Where it runs
Runs in the EU
The age check, including estimation and liveness, runs on infrastructure in the European Union, under EU data protection law.
Trust Center
Hosted age checks with EU-resident processing. Selfie images are not written to our storage.
Terms and policies
The documents below govern the AgeRail hosted age-verification service, operated by Lalalu Marketing SL. Each one is published in full and versioned on its own page.
Terms of ServiceThe contract governing use of the Service, including prepaid credit and lawful-use terms.Privacy PolicyHow we process personal data about tenant users, people who complete a verification, and business contacts.Cookie PolicyThe cookies this site may write, how long they last, who receives them, and how to change a stored answer.Data Processing AgreementThe GDPR Article 28 terms for end-user verification data, incorporated into the Terms of Service.Service providers and sub-processorsThe vendor list incorporated into the DPA, with role, data category, region, and transfer mechanism for each.ImprintService-provider identification required under Spanish Act 34/2002 (LSSI-CE).
Privacy by design
What happens to the selfie?
The face image is not written to AgeRail's storage. Images may be kept in memory for up to 24 hours for quality assurance, and may leave sooner when capacity is reached or the service restarts. Authorised AgeRail staff can view them during that time. Our vision-model provider may keep a flagged request for up to 90 days for abuse monitoring. We do not store face embeddings, face hashes, or identifiers that could link one session to another. The Privacy Policy has the details.
After the check
No biometric profile
No face image, embedding, face hash, or cross-session biometric identifier is written to the database.
For the user
No accounts
Users take one selfie. The selfie check does not ask for a name, an email address or an account.
Result
Cryptographically signed result
You receive a signed, timestamp-bound webhook that your server can verify on its own.
Security
We apply technical and organisational measures appropriate to the risk, including access controls on the principle of least privilege; encryption in transit; enforced location controls that stop verification services running outside their approved region; controls that prevent face images, any reusable biometric template or other representation derived from them, and the model's full age-estimate distribution from being written to persistent storage (our records have no field for them); and restricted operator-only access to calibration records.
We may change these measures over time, provided the overall level of protection is not lowered.
Your rights
Depending on your role and applicable law, you may have rights of access, rectification, erasure, restriction, portability, and objection (including under GDPR Art. 21 for processing based on legitimate interests).
To exercise these rights, contact privacy@agerail.com.
End users who verified through a tenant's product should also contact that tenant for requests about the tenant's own processing of their data outside AgeRail.
You may lodge a complaint with a supervisory authority. In Spain the lead authority is the Agencia Española de Protección de Datos (AEPD).
Read the Privacy PolicyContact
Data-protection enquiries and data-subject rights: privacy@agerail.com.
Lalalu Marketing SLTravessera de Gràcia 73, 4-2
08006 Barcelona, Spain