Biometric Data Notice and Policy

Last updated October 13, 2026 · Operated by Odyssey Developments

Some Wardeye features (the Shield plan’s live match) compare the face and voice of a person on a call with a template made when that person enrolled. This notice describes that processing. It is written to meet biometric-privacy laws such as the Illinois BIPA, Texas CUBI, Washington’s biometric law, and GDPR/UK GDPR Article 9.

Verify does not use biometrics. On the Verify plan nothing about anyone’s face or voice is collected. Face Unlock on a phone is performed by the phone’s operating system; Wardeye never receives that data.

1. What is collected, and only if you enrol

When a person chooses to enrol, Wardeye captures several short face video angles, spoken voice prompts and a short writing sample. These are converted into mathematical templates (face and voice embeddings) and a writing-style profile. The raw recordings are deleted after processing. Wardeye does not collect biometrics from the other participants on a call for storage; a live match compares what the Mac sees and hears against enrolled templates in memory, and the result is a score shown to the user.

2. Purpose

Solely to help the enrolled person’s organisation judge whether a caller claiming to be that person is likely real. We do not use biometrics for advertising, profiling, sale, employee monitoring or any other purpose, and we do not sell, lease, trade or profit from them.

No one is enrolled until they have read this notice and given informed written (electronic) consent, with a version number and timestamp recorded. Consent is voluntary and separate from any employment terms; a person may decline or withdraw at any time without retaliation from Wardeye, and organisations must offer an alternative verification method. Customers are responsible for any additional notice or consent that their jurisdiction or workplace requires.

4. Where templates live and who can reach them

Templates are created and stored on the designated Mac of the organisation that requested enrolment, protected with the Mac’s Keychain. They are not uploaded to our cloud. For remote enrolment, the person’s phone encrypts the captured media to that Mac’s public key before upload; our cloud holds only ciphertext it cannot read, and the Mac deletes it after processing. Odyssey staff do not have access to templates. Templates are protected using a standard of care at least as protective as we use for other confidential and sensitive information.

5. Retention and destruction

Templates are kept only while the person remains enrolled. They are permanently destroyed when the person withdraws, when the organisation removes them, when the purpose of collection ends (for example the person leaves the organisation), or within 3 years after the person’s last interaction with Wardeye, whichever comes first. Sealed uploads are deleted as described in the Privacy Policy. This schedule is our written, publicly available retention policy.

6. Disclosure

We do not disclose or disseminate biometric data, except to the extent the person consents, a valid legal process requires it, or to complete a financial transaction the person requested. Because templates stay on the organisation’s Mac, our ability to disclose them is limited.

7. Withdrawing and deleting

A person can withdraw consent and require deletion at any time by telling their organisation administrator or emailing wardeye@odysseydevelopments.dev. We will have the template removed and confirm in writing. Accuracy and fairness: face and voice matching is probabilistic and can be less accurate for some people, in poor lighting or on poor audio. A low score is never proof of fraud, and a high score is never proof of identity.

8. Security testing with synthetic media

If an organisation runs a security drill using synthetic (AI-generated) imitations, that requires separate, specific written consent from the person imitated, restricted storage, and deletion when the drill ends. Wardeye does not create or publish synthetic imitations of anyone without that consent.

9. Region notes