Privacy centre

Your identity evidence should not outlive its purpose.

DAJU separates identity evidence from customer-facing references, records consent by purpose and version, restricts evidence access, and supports time-bound retention and verified data-rights workflows.

Your rights

Requests DAJU is designed to support

Access

Ask what personal data is being processed and receive a verified export.

Correction

Request correction of inaccurate identity or verification information.

Deletion

Request deletion where no legal, regulatory, security, or dispute hold applies.

Restriction or objection

Ask that processing be limited or object to an eligible purpose.

Human review

Request an explanation and human review of an automated decision.

Make a request

Start with the organisation that verified you

Use that organisation's verified support or privacy channel and provide the DAJU session or subject reference shown in your journey. Do not send identity documents, selfies, passwords, one-time codes, or payment details by ordinary email or chat. The organisation must verify your identity before disclosing, correcting, exporting, or deleting information.

What happens next

  1. Your request is logged using a hashed case reference.
  2. Your identity and authority to act are verified.
  3. Legal holds and applicable retention duties are checked.
  4. The outcome and any export or deletion evidence are recorded.

Safeguards

Deletion is controlled, not cosmetic

Active legal holds block deletion. A deletion request cannot be marked fulfilled while in-scope evidence remains. Evidence workers claim jobs with bounded concurrency, record cryptographic receipts, and preserve an immutable operational history without retaining the deleted evidence itself.

Cookies

Analytics on public pages, only if you accept

We use cookies needed to run the site: a session cookie for a signed-in workspace, a session cookie for a verification in progress, and a stored theme preference. On public pages we use Google Analytics 4, provided by Google LLC, measurement ID G-M4Z3D85B27, to understand how those pages are used: how many people visit, which pages they open, and how they move between them. Signed-in, account, dashboard, API, token and verification-result pages never load the tag. No identity evidence, names, emails or advertising audiences are sent.

Google sets _ga (distinguishes browsers for up to two years) and _ga_* (persists the session state for this property for up to two years). Analytics cookies are set only after you press Accept. Advertising storage, ad user data and ad personalisation remain denied (Google Consent Mode v2). GA4 does not log or store IP addresses; it uses them briefly to derive approximate location, then discards them. We do not use Google Signals or advertising features.

Your Accept or Reject choice is stored in our first-party cookie daju-analytics-consent for about six months. You can change or revoke it at any time using Cookie settings in the footer. Until you Accept, analytics cookies are not set.