Published under BIPA 740 ILCS 14/15(a)
Biometric Data Retention & Destruction Policy
Effective 16 August 2026 · Applies to all biometric identifiers and biometric information in VoiceIDVault’s possession.
1. Retention schedule
Biometric identifiers are destroyed when the initial purpose for collecting them has been satisfied, or within the period below, whichever occurs first.
| Data | Maximum (BIPA) | Maximum (GDPR) |
|---|---|---|
| Voice biometric template Derived vector; no raw audio retained after processing. | 3 years | 3 years |
| Face biometric template Derived vector; source image is not retained. | 3 years | 3 years |
| Iris biometric template Capability in development; no production data held. | 3 years | 3 years |
| Verification log Records that a verification occurred, not the biometric itself. | 3 years | 6 years |
| Audit trail Tamper-evident chain of system events. | 3 years | 7 years |
| Account data Non-biometric account records. | 3 years | 2 years after closure |
| Key material Retired encryption keys. | 1 year | 1 year after rotation |
Where more than one regime applies to the same record, the shortest applicable period governs. Longer HIPAA periods apply only where a customer’s deployment is subject to HIPAA and they have contracted for it.
2. Destruction guidelines
- Method. Biometric templates are destroyed by cryptographic erasure — the record and its encryption key are both destroyed, so the ciphertext cannot be recovered — or by secure deletion where erasure does not apply.
- Trigger. Destruction runs automatically when the retention ceiling is reached, and on request under GDPR Art. 17 or an equivalent state right.
- Attestation. Every destruction produces a signed certificate carrying a Merkle inclusion proof, which the data subject or a regulator can verify independently.
- Legal hold. Destruction is suspended for records under a documented legal hold, and resumes when the hold is lifted. Holds are recorded in the audit trail.
3. What we do not do
- We do not sell, lease, trade, or otherwise profit from biometric identifiers (BIPA §15(c)).
- We do not retain raw audio or source images after a template has been derived.
- We do not disclose biometric identifiers without consent, except as §15(d) permits.
4. Exercising your rights
To request deletion of your biometric data, or a copy of the destruction certificate for data already deleted, contact privacy@voiceidvault.com. Where VoiceIDVault processes your data on behalf of another organisation, we will direct your request to them as the controller and support them in fulfilling it.
5. Scope and changes
This policy describes retention and destruction only. It is not a statement of compliance with any framework, and it does not describe our lawful basis for processing — see the privacy policy for that. Material changes will be published here with a revised effective date; we do not apply a shortened retention period retroactively without destroying the affected records.