01Who We Are
AIVerID (aiverid.com) is a sign-in and identity service. You create one account and use it to sign in to the Ver* apps (such as VerSketch, VerGolf and VerHoro) and to connect AI assistants such as Claude and ChatGPT to them.
For anything about your personal data, write to aivisibilityrights@gmail.com.
02Information We Collect
| What | Details |
|---|---|
| Account details | Your first and last name, email address, country and password, entered when you sign up. Your name is encrypted (AES-256-GCM) before it is stored. Your email address is stored as plain text, because we use it to sign you in and to write to you. Your password is never stored; we keep only a one-way bcrypt hash of it. |
| Other details an app may provide | Our sign-up API also accepts a phone number, date of birth, organization name and registration number, crypto wallet addresses and an ID card number. Our own sign-up page does not ask for them. If they are provided, the ID card number is encrypted; the others are stored as plain text. |
| Profile photo | If you upload one, it is stored with our storage provider (Supabase) at a public web address, because the apps you sign in to show it. |
| Identity verification (optional) | If you choose to verify your identity, you upload photos of the front and back of your ID card and, for the highest level, a selfie. The photos are kept privately with Supabase and are reviewed by AIVerID staff. Thai national ID requests can be approved automatically after the number passes validity and duplicate checks; staff may still revoke an approval. We do not store your ID number from this step, only a one-way fingerprint of it that stops one card from verifying two accounts. The photos are deleted 30 days after review, at once if you cancel, and at once if your account is erased. |
| How you signed up | Which app and channel (website, Claude or ChatGPT) you were signing in to when you created your account, the domain of the website that sent you to us (never the full address), and your browser language. This describes the sign-in you started from; it is not proof of who sent you. Accounts created before this was introduced on October 15, 2026 may still hold the full address of the page they signed up from. |
| Sign-in records | Each time an app signs you in or renews your sign-in (apps renew regularly while you use them), we record which app and when. This lets you see and disconnect your apps, and lets us count how often members use the apps. |
| Connected AI assistants | When you connect Claude or ChatGPT, we keep the connection's name, what it is allowed to do, and when it was last used. |
| Security log | For sign-ups, sign-ins, failed sign-ins and every request made while you are signed in, we log the time, what was done, your IP address and your browser. This is used to protect accounts and investigate abuse. |
| Password reset requests | The reset link we email you, with the IP address and browser that asked for it. |
| Messages you send us | If you use our contact form, your name, email address, topic and message are emailed to our team inbox. They are not stored in our database. To stop abuse, we count each day's messages in total and per email address; the email address is kept only as a one-way fingerprint, and the counts are kept for no more than four days. |
| AI Rights records | The AIVID, AIPLT and SLIVR records created with your account are entries in our database. They are not on a blockchain. |
| Newsletter choice | Whether you ticked “Send me updates” at sign-up. We have not sent marketing emails so far. |
When you tick “Stay signed in on this browser”, we set one strictly necessary cookie,
__Host-aiverid_bs. It holds a random identifier, with no personal data in the cookie itself.
It is HttpOnly (scripts cannot read it) and Secure (sent over HTTPS only). It lasts for 15 days from your
last sign-in, including a sign-in through a Ver* app that passes through aiverid.com; each of these sign-ins
starts the 15 days again. Using an app without passing through aiverid.com does not extend it.
The remembered session ends when you choose “Log out” or “Log out everywhere”, or when it expires.
Each tab also keeps a short-lived sign-in token in session storage, which is cleared when you close the tab.
Our pages carry no analytics, advertising or tracking scripts. We do not ask for your location (your IP address and country do give an approximate one); we take no payments and hold no card details; and we do not sell, rent or trade your data.
03How We Use It
- To create and run your account and sign you in.
- To sign you in to Ver* apps and connect AI assistants, sharing only what you approve on the consent screen.
- To verify your identity, when you ask us to.
- To keep accounts safe: for example, an account is locked for a while after repeated failed sign-ins, and we are alerted when that happens.
- To send emails about your account: password reset links and a notice when your password changes.
- To answer messages you send us through our contact form or by email.
- To understand how the service is used. Our administrators see counts of sign-ups by app, channel, country and browser language, and of how often members use the apps and which apps are used together; on each account they can also see how it signed up. We do not use any of this for advertising or to make decisions about you.
- To send you updates, only if you ticked the newsletter box.
04What Connected Apps Receive
Every time an app asks you to sign in with AIVerID, you see a consent screen listing what it will receive. Nothing is shared before you approve.
- Basic profile: your AIVerID number, name, email address, phone number, date of birth, country, profile photo, account type, verification level and the date you joined.
- Business details (VerHotel only): your organization's name, registration number and administrator name, and the last 4 digits of an ID card number if one was provided.
- AI Rights records (only for apps that ask for them): your AIVID, AIPLT and SLIVR records.
- AI assistants (Claude, ChatGPT): the connected app receives your AIVerID number, verification level and granted permissions. The app can also receive your name under the profile scope and your email under the email scope, and may make approved data available to the assistant. Review the consent screen for the data and actions you allow. Your password and ID document photos are never shared.
An app keeps what it receives under its own privacy policy. Disconnecting an app in your dashboard stops it from getting anything new, but it does not delete what the app already copied; ask that app to delete it.
05Who Else Handles Your Data
We use these service providers. They process data for us; they do not get it to use for themselves.
- Railway — runs our servers and the database that holds the information above, apart from contact-form messages, which are only emailed to our inbox.
- Vercel — hosts this website.
- Supabase — stores profile photos and identity-verification photos.
- Resend — sends our emails, including contact-form messages to our inbox, so it receives the email addresses and content of those emails.
- Google — our security alerts and contact-form messages go to a Gmail inbox. An alert can include your account number, a partly hidden email address and an IP address; a contact-form message holds what you entered in the form. Our pages also load fonts from Google Fonts, so your browser contacts Google.
- Cloudflare (cdnjs) and Webflow — deliver some scripts and images on our pages, so your browser contacts them.
These providers may store data outside Thailand.
06How Long We Keep It
- Account details and profile photo: until your account is erased.
- Sign-in records: kept for our usage counts; once your account is erased they are linked only to its account number.
- Identity-verification photos: 30 days after review, or less as described above.
- Security log: 12 months.
- Password reset requests: deleted one day after the link expires (links expire after one hour).
- Messages you send us: in our email inbox until we delete them. We do not delete them on a schedule; ask us and we will.
- Daily contact-form counts: no more than four days.
- Our hosting providers keep their own technical logs for a limited time that they set.
07How We Protect It
- Passwords are stored only as bcrypt hashes; names and ID card numbers are encrypted with AES-256-GCM.
- Sign-in tokens are stored only as hashes, expire after a set time, and can be revoked. Sign-in follows OAuth 2.0 with PKCE.
- Traffic to our website and servers is encrypted (HTTPS).
- Sign-in attempts are rate-limited, and our administrator account needs a password and a code sent by email.
Other details, such as your email address, phone number and wallet addresses, are not encrypted by our application; they are protected by our providers' security. No system is completely secure. If a breach affects your data, we will tell you and the authorities as the law requires.
08Your Choices and Rights
In your dashboard you can:
- see your profile, and add or remove your profile photo;
- see the apps and AI assistants connected to your account, and disconnect any of them;
- sign out of every device at once.
On the identity verification page you can cancel a verification that is still waiting for review, which deletes its photos at once.
To change your password, use “Forgot password” on the sign-in page.
For anything else, email aivisibilityrights@gmail.com from the address on your account. We reply within 30 days.
- A copy of your data: we send you what we hold about you.
- Corrections: we correct your name, email address or other details. You cannot edit them yourself yet.
- Erasing your account: we erase your email address, name, phone number, date of birth, wallet addresses, ID card number, profile photo and identity-verification photos; disconnect every app and AI assistant; sign you out everywhere; and remove your IP address and browser from the security log and from copies in our other logs. What remains is a record of your account number, when the account was created and erased, your country and how you signed up, so that the number is never given to anyone else. With us, the number no longer leads to any of your details; but apps you used may still hold it next to what they copied, so ask them to delete their copy too. Your email address can then be used to sign up again. Messages you sent us are not part of your account; ask us to delete them too.
- Stopping updates: we stop, if you ticked the newsletter box.
If you are unhappy with how we handle your data, you can also complain to Thailand's Office of the Personal Data Protection Committee (PDPC).
09Children
AIVerID is not meant for anyone under 18. We do not check age at sign-up. If you believe a child has an account, email us and we will erase it.
10Changes to This Policy
When we change how we handle your data, we update this page first and change the date below.
11Contact
Email: aivisibilityrights@gmail.com
Last updated: October 16, 2026