Last updated 12 October 2026

Privacy, clearly.

This website introduces IDWelly, a service in development by WellyVentures Ltd. It does not perform identity checks or accept identity documents.

Your enquiries

WellyVentures Ltd is responsible for your information. When you contact us, we collect your name, email address, company if supplied, selected topic and message. We use this information to consider and respond to your enquiry. The lawful basis is our legitimate interest in responding to business enquiries, or taking steps at your request before a contract where that applies.

Where information goes

Enquiries are stored privately on our Hetzner server and are accessible to authorised people working for WellyVentures Ltd. They are not published, sold or automatically submitted to identity verification providers. Sending the form does not subscribe you to marketing.

Your workspace account

If an administrator invites you, we receive your email address, assigned role and organisation from them. When you activate your account, we store your name and a password hash, not your password. We also keep workspace settings, support conversations, invitations and a record of account activity, changes and authorised exports.

We use these records to provide and secure your requested workspace, manage access and respond to support requests. Our basis is our legitimate interest in operating a secure business workspace, or performing a contract with you where applicable. Account details are needed to provide access. Your organisation's administrators can manage its members; authorised IDWelly administrators can support and administer the platform. Other customer organisations cannot access your workspace records.

Checks currently use generated synthetic profiles. They do not assess real people or make decisions with legal effects. Do not submit identity evidence or sensitive personal information in support messages, notes or other free text fields. No verification provider receives workspace data.

Account and workspace email

When email sending is enabled, we use Resend to send account invitations, password recovery links and password change confirmations. We share the recipient address and the message needed for delivery. Security messages do not depend on optional notification preferences.

Organisation administrators can enable brief review and support notices for active members of their workspace. New enquiry notices go only to an activated owner. These notices link to the private workspace; they do not include enquiry contents, private notes or support message bodies. Turning on email does not send earlier activity or subscribe anyone to marketing. Open and click tracking are disabled for these emails.

Queued email contents are encrypted on our server and removed when no longer needed for sending. We retain limited delivery status and provider references for operational review. A provider accepting a message does not establish that it arrived in your inbox. Resend processes email data under its privacy policy.

Website security

Our hosting server processes connection information to deliver and protect the website. The enquiry service uses a keyed hash of your IP address to limit repeated submissions, rather than storing your raw address in its enquiry database. We do this under our legitimate interest in keeping the service secure.

Older rate limit records are removed during subsequent API requests. Website access logs omit raw IP addresses, enquiry contents and query strings. Error logs may contain connection information when a request fails; log rotation limits the number of retained log files.

Cookies and external services

Signing in uses necessary security cookies. A login protection cookie expires after 30 minutes and a signed in session expires after 8 hours. These support account access and request protection, not advertising. Sessions can be revoked from your account settings.

This website does not set analytics or advertising cookies. Its fonts, images and scripts are hosted with the website. Animation preferences apply only while the page is open. Links to other websites are subject to those sites' privacy notices.

How long we keep information

We retain enquiries while needed to respond and follow up. Continued retention depends on whether the conversation is active, there is an ongoing business relationship, or information is needed to establish or defend a legal claim. Enquiries no longer needed for those purposes should be deleted following review. You can request deletion at any time.

Account and support records are retained while needed to provide the workspace, resolve active matters and maintain a proportionate security history. An administrator reviews records when access ends or a deletion request is received. Audit and invitation history may remain where needed to investigate misuse or establish or defend a legal claim. Expired sessions and older authentication rate limit records are pruned during later authentication activity. Invitation links expire after 72 hours. Password recovery links expire after 30 minutes and can be used once; a completed reset ends existing sessions. Private local recovery copies may retain earlier records pending the same retention review; they are not a public archive.

Your choices

You can ask to access, correct or delete your information, or restrict its use. Where applicable to information you provide under a contract, you may also request a portable copy.

Your right to object: you can object to our use of your information where we rely on legitimate interests.

Use the contact form and select Something else, noting that your request concerns privacy. We may need to confirm your identity proportionately before acting, but please do not send an identity document through this website.

You can also raise a concern with the UK Information Commissioner's Office.

The visual examples

Website photography is AI generated. The verification journey uses illustrative data. It does not access your camera, read a passport or make a verification decision about you.