Doorman
Privacy notice
Last updated 10 August 2026
The short version
Doorman helps a shop check that a shopper is old enough to buy age-restricted products. When a shopper takes a photo for an age check, that photo is analysed in memory and discarded within the same request. It is never written to disk, never stored, never sent anywhere else, and never seen by a person. We do not keep the photo, and we do not create or keep a face template or any other biometric identifier. If you are signed in to the shop, a one-way hash of your account id is kept for as long as the check lasts, purely so you are not asked again on another device.
Who is responsible for what
The merchant running the shop decides that an age check is required and is the controller of that decision. Doorman acts as a processor on their behalf. If you are a shopper with a question about a specific shop, contact that shop first.
What we process, and why
| Data | Why | How long |
|---|---|---|
| A single photo frame (only if the shopper chooses the photo check) | To estimate an apparent age | Held in memory for the length of one request, then discarded. Never stored. |
| A date of birth (only if the shopper uses that route) | To compare against the required age | Used during the request only. Never stored. |
| IP address | To determine the country and region, so that photo checks are not offered where local law restricts them | Used during the request only. Never stored. |
| A record that a check happened | So the merchant can show an inspector that checks are being carried out | Stored for 24 months, then deleted automatically. Contains the time, the method used, the outcome, the age required, a five-year apparent-age band, the country/region, and a reference code. It contains no name, no photo, no date of birth and no IP address. |
| A one-way hash of your customer account id — only if you are signed in | So that verifying on your phone means you are not asked again on your laptop | Stored until the check expires, then deleted. The account id itself is never stored: what is kept is a salted hash, specific to that one shop, which cannot be reversed and identifies nothing outside it. If you are not signed in, nothing is kept at all. |
| Shop settings, rules and Shopify session credentials | To run the app for the merchant | Stored while the app is installed. |
Automated decisions
An age estimate is produced by software, not by a person. It is deliberately not treated as a final answer: a shopper whose estimated age is close to the threshold is asked to verify another way rather than being refused. A shopper who believes a decision was wrong can ask the shop to verify them by another route.
Photo checks are always optional
A photo check never happens without the shopper agreeing to it first: the camera only opens after explicit consent, and a non-biometric route (entering a date of birth, or a document check where the shop offers one) is always available instead. Consent can be declined at any point, and declining still leaves a way to complete the purchase.
Merchants can also list regions where the photo route should not be offered at all. That list is applied wherever the shopper’s region is known to the store; it is not a substitute for the consent step above, which applies everywhere and to every shopper.
Retention and destruction
Photo frames and dates of birth are destroyed at the end of the request that used them — in practice within about a second, and always before the response is returned. No copy is retained in any backup, log or cache.
Records that a check happened are kept for 24 months and then deleted automatically, which is long enough to answer a question about last year's trading and no longer. Operational messages inside the app are kept for 90 days. A cross-device pass is deleted as soon as it expires. Everything belonging to a shop — records, settings, rules and credentials — is deleted within 30 days of the app being uninstalled.
Sub-processors
Hosting is provided by Oracle Cloud. If a merchant enables optional identity-document checks, that check is carried out by the document verification provider they have chosen, under that provider's own terms; we receive only a pass or fail and a reference code.
Your rights
Depending on where you live you may have the right to access, correct, delete or object to the processing of your personal data. Because we do not store photos, dates of birth, names or IP addresses, there is generally nothing held about an individual shopper to retrieve. Requests can be sent to the address below and are answered within 30 days.
Contact
Questions or requests: tsoukalasltd@gmail.com