Privacy Policy

This policy applies to No Eye Beans websites, account services, and related communications. StoneToned, Inc. is responsible for information it collects directly. When an organization uses No Eye Beans for its users, that organization may control the purpose of customer-data processing and StoneToned may act as its processor or service provider under separate terms.

Depending on available features, we may process account identifiers, verified contact status, authenticator and recovery metadata, organization memberships, sessions and device or security signals, application and token metadata, permissions, entitlements, evidence results and provenance, authorization decisions, and audit receipts. We do not need plaintext passwords. Raw identity documents or biometrics will be processed only through a reviewed flow, for a disclosed purpose, with provider and retention controls.

We may receive information you provide, information generated when you use the service, limited technical and security data such as IP address, browser, device, time, requested path and delivery logs, information from an organization that manages your access, and results from providers you choose or are asked to use. The collection screen and service-specific notice should identify any sensitive evidence before it is submitted.

We use information to deliver and secure the site, prevent abuse, respond to requests, maintain necessary audit records, comply with law, and protect people and systems. The legal basis may be steps taken at your request, legitimate interests, consent, or a legal obligation, depending on the interaction and location.

No Eye Beans may help an application evaluate evidence, entitlements, context, and policy for an access decision. The relevant application or customer normally defines the purpose and rule. Where a decision meaningfully affects you, available experiences should explain the result at an appropriate level and provide a route to correct evidence, request review, or appeal. We do not sell identity or proof data or use it for cross-context behavioral advertising.

The static public site does not currently enable advertising cookies, behavioral profiling, or optional analytics. Hosting and security providers may process limited request logs needed for reliable and secure delivery. We will update this policy and provide required choices before introducing optional tracking.

We may use providers to host, secure, operate, and support the site. They may process information only for our instructions and services. We do not sell personal information. Information may be processed in the United States or other countries with appropriate safeguards where required.

We retain information only as long as reasonably necessary for delivery, security, legal, accounting, and dispute-resolution needs, then delete or de-identify it where appropriate. We use reasonable administrative, technical, and organizational safeguards, but no internet service is completely secure.

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, request portability, withdraw consent, and complain to a data protection authority. We may request reasonable verification before acting on a request.

No Eye Beans is not intended to collect children’s identity evidence without an approved age-appropriate service, notice, lawful basis, and any required parent or guardian process. Applications using an age-threshold claim should request the minimum result, such as whether a threshold is met, rather than a full birth date where possible.

We may update this policy as No Eye Beans changes. We will publish the new effective date and provide additional notice when a material change requires it. Product collection screens or service-specific notices may give more detail for a particular feature and should be read with this policy.

Send privacy questions and rights requests to nosa@stonetoned.com. Do not email identity documents, passwords, recovery codes, or other sensitive credentials.