This policy explains how your identification document is collected, processed, stored, and deleted.
Last updated: 25 April 2026
When a service provider on the Velyxa platform requests ID verification as part of a booking, you may be asked to upload a photo of your identification document. We understand this requires trust, so we want to be completely transparent about what happens with your data.
When you complete an ID verification request, we collect a photograph of your identification document. This may be a driver's licence, passport, or proof of age card.
The image is uploaded securely over an encrypted connection and stored in Supabase Storage, our secure cloud database and file storage provider.
We also record your phone number (as provided during the booking process) and the timestamp of the verification for record-keeping purposes.
Your ID image is analysed by an AI system (Claude, by Anthropic) to determine whether the uploaded image is a valid identification document.
The AI checks that the image contains a recognisable ID document (such as a licence, passport, or proof of age card) and extracts the name shown on the document.
The AI does not perform facial recognition or biometric analysis. It simply confirms that the image is a legitimate ID and reads the name displayed on it.
If the AI determines the image is not a valid ID (for example, a random photo, a blurry image, or a screenshot), the verification will be declined and you will be asked to try again.
The service provider who requested the verification can view your ID image through their secure dashboard. This is so they can confirm your identity before a booking.
Velyxa staff do not routinely access ID images. We may access them only if required to investigate a report or resolve a dispute, and only in accordance with our obligations under Australian law.
Your ID image is never shared with other users, third parties, or used for marketing purposes.
Your ID image is automatically and permanently deleted from our systems after 365 days from the date of upload.
If you have been reported by a service provider for safety reasons, your ID data may be retained for longer than 365 days. This is necessary to protect the safety of providers on the platform and to comply with any legal obligations.
You may request early deletion of your ID image by contacting us at help@velyxa.ai. We will action your request within 30 days, unless the data is required to be retained for safety or legal reasons.
All ID images are encrypted in transit using TLS and encrypted at rest using AES-256 encryption.
Images are stored in secure, access-controlled cloud storage hosted by Supabase.
Access to stored images is restricted through row-level security policies, ensuring that only the relevant service provider (and authorised Velyxa systems) can access a given image.
We regularly review our security practices to ensure your data remains protected.
Supabase provides secure database and file storage. Your ID image is stored in Supabase Storage with access-controlled security policies.
Anthropic (Claude AI) processes your ID image to verify it is a legitimate identification document. Anthropic does not retain or use your image data for training purposes.
You have the right to request a copy of any personal data we hold about you, including ID verification records.
You have the right to request deletion of your ID image at any time, subject to safety and legal retention requirements.
You have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe your data has been mishandled.
For any requests or questions, contact us at help@velyxa.ai.
ID verification exists to protect the safety of service providers on the Velyxa platform. It helps confirm that the person making a booking is who they say they are.
Providing your ID is voluntary. It is requested by the individual service provider, not by Velyxa. If you choose not to provide ID, the service provider may decline the booking.
We understand that sharing your ID requires trust. That is why we are transparent about exactly what happens with your data, and why we automatically delete it after 365 days.