Privacy Policy

Last updated: September 26, 2026

日本語はこちら

This policy explains how Great Bright Science and Technology Inc. (偉輝科技株式会社, “GBST”, “we”) handles personal data through FirstPass: the website firstpass.cloud, the customer dashboard, the hosted identity verification page and the API at api.firstpass.cloud.

1. Who we are

• Operator: Great Bright Science and Technology Inc. (偉輝科技株式会社)
• Representative Director: TAN PEK AUN
• Address: 402, 1-51-3 Chuo, Nakano-ku, Tokyo 164-0011, Japan
• Contact: hello@firstpass.cloud

2. Two roles: customers and applicants

Customers are the businesses that create a FirstPass workspace and send identity checks to us. For customer account data we decide how the data is used.

Applicants are the customer's own end users whose face and identity document are checked. We process applicant data on behalf of the customer, to run the checks the customer requests. The customer decides to verify its users with FirstPass and is responsible for telling its applicants about it, for having a lawful basis, and for obtaining any consent that applicable law requires (including consent to process biometric data and to store it as described below) before sending their data to FirstPass. If you are an applicant, please contact the service that asked you to verify first; we will also help with requests sent to us (section 9).

3. What we collect

Customer account and billing data

• Company or workspace name, email address, and a password (stored only as a salted hash).
• API keys (stored only as a hash plus a short hint; the full key is shown once).
• Credit balance and top-up history: Stripe checkout session and payment identifiers, or USDT transaction hash, network and amount. We do not receive or store card numbers; card payments are entered on Stripe.
• Usage logs: which API endpoint was called, when, whether it was billable, and the result verdict.
• The IP address of sign-up attempts, used for abuse limits.
• Monthly usage reports we email to the workspace address.

Applicant data (KYC checks)

• Identity data sent by the customer or entered on the verification page: name, email, phone number, and for Level B also date of birth, nationality, address, occupation, whether the person is a politically exposed person, source of funds and annual income (self-declared, not verified by us).
• Face images: the selfie and, on the hosted verification page, the live-scan evidence (challenge frames, screen-flash frames and a short scan video).
• Identity document images and the fields read from them (document type, document number, name, date of birth, expiry). For images classified as Japanese My Number cards, the document-number field is cleared and sensitive-number filtering is applied to OCR text. Misclassification remains possible; submit the photo side and mask sensitive numbers before upload.
• For Level B: proof-of-residence and source-of-funds documents and the fields read from them.
• Results: face match score and verdict, a face fingerprint (a 128-number face embedding derived from the images, which is biometric data), document and liveness checks, and the overall outcome.
• The customer's own reference for the applicant, if the customer provides one.

Website visitors

• Free demo: the email address you enter and your IP address. Your selfie and ID photo (and, for Level B, your residence and funds documents) are processed to show the result and to email you a report, but the images are not stored. We keep the email address, IP address, chosen level, face match verdict and similarity score, document type, and whether your browser reported a live scan (a self-reported flag we do not verify). The name and phone check on the website keeps only the email address and IP address.
• Support chat: the messages you type and the replies, linked to a random session id, and your IP address for rate limiting.
• Analytics and advertising data described in section 7.

4. KYC records are retained

These paid checks are each stored as a record: Level A and Level B (hosted verification sessions and the direct /v1/kyc/a and /v1/kyc/b calls), face compare (/v1/face/compare) and ID document reading (/v1/document/ocr). A record contains the identity data and results that check produced and downscaled selfie and/or document images. Hosted sessions also store the live-scan frames, screen-flash frames, scan video and face fingerprint; if the applicant retries on the same link, the new attempt replaces the previous attempt's record. Direct Level A and B calls do not store the face fingerprint they return. An ID image that shows no face (for example the back of a card) is not stored; only the fields read from it are. For Level B, the proof-of-residence and source-of-funds images are stored encrypted, separately from the record, and inaccessible 90 days after upload, then overwritten at startup or by the next expiry job; the fields read from them stay with the record. Only authorised FirstPass staff reviewing records can view these two images through the staff page (not the customer's dashboard, exports or API), and staff-page access is logged with the staff account and time (admin-token access is logged as a shared admin identity). This access does not assign applicant review to FirstPass. The service requesting verification handles review and any follow-up; if it needs original proofs, it must arrange collection with the applicant. The face fingerprint endpoint (/v1/face/embed), the name, email and phone check (/v1/identity/basic) and proof-of-residence reading (/v1/document/por) are billed but create no record. Standalone proof-of-residence reading refunds unreadable or unrecognized documents and reader outages; Level B retains its overall 2-credit charge for unreadable proofs. Storage is not optional for customers and cannot be switched off.

• Records are encrypted (Fernet, AES-based) before being written to our database.
• Each record is visible only in the dashboard of the customer that ran the check, and to our authorised operations staff (Level B proof-of-residence and source-of-funds images: our authorised staff only, through logged staff-page access). Faces are never matched across customers; FirstPass is not a shared face database and runs no face search.
• Records have no automatic deletion period. They are kept while the customer uses the service and afterwards until erased. Our operations staff erase a record on request (section 8).

5. Why we use the data

• To run the identity checks customers request and return and store the results for their audit trail.
• To operate customer accounts, sign-in, billing and credits, and to send service emails (API key, monthly reports).
• To prevent abuse (rate limits on sign-up, demo and chat) and keep the service secure.
• To answer questions through the support chat and by email, and to follow up on sales enquiries.
• To understand how the website is used and measure our advertising (section 7).

We do not sell personal data, and we do not use applicant data for our own marketing or to train AI models.

6. Service providers and where data goes

Face matching and the face fingerprint are computed on our own servers, not by a third party. USDT top-ups are detected by our own payment gateway on the same servers; blockchain transactions are public by nature. Email addresses may be checked with a DNS lookup of the domain's mail server.

7. Analytics and advertising on the website

The public pages of firstpass.cloud use these tags. They are not loaded on the identity verification page, the customer dashboard or the API.

• Google Analytics 4 and Google Ads (Google LLC, United States): pages viewed, cookie identifiers, device and browser information, and events such as form submissions, to understand site use and measure ad performance. Opt out with Google's add-on https://tools.google.com/dlpage/gaoptout or at https://adssettings.google.com.
• X Pixel (X Corp., United States): pages viewed, whether a workspace sign-up was completed (a conversion), cookie identifiers, IP address, and device and browser information. The company name, email address and password you enter are not sent. Managed under X's privacy policy (https://x.com/en/privacy); you can turn off ad personalization in X's “Personalization and data” settings: https://x.com/settings/account/personalization.

8. How long we keep data

• KYC records: no automatic deletion period (section 4). Erasure on request: we overwrite the record so the images, face fingerprint, name and email are removed, and keep an erasure marker plus record metadata such as id, workspace, level and timestamps. Linked sessions retain operational metadata, including return_url; avoid putting personal data in that URL. Record erasure does not also erase demo/signup logs or separate website sales chats; requests covering these require a separate operational assessment.
• Level B proof-of-residence and source-of-funds images: inaccessible 90 days after upload, then overwritten at startup or by the next expiry job (the image is overwritten; the record and the fields read from the documents are kept). An image that may show a 12-digit My Number (個人番号), or that our reader could not check, is not stored at all; only the fields read from it are kept.
• Customer account, billing and usage records: while the workspace exists and afterwards as needed for accounting and legal obligations.
• Demo leads, support chat messages and abuse-limit logs: no fixed deletion period at present. Contact hello@firstpass.cloud about erasure; these logs need separate handling from KYC record erasure, with no completion time guaranteed.
• Database backups: rolling local copies (about 7 days) and off-site copies that are replaced over time, so erased or deleted data may remain in backups for a limited period.

9. Your rights

Depending on where you live (for example under Japan's Act on the Protection of Personal Information or the EU/UK GDPR), you may ask us to tell you what data we hold about you, give you a copy, correct it, stop using it, or erase it. Applicants should normally contact the service they verified with, which controls their record; you can also write to us and we will work with that customer. Customers can request erasure of an applicant record on the applicant's behalf. Email hello@firstpass.cloud; we may need to confirm your identity. You may also complain to your data protection authority (in Japan, the Personal Information Protection Commission).

10. Transfers outside your country

Our servers are in Japan, but several providers above are based in the United States and may process data there or elsewhere. Data protection rules in those countries may differ from those in your country. We use providers that commit to protecting the data under their terms, and we send them only what their task needs.

11. Security

Connections use HTTPS. KYC records are encrypted in the database, API keys and passwords are stored only as hashes, dashboard sessions use signed cookies, and access to the servers and operations tools is limited to authorised staff. No system is perfectly secure; we will notify affected customers and authorities of a breach as required by law.

12. Changes

We will update this page when our practices change and change the date above. Material changes that affect customers will also be announced to workspace email addresses.