Privacy Policy

Magic Auth is operated by TS Robotics Limited. This notice covers our website, direct accounts and the identity, signature and security services we provide. Our contact and registered office details appear at the end of this page.

Public company registration and personal enrolment are not yet available. The sections about identity capture, sharing and premium accounts explain those services before they open. Visiting this website does not verify your identity, enrol you in biometric matching or authorise model training. Check access and availability before starting.

1. Who is responsible for your information

TS Robotics is the controller for the Magic Auth profile we maintain for you, our direct membership relationship, website operations, support and our own security purposes. We also determine the separate purposes of duplicate-profile detection and any separately authorised development of our identity models.

A company requesting your details is responsible for why it needs them and how it uses information you authorise it to receive. Its privacy notice applies to that use. Where we carry out a specific task solely on a company's documented instructions, our processor responsibilities must be set out in the relevant data processing agreement. A company account does not give that company unrestricted access to your profile.

2. Information we collect and its sources

Do not email identity documents, biometric recordings, passwords, recovery keys or card details to our support address. We will arrange an appropriate route if evidence is needed to handle your request.

3. One profile and your choice of companies

You have one personal profile. Multiple companies may request access, but each request requires your authorisation for that company and the details to be shared. A company cannot use another company's permission.

A completed identity verification can be reused for three calendar months from completion. Reuse does not extend that period. After it expires, a fresh check is required on the existing profile. Verification validity is separate from how long evidence is retained.

Declining a request prevents that requested disclosure. The company must explain how that affects its own service and any alternative route. Removing a sharing permission stops future access under that permission; it does not automatically remove copies the company already received. The company remains responsible for those copies and any lawful retention.

4. Verification, duplicate detection and training

Each new verification requires explicit consent to the capture and processing described for that check. Recovery checks also require fresh consent. An earlier check, a subscription payment or acceptance of service terms does not supply it.

Duplicate-profile detection has a separate consent choice and record. The current enrolment design requires that choice to complete a new profile or recovery capture. If it is refused, that process cannot complete. Public enrolment remains unavailable while the matching system, coverage and participation arrangements are completed.

Training is independently optional. Only a separate, affirmative training choice may authorise the use of raw documents, selfies or recordings to develop and evaluate our own identity models. Refusing training does not prevent verification. No training consent is inferred from verification or duplicate-detection consent.

You can withdraw each consent separately through the relevant service control when available, or contact admin@tsrobotic.com. Withdrawal stops future use for that consented purpose and triggers a review of related evidence and access. It does not make earlier lawful processing unlawful. If a sample has already influenced a trained model, removing the sample alone does not reverse that influence; the request must also assess the affected model and any further action needed.

5. Why we use information

If a required account field is missing, we may be unable to create the account or fulfil the request. A requesting company must explain any statutory or contractual requirement it places on you. We do not infer permission for marketing from an enquiry or service registration.

6. How long information is kept

Our selected raw-evidence policy has no fixed automatic expiry. Documents, selfies and recordings may therefore be retained indefinitely, but only while a recorded purpose still needs them and a valid basis permits that retention. The policy requires a necessity review at least annually. It does not authorise keeping evidence after it is no longer needed.

Those reviews consider whether the relevant service remains active, whether a check or dispute is unresolved, whether consent has been withdrawn, and whether a specific legal hold applies. A legal hold must have its own reason and scope. It cannot silently become permission for training.

Account information is needed while the account is active. After closure, retention is limited to unresolved support, security, billing or legal matters and any identified statutory record-keeping duty. Enquiry records are kept while the enquiry and any resulting follow-up remain relevant. Security logs are retained according to incident investigation needs; payment records follow applicable accounting requirements.

Vault contents are subject to deletion requests and the storage controls of the enabled service. Withdrawal and erasure requests must also address processors, authorised copies and backups where applicable. We will explain any information that must be retained, the reason and the period or criteria used, rather than promise immediate deletion of every copy.

7. Who may receive information

We do not sell personal information. Recipients depend on the service you use:

• Companies you authorise receive the selected verified details and relevant verification information. This does not grant general access to raw evidence or your Vault.
• Assigned reviewers may see evidence needed for their verification case. Recovery may include consented access to a retained portrait from an earlier check, including a check initiated by another company. Access is limited to that case.
• Google Cloud provides hosting, database and key-management services. Cloudflare provides website delivery and edge services. Stripe processes payments where checkout is enabled.
• Professional advisers, competent authorities or parties to a legal claim may receive information where disclosure is necessary and lawful.

Identity checks use Magic Auth's own capture and review pipeline. Use of infrastructure providers does not give them permission to train their own models on identity evidence.

8. Location and international processing

The primary application hosting region is Google Cloud London. Cloudflare operates a global delivery network, and payment and support providers may process information in other countries. Hosting in London does not mean every provider operation takes place in the United Kingdom.

International transfers require an applicable legal transfer mechanism and assessment. Contact us for the locations and safeguards that apply to your service and a copy of relevant safeguards. Service-specific transfer arrangements must be confirmed before new identity processing begins.

9. Security and decisions

We use HTTPS, access permissions and authentication controls to protect the service. Verification evidence and personal account access have different authorisation rules. Staff access must be limited to an assigned role and purpose.

Vault encryption depends on the supported client and a key controlled by you. Identity recovery cannot recover a lost Vault key. Keep recovery material secure and separate from the encrypted content.

A website demonstration is not an identity decision. Automated identity approval is not publicly available. A company remains responsible for its decision to provide a product or service; you can ask it about that decision and contact us to challenge inaccurate Magic Auth information.

10. Your rights and complaints

Depending on the processing and applicable law, you may request access, correction, erasure, restriction or portability of your information. You may withdraw consent at any time. We may need proportionate information to confirm that the request is yours.

Right to object: you may object to processing based on legitimate interests, including our security or transaction-record purposes, for reasons relating to your situation. You may object to direct marketing at any time.

Send privacy requests to admin@tsrobotic.com. Say which account or service is involved and what you want us to do. You can contact us about your Magic Auth profile even if a company initiated your check. For a company's own use of your information, contact that company as well.

You may complain to the Information Commissioner's Office in the United Kingdom or your relevant supervisory authority. You do not have to complete our complaints process before contacting the regulator.

Changes to processing will be reflected in this notice. Where a new purpose needs consent or additional information, an updated website page alone does not provide that consent.