Privacy Policy
What WorkPair collects, why, who sees it, how long it’s kept, and the rights you have over it.
Version 2026-10-05 · Last updated October 5, 2026 · WorkPair®, Inc.
Who we are
WorkPair Registry is operated by WorkPair®, Inc., a Delaware corporation and a wholly owned subsidiary of The Ravine of Willows, Inc. WorkPair is the intellectual property of Enemo Consulting Group, Inc. WorkPair®, Inc. is the controller of the personal data described here, except where an organization uses WorkPair to process data on its own behalf (see “Organizations”). Contact: support@workpair.io. [Counsel to confirm: postal address; EU/UK representative (GDPR Art. 27); data protection officer, if required; Nigerian NDPC registration]
The short version
- Your WorkPair key is created on your device and stays there. We never hold it. If you set a passphrase, we keep an encrypted copy we can’t open.
- Nothing about you is shared with an organization unless you approve it, or you set your own rules that answer for you.
- We don’t sell personal data, show ads or use tracking cookies.
- You can download everything we hold about you, and delete your WorkPair ID, from your Profile.
What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Email address | You | Sign-in codes, notices about your record |
| Your WorkPair ID (a public key) and devices you sign in on (browser and device type, sign-in times) | Your devices | Proving it’s you; letting you see and sign out devices |
| Confirmation you are 18 or older | You, before paying | Only adults open their own WorkPair ID. We keep that you confirmed, not the date you entered. |
| Identity check: photos of your ID document, a selfie and liveness check, your ID number (in the US, your SSN) | You, through our identity provider (Stripe Identity) | Proving you are a real person and the one on the document (identity assurance level 2), and that one person holds only one WorkPair ID. See the Biometric Data Policy. |
| Your legal name | The identity check | Shown on your record and shared only when you approve |
| One-way hashes of your ID document number and ID number | The identity check | Fraud prevention: one person, one WorkPair ID. The numbers themselves are not stored. |
| Credentials: facts about you (for example enrollment, a degree, employment, a license), including sealed results such as reviews and grades | The organizations and people who issue them | Holding facts you can share; sealed results stay visible only to you until you unseal them |
| Requests about you, your decisions, your sharing rules and the access log | Organizations and you | Answering requests only with your consent, and showing you every answer given |
| Links with organizations; requests you send asking someone to confirm a fact (their name, email and the facts you claim) | You and organizations | Letting organizations issue to you; asking people to vouch |
| Children’s records: the child’s legal name and date of birth, guardians, and the child’s credentials | Guardians, schools and our staff review | Keeping a child’s record until they take it over at 18 |
| Wallet, top-ups, fees and saved-card references | You and Stripe | Paying WorkPair fees. Card numbers are held by Stripe, not by us. |
| Consent receipts (which versions of these documents you accepted, and your biometric release) | You | Proof of what you agreed to |
| Security audit trail | WorkPair | Tamper-evident record of actions on accounts; designed to exclude contact details |
Our servers also see your IP address when you connect. We don’t store it with your account; our hosting provider keeps request logs for a short period for security and reliability. [Counsel to confirm: log retention period at Vercel under our plan]
Legal bases
We process data to provide the service you signed up for (contract); with your consent (sharing answers with organizations, the biometric identity check, optional monitoring); for our legitimate interests in preventing fraud and keeping the service secure (uniqueness hashes, security logs); and to meet legal obligations (financial records, responding to lawful requests). [Counsel to confirm: legal bases per jurisdiction, including GDPR Art. 9(2)(a) explicit consent for biometric data and NDPA 2023 lawful bases]
Who receives your data
- Organizations you approve. When you approve a request (or your own rules answer it), the requester receives only the answers and fields you chose. Organizations that check credentials pay for checks; you never do.
- The person or organization you ask to confirm a fact sees your verified legal name and what you claim. A person who vouches for you does so under their verified legal name, which is shown to whoever checks that fact.
- Service providers that run WorkPair for us, listed on the Subprocessors page.
- Authorities, when the law requires it. [Counsel to confirm: law-enforcement request policy and notice to users]
We do not sell or share personal data for advertising.
How long we keep it
| Data | Kept for |
|---|---|
| Your account, credentials, sharing rules and access log | Until you delete your WorkPair ID |
| Identity-check images, selfie and ID numbers held by Stripe | Deleted from Stripe as soon as the result has been used (we retry until it succeeds) |
| Sign-in sessions and device descriptions | 30 days after the session ends |
| Sign-in codes and challenges | 1 day after they expire |
| Read notifications | 180 days |
| Contents of webhook messages sent to organizations | 30 days |
| Contact details and claimed facts on ended requests (including people who never joined) | 90 days after the request ends |
| A child’s record nobody claims after 18 | 7 years after the age of majority, then deleted |
| Wallet ledger and payment records | As financial records [Counsel to confirm: statutory period, typically 7 years] |
| Consent receipts, the security audit trail and uniqueness hashes | Kept after deletion, without contact details, as legal and fraud-prevention records |
Deleting your WorkPair ID
From your Profile, with your WorkPair key and a code we email you. We revoke every credential on your record, end links and monitoring (organizations watching your record are told), and remove your email, legal name and other personal details. A pseudonymous placeholder remains so that records that must not change (the audit trail, consent receipts, the wallet ledger) stay consistent. Any wallet balance is refunded to the original payment method. Guardians can delete a child’s record; with two guardians, both confirm.
Your rights
Depending on where you live, you have the right to:
- access and download your data (Profile → Export gives you everything, with sources, recipients, purposes and retention);
- correct it (a fact on a credential is corrected by its issuer; ask us and we’ll pass it on);
- delete it (in the app, or by writing to us);
- object to or restrict processing, and withdraw consent at any time (withdrawing doesn’t undo answers already given);
- take your data elsewhere (the export is in standard W3C Verifiable Credentials format);
- not be discriminated against for using these rights;
- appeal our decision on a request, and complain to your data protection authority.
Write to support@workpair.io. We answer within one month (45 days for California requests). Executors and next of kin may write to the same address about a person who has died. [Counsel to confirm: verification steps for requests; authorized agents (CCPA); state-specific notices; NDPA s.34–38 rights wording]
Children
People under 18 can’t open their own WorkPair ID. A parent or legal guardian, whose own identity is verified, can open a record for a child; our staff review the guardianship before it becomes active. Guardians approve every request about the child and choose what is shared. Schools can add enrollment, attendance, awards and structured results such as test scores; results arrive sealed, visible only to the guardians until they choose to share them. Free-text comments are never added to a child’s record. At 18 the young adult takes over the record at no cost. Guardians can delete a child’s record at any time. [Counsel to confirm: COPPA verifiable parental consent method; FERPA school-official terms; UK Age Appropriate Design Code; state student-privacy laws]
Security
Personal fields are encrypted in our database; your signing key never leaves your devices; sign-in needs your key or an emailed code, and anything that changes your record needs your key. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.
International transfers
WorkPair is hosted in the United States. If you use it from elsewhere, your data is transferred to the US. [Counsel to confirm: transfer mechanism (EU SCCs / UK IDTA / EU-US Data Privacy Framework) and NDPA cross-border basis]
Cookies and storage
We only use storage that WorkPair needs to work. See Cookies and Storage.
Changes
When we change this policy we update the version above and ask you to accept the new version the next time you sign in.