Bommajung Biometric and Consumer Health Data Privacy Policy

Bommajung is a service of Destarlink LLC ("we", "us"). Last updated: November 1, 2026

1. What is collected and why

Bommajung is a verified, adults-only service. Checking that every member is a real adult is necessary to provide the service and to prevent identity theft, fake profiles and romance scams. So every member checks their identity once, when they join.

Our ID check provider, Stripe, Inc. ("Stripe"), asks you to take a photo of your government ID and a live selfie. Stripe compares the face in your selfie with the face on your ID. To do this, Stripe creates a scan of face geometry from both photos. This scan is "biometric data". Under some state laws, such as Washington's My Health My Data Act, it is also "consumer health data".

Source: you give the photos directly to Stripe on Stripe's screen.

We use the ID check only for one purpose: to check that you are the real person on the ID and that you are 18 or older.

We do not use biometric data for marketing, matching, or any other purpose. We do not sell, lease, or trade it, and we do not let anyone else profit from it.

2. Who receives it

Stripe receives your photos and creates and uses the face scan. Stripe does not give the face scan to us. We receive only the result: pass or fail, whether you are 18 or older, your birth year, and the date of the check.

Stripe handles this data in two roles:

• For us: Stripe keeps a copy for us so that we can see the result of your check. We ask Stripe to delete this copy right after the check is finished. This normally takes up to 4 days.
• For Stripe's own purposes: Stripe also uses the data, as an independent company, to prevent fraud and for security. For this purpose, Stripe keeps the face scan for up to one year and then deletes it, and keeps the ID images and the information read from your ID for up to 3 years. We ask for your separate consent to this sharing. Stripe will also ask for your own consent on its screen. Stripe asks separately if it may use your data to improve its technology, and you can say no. Stripe's Privacy Policy explains this: stripe.com/privacy. To ask Stripe to delete the data it keeps for its own purposes, email privacy@stripe.com.

3. How long we keep it

We never keep biometric data. The copy Stripe keeps for us is deleted right after the check, normally within 4 days, and in no case later than 30 days after the check. If a court order, warrant, or subpoena requires us to keep it, we keep it only as long as the order requires.

4. What we keep

We keep only: the result (pass or fail), 18+ yes or no, birth year, the date, a record of your consent (the consent text version, the time, and the full name you typed to sign it), and one-way coded values (HMAC) made from your phone number, your ID number with the issuing state, and your name with your full date of birth. These coded values cannot be turned back into the original information. We use them only to stop banned members from joining again. They are not biometric data. Your full date of birth is kept only inside this one-way coded value.

5. Things we do that are not biometric

• To find stolen or copied profile photos, we compare a simple image fingerprint (a hash of the picture file). This does not scan face geometry.
• We turn your 30-second voice intro and voice messages into text. We do not create a voiceprint and do not identify people by voice.

6. Security

We protect this information with at least the same care we use for other sensitive information, including encryption in transit and at rest.

7. Your rights and choices

• You can ask us what consumer health data we have about you, ask us to delete it, and withdraw your consent. We answer within 45 days. Email privacy@bommajung.com or use Settings > Privacy.
• The ID check is required to use Bommajung. If you do not agree to the face scan, no biometric data is collected. You can ask for an ID check by a person instead: you upload a photo of your ID only, a staff member checks it by eye within 2-3 business days, and we delete the photo right after the check, or after 14 days if no decision was made (then you can ask again).
• Washington residents: you have the rights above under the My Health My Data Act.