Data Retention & Privacy
What Stile stores, what gets purged and when, and how the platform minimizes the PII you ever touch.
Stile is built to minimize the personal data you handle. Identity material is collected only to run verification and review, then purged according to the lifecycle and jurisdiction rules below. What can persist longer is the verification outcome and sensitive hashed anchors used for same-operator returning-user lookup.
What persists vs. what's purged
| Data | Retention |
|---|---|
| Captured document evidence (images and extracted document PII) | Purged after a final verification or review decision. Review-held sessions retain the evidence needed by the reviewer until resolution. |
| Session-collected PII (workflow-collected names, DOB, addresses) | Purged by the session's resolved data_retention_days policy. This is separate from captured document evidence. |
| Hashed anchors (email hash, phone hash, document fingerprint) | Retained for deduplication and returning-user lookup. They are not raw PII but remain sensitive data and must be protected. |
| Verification outcome (age tier, method, expiry) | Retained — so returning users can skip re-verification even after raw PII is gone. |
Captured document images and extracted document PII are purged after the session receives its final verification or review decision. A session in under_review keeps the evidence needed to make that decision; approval or rejection then triggers the purge. Separately, workflow-collected PII in the session follows data_retention_days.
You never store the documents
Stile's public integration returns verification outcomes, not document images. Evidence needed for an active review remains inside Stile until the review resolves; it is not delivered to your webhook handler.
Jurisdiction-specific retention
Retention windows aren't one-size-fits-all — they're set by the compliance rule for the jurisdiction the verification ran in. Each rule carries three independent maximum windows:
| Limit | Governs |
|---|---|
data_retention_days | Collected PII (names, dates of birth, addresses). |
document_image_retention_days | Captured ID document images. |
biometric_retention_days | Biometric data such as face-match templates. |
Stile resolves these settings from the session's jurisdiction and workflow. Data may be purged earlier when it is no longer needed: in particular, captured document images and extracted document PII are removed at the final verification or review decision. The scheduled retention worker enforces the configured windows as upper bounds for any eligible data that remains. These settings describe platform behavior, not a legal conclusion about your application; confirm the applicable retention policy with your compliance team.
Credentials outlive raw PII
Verification credentials (the record that a user verified) are governed by their
credential_validity_days, not by these retention limits. A returning user can still skip
re-verification after their raw PII has been purged — until the credential itself expires.
Biometric consent
When the resolved workflow requires explicit biometric consent, the widget collects it before the biometric step and records it against the session. Retention of biometric templates then follows the resolved biometric_retention_days setting.
Erasure and data-subject requests
Stile supports deleting a user's biometric and verification data on request, so you can satisfy right-to-be-forgotten obligations (GDPR, CCPA, BIPA). Reach out through your account's support channel or the dashboard to action an erasure; the underlying biometric template for a session can be deleted independently of the verification outcome.
This is implementation guidance, not legal advice
Retention windows and consent requirements are driven by jurisdiction rules in the platform, but your own compliance obligations depend on your use case. Confirm the specifics with your compliance team.