GDPR Compliance & Data Privacy

AgeVerify Shield was built with privacy by design. Here's how we protect your customers' data.

Core Privacy Principles

No Personal Data Stored Permanently – Sessions are anonymous and temporary
IP Addresses Are Hashed – SHA256 hashed, never stored in plain text (only first 32 characters kept)
Minimal Data Collection – Only what's needed for verification
Automatic Deletion – Sessions expire after the configured duration
No Third-Party Sharing – Data stays between you and your store

What Data Is Collected

Data Point	Storage	Purpose
Session ID	Temporary	Identify the verification session
Hashed IP (partial)	Temporary	Prevent abuse & rate limiting
Country Code	Temporary	Geo-targeting & compliance
User Agent (truncated, max 200 chars)	Temporary	Analytics & troubleshooting
Verification Result	Temporary	Track confirm/deny/block
Required Age	Temporary	Which age was verified
Rule ID	Temporary	Which rule triggered
Page URL & Type	Temporary	Analytics context

Session Duration

Sessions are automatically deleted after the configured period:

Plan	Default Audit Retention
Free	7 days
Basic	30 days
Pro	90 days
Enterprise	Unlimited (configurable)

Cookie Usage

A single cookie (__av_session) is set for verified users:

HttpOnly – Cannot be read by JavaScript
Secure – Only sent over HTTPS (in production)
SameSite=Lax – Protection against CSRF
HMAC-SHA256 signed – Tamper-proof
Max-Age: 24 hours (configurable)

Compliance Links

You can add legal links directly in the verification modal:

Privacy Policy
Terms of Service
Imprint / Legal Notice
Cookie Policy
Custom links (with label + URL)

Plan	Max Compliance Links
Free	1
Basic	3
Pro	Unlimited
Enterprise	Unlimited

Recommendations for Merchants

Add your Privacy Policy link to the verification modal
Mention age verification in your store's privacy policy
Set appropriate session durations – shorter is more privacy-friendly
Enable audit logging for compliance documentation
Consult a lawyer for specific legal requirements in your jurisdiction

Disclaimer: AgeVerify Shield helps you comply with age verification requirements but does not replace legal advice. Legal requirements vary by country and product type.