Privacy Policy

AIVerID (aiverid.com) is a sign-in and identity service. You create one account and use it to sign in to the Ver* apps (such as VerSketch, VerGolf and VerHoro) and to connect AI assistants such as Claude and ChatGPT to them.

For anything about your personal data, write to aivisibilityrights@gmail.com.

What	Details
Account details	Your first and last name, email address, country and password, entered when you sign up. Your name is encrypted (AES-256-GCM) before it is stored. Your email address is stored as plain text, because we use it to sign you in and to write to you. Your password is never stored; we keep only a one-way bcrypt hash of it.
Other details an app may provide	Our sign-up API also accepts a phone number, date of birth, organization name and registration number, crypto wallet addresses and an ID card number. Our own sign-up page does not ask for them. If they are provided, the ID card number is encrypted; the others are stored as plain text.
Profile photo	If you upload one, it is stored with our storage provider (Supabase) at a public web address, because the apps you sign in to show it.
Identity verification (optional)	If you choose to verify your identity, you upload photos of the front and back of your ID card and, for the highest level, a selfie. The photos are kept privately with Supabase and are reviewed by AIVerID staff. Thai national ID requests can be approved automatically after the number passes validity and duplicate checks; staff may still revoke an approval. We do not store your ID number from this step, only a one-way fingerprint of it that stops one card from verifying two accounts. The photos are deleted 30 days after review, at once if you cancel, and at once if your account is erased.
How you signed up	Which app and channel (website, Claude or ChatGPT) you were signing in to when you created your account, the domain of the website that sent you to us (never the full address), and your browser language. This describes the sign-in you started from; it is not proof of who sent you. Accounts created before this was introduced on October 15, 2026 may still hold the full address of the page they signed up from.
Sign-in records	Each time an app signs you in or renews your sign-in (apps renew regularly while you use them), we record which app and when. This lets you see and disconnect your apps, and lets us count how often members use the apps.
Connected AI assistants	When you connect Claude or ChatGPT, we keep the connection's name, what it is allowed to do, and when it was last used.
Security log	For sign-ups, sign-ins, failed sign-ins and every request made while you are signed in, we log the time, what was done, your IP address and your browser. This is used to protect accounts and investigate abuse.
Password reset requests	The reset link we email you, with the IP address and browser that asked for it.
AI Rights records	The AIVID, AIPLT and SLIVR records created with your account are entries in our database. They are not on a blockchain.
Newsletter choice	Whether you ticked “Send me updates” at sign-up. We have not sent marketing emails so far.

What we do not do: our pages carry no analytics, advertising or tracking scripts; we set no cookies (signing in uses your browser's session storage, which is cleared when you close the tab); we do not ask for your location (your IP address and country do give an approximate one); we take no payments and hold no card details; and we do not sell, rent or trade your data.

• To create and run your account and sign you in.
• To sign you in to Ver* apps and connect AI assistants, sharing only what you approve on the consent screen.
• To verify your identity, when you ask us to.
• To keep accounts safe: for example, an account is locked for a while after repeated failed sign-ins, and we are alerted when that happens.
• To send emails about your account: password reset links and a notice when your password changes.
• To understand how the service is used. Our administrators see counts of sign-ups by app, channel, country and browser language, and of how often members use the apps and which apps are used together; on each account they can also see how it signed up. We do not use any of this for advertising or to make decisions about you.
• To send you updates, only if you ticked the newsletter box.

Every time an app asks you to sign in with AIVerID, you see a consent screen listing what it will receive. Nothing is shared before you approve.

• Basic profile: your AIVerID number, name, email address, phone number, date of birth, country, profile photo, account type, verification level and the date you joined.
• Business details (VerHotel only): your organization's name, registration number and administrator name, and the last 4 digits of an ID card number if one was provided.
• AI Rights records (only for apps that ask for them): your AIVID, AIPLT and SLIVR records.
• AI assistants (Claude, ChatGPT): only your AIVerID number, your verification level and the permissions you granted — not your name, email or phone.

An app keeps what it receives under its own privacy policy. Disconnecting an app in your dashboard stops it from getting anything new, but it does not delete what the app already copied; ask that app to delete it.

We use these service providers. They process data for us; they do not get it to use for themselves.

• Railway — runs our servers and database, where everything above is stored.
• Vercel — hosts this website.
• Supabase — stores profile photos and identity-verification photos.
• Resend — sends our emails, so it receives your email address and the message.
• Google — our security alerts go to a Gmail inbox; an alert can include your account number, a partly hidden email address and an IP address. Our pages also load fonts from Google Fonts, so your browser contacts Google.
• Cloudflare (cdnjs) and Webflow — deliver some scripts and images on our pages, so your browser contacts them.

These providers may store data outside Thailand.

• Account details and profile photo: until your account is erased.
• Sign-in records: kept for our usage counts; once your account is erased they are linked only to its account number.
• Identity-verification photos: 30 days after review, or less as described above.
• Security log: 12 months.
• Password reset requests: deleted one day after the link expires (links expire after one hour).
• Our hosting providers keep their own technical logs for a limited time that they set.

• Passwords are stored only as bcrypt hashes; names and ID card numbers are encrypted with AES-256-GCM.
• Sign-in tokens are stored only as hashes, expire after a set time, and can be revoked. Sign-in follows OAuth 2.0 with PKCE.
• Traffic to our website and servers is encrypted (HTTPS).
• Sign-in attempts are rate-limited, and our administrator account needs a password and a code sent by email.

Other details, such as your email address, phone number and wallet addresses, are not encrypted by our application; they are protected by our providers' security. No system is completely secure. If a breach affects your data, we will tell you and the authorities as the law requires.

In your dashboard you can:

• see your profile, and add or remove your profile photo;
• see the apps and AI assistants connected to your account, and disconnect any of them;
• sign out of every device at once.

On the identity verification page you can cancel a verification that is still waiting for review, which deletes its photos at once.

To change your password, use “Forgot password” on the sign-in page.

For anything else, email aivisibilityrights@gmail.com from the address on your account. We reply within 30 days.

• A copy of your data: we send you what we hold about you.
• Corrections: we correct your name, email address or other details. You cannot edit them yourself yet.
• Erasing your account: we erase your email address, name, phone number, date of birth, wallet addresses, ID card number, profile photo and identity-verification photos; disconnect every app and AI assistant; sign you out everywhere; and remove your IP address and browser from the security log and from copies in our other logs. What remains is a record of your account number, when the account was created and erased, your country and how you signed up, so that the number is never given to anyone else. With us, the number no longer leads to any of your details; but apps you used may still hold it next to what they copied, so ask them to delete their copy too. Your email address can then be used to sign up again.
• Stopping updates: we stop, if you ticked the newsletter box.

If you are unhappy with how we handle your data, you can also complain to Thailand's Office of the Personal Data Protection Committee (PDPC).

AIVerID is not meant for anyone under 18. We do not check age at sign-up. If you believe a child has an account, email us and we will erase it.

When we change how we handle your data, we update this page first and change the date below.

Email: aivisibilityrights@gmail.com