side, we keep what our servers handle to a minimum, encrypt it in transit and limit who can access it.
Changes to this policy
We may update this policy as Leagle.id changes. When we make a material change, we will tell you in the Wallet or on this website. The date at the top of this page shows when it last changed.