Colleckt LLC (“Colleckt”, “we”, or “us”) provides identity verification and USPS Form 1583 compliance services to commercial mail receiving agencies (“CMRAs”) and other businesses. This Privacy Policy explains what personal information we collect, how we use and share it, and the choices you have. Capitalized terms not defined here have the meanings given in our Terms of Service.
1. Who This Policy Covers
This policy applies to three groups of people:
Website visitors: people who visit colleckt.io or contact us through it.
Partners: businesses that use the Service, and the individuals who access it on their behalf.
End Customers: individuals whose identities are verified through the Service at a Partner’s request, such as a CMRA’s mailbox customers.
If you are an End Customer, the CMRA or other business that asked you to verify your identity decides why and how your information is used. Colleckt processes that information on its behalf, as described in Section 6.
2. Information We Collect
A. Information you give us
Contact and demo requests. When you contact us through our website, we collect your name, email address, company, expected monthly verification volume, and anything you write in your message.
Partner accounts. When a Partner signs up, we collect account information such as the names, email addresses, and roles of authorized users, login credentials, and billing details. Payment card information is handled by our payment processor and is not stored by Colleckt.
B. Information collected from End Customers
When an End Customer completes a verification, we collect the information the Partner requires, which may include:
(i) name, date of birth, residential address, email address, and phone number;
(ii) images of identity documents, such as a driver’s license, passport, or other government-issued ID, and the information printed on them, including document numbers and expiration dates;
(iii) a photo or short video of the End Customer’s face, captured to confirm that a live person is present (see Section 3);
(iv) the information required to complete USPS Form 1583, including business information where the mailbox is for a business, and the End Customer’s electronic signature; and
(v) verification results, timestamps, and an audit trail of each step.
C. Information collected automatically
When you use our website or the Service, our servers automatically record technical information such as IP address, browser and device type, pages requested, and the date and time of each request. We use this information to operate the Service, keep it secure, and detect fraud.
3. Liveness Checks and Biometric Information
During verification, the Service may analyze an image or video of an End Customer’s face to confirm that a real, live person is present and not a photo, screen, or mask (a “liveness check”). The liveness check may involve analyzing facial geometry.
Facial geometry is used only to complete the liveness check. It is processed while the check runs and is not stored by Colleckt afterward. We do not use it to build a facial recognition database, and we never sell, lease, trade, or otherwise profit from it.
Before any liveness check, the Service shows the End Customer a notice explaining the check and asks for their consent. An End Customer who does not consent can decline, and should contact the Partner about other ways to verify their identity.
4. How We Use Information
We use personal information to:
(i) verify identities, complete and file USPS Form 1583, and deliver the results to the Partner that requested them;
(ii) detect and prevent fraud, identity theft, and misuse of the Service;
(iii) operate, maintain, secure, and support the Service, including notifying Partners when an End Customer’s ID is about to expire;
(iv) respond to demo requests and other messages, and send Partners service-related notices;
(v) bill Partners and manage their accounts; and
(vi) comply with legal obligations, including USPS recordkeeping requirements, and enforce our Terms of Service.
We do not use End Customer information for our own marketing, and we do not use it to target advertising.
6. Our Role for Partners
For End Customer information, Colleckt acts as a service provider or processor to the Partner, as those terms are defined under applicable privacy and data protection laws. We process that information only on the Partner’s behalf, to provide the Service, and as permitted by our agreement with the Partner and applicable law. The Partner is responsible for providing End Customers with any notices it is required to give and for obtaining any required consents.
7. Aggregated Data
We may de-identify and aggregate information about use of the Service so that it no longer identifies, and cannot reasonably be linked to, any Partner or individual. We use this aggregated data to operate and improve the Service, including our fraud detection. We will not attempt to re-identify it, and we never create aggregated data from facial images, facial geometry, or images of identity documents.
8. Data Retention
Each Partner sets how long End Customer verification records are kept. By default, Colleckt keeps verification records for seven (7) years to support USPS recordkeeping requirements for Form 1583, and minimizes personal information in them after review.
When a Partner’s account ends, the Partner has thirty (30) days to export its data. After that, we delete it or make it permanently inaccessible, except where the law requires us to keep it. Copies in backups are overwritten in the ordinary course of our backup rotation.
Facial geometry used for liveness checks is not retained, as described in Section 3. We keep contact and demo request information for as long as needed to respond and follow up, and Partner account and billing records for as long as the account is active and afterward as required for tax, accounting, and legal purposes.
9. Security
We maintain a written information security program with administrative, physical, and technical safeguards, including encryption of data in transit and at rest, role-based access controls, and logging and monitoring of access to personal information. No system is perfectly secure, and we cannot guarantee that unauthorized parties will never defeat our safeguards. If we confirm a security incident affecting personal information, we will notify affected Partners and others as required by law.
10. Your Privacy Rights
Depending on where you live, you may have the right to know what personal information we hold about you, to get a copy of it, to correct it, to delete it, and to appeal our decision on a request. We will not discriminate against you for exercising these rights.
End Customers. Because we process your information on behalf of the business that asked you to verify your identity, please send your request to that business first. If you contact us instead, we will forward your request to the business and help it respond. Some information may need to be kept to meet USPS recordkeeping requirements.
Website visitors and Partner users. Email us at legal@colleckt.io. We will verify your identity before acting on a request, and you may use an authorized agent where the law allows. You can unsubscribe from marketing emails at any time using the link in the email; we will still send service-related notices.
12. Children
The Service is intended for businesses and adults. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.
13. Where We Process Data
Colleckt is based in the United States, and we store and process personal information in the United States.
14. Changes to This Policy
We may update this policy from time to time. When we do, we will change the “Last updated” date at the top of this page, and if the changes are material we will notify Partners by email or through the Service.
15. Contact Us
If you have questions about this Privacy Policy or how we handle personal information, contact us at legal@colleckt.io.