Biometric Information Privacy
Our public written policy under the Illinois Biometric Information Privacy Act, 740 ILCS 14: written notice and consent before collection, a stated retention schedule, destruction guidelines, and a no-sale commitment.
Contents and legal documents
Purpose and scope
This is the written policy of GrayPass, Inc., regarding biometric data, published in accordance with the Illinois Biometric Information Privacy Act, 740 ILCS 14 ("BIPA"), and made available to the public as BIPA section 15(a) requires.
It applies to any data GrayPass collects, captures, receives, or stores that constitutes a "biometric identifier" or "biometric information" under BIPA, and to the Brainprint templates created through the GrayPass platform, wherever an Illinois resident is concerned.
Our position on Brainprint templates
GrayPass does not collect the identifiers BIPA enumerates: no retina or iris scans, no fingerprints, no voiceprints, and no scans of hand or face geometry. What we process are interaction timing patterns and kinematics, reduced on the device and used to create an encrypted, tenant-scoped Brainprint template.
Whether such templates fall within BIPA's definitions is not settled law. We do not rest on that ambiguity: we treat Brainprint templates with the full set of protections BIPA prescribes for biometric identifiers, as set out below. When in doubt, we apply the stricter reading.
Consent before collection
Before any behavioral signals are collected from an Illinois resident, GrayPass (or the customer whose application integrates GrayPass) must:
- inform the person in writing that behavioral timing data is being collected and a template created;
- state the specific purpose (confirming that the expected person remains in control of an account or action) and the length of term over which the data will be kept;
- obtain a written release, in practice an explicit electronic consent, before collection begins.
Customers deploying GrayPass to Illinois users are contractually required to gate collection until they have presented this notice and obtained the required affirmative consent.
Retention schedule
We retain Brainprint templates only while they serve the purpose for which they were created:
- Active accounts: the template persists while the account (or the customer relationship it belongs to) remains active.
- Deletion requests: destroyed within thirty (30) days of a verified request.
- Inactivity: destroyed when the initial purpose for collection has been satisfied, and in any event within three (3) years of the individual's last interaction with the service, whichever comes first, per BIPA section 15(a).
- Raw behavioral streams: never retained at all; they are discarded on the device by construction.
Destruction guidelines
Destruction removes the Brainprint template, terminates live sessions, clears subject metadata, and revokes outstanding proofs. Customer environments and their data are deleted within thirty (30) days after termination.
Revocation is immediate and irreversible. Recovery is handled through authenticated re-enrollment under the customer's declared anchor, not by exporting or rotating a template.
No sale, no profit, no unauthorized disclosure
- GrayPass does not, and will not, sell, lease, trade, or otherwise profit from biometric identifiers, biometric information, or Brainprint templates.
- We do not disclose them except: with the individual's consent; to complete a transaction the individual requested (returning an authorization decision to the application they are using); or when required by law, warrant, or subpoena.
- Decisions returned to customers contain the decision, typed assurance, and reason codes, never the template, never raw signals.
Standard of care
Brainprint templates are stored using a standard of care at or above how we protect confidential information: encryption at rest, TLS in production, tenant and environment isolation, access controls, and audit logging.
Illinois residents' rights and contact
If you are an Illinois resident, you may request access to, or destruction of, any Brainprint template we hold about you, and you may withdraw consent to further collection at any time. Requests go to tools@graypass.org with the subject "BIPA request"; we respond within thirty (30) days.
If GrayPass is processing your data on behalf of an application you use, we will honor destruction instructions from that application and route your direct requests to it, as the law and our contracts require.