On this page

IO PATINA Account Privacy Notice

Effective date: October 15, 2026
Operator: IO Patina LLC, California, United States
Privacy contact: privacy@iopatina.com

1. Scope

This notice explains how IO Patina LLC handles personal information in IO PATINA Account, our shared identity and account-management service. It covers sign-in coordination, account profile and security, account-to-product connections, family and age-related account functions, parental verification and consent workflows, and requests about this information. Some features are available only for particular products or locations.

The notice does not replace the Website Privacy Notice for our company website or the separate privacy notices that apply to information collected within an IO PATINA product. A product's own notice describes the information that product collects, how it uses that information, and the disclosures it makes. If a product requests parental consent, its direct notice supplies the product-specific details relevant to that decision.

2. Information handled through Account

Depending on your use of the service and enabled features, this can include:

Identity and contact information: an account identifier, email address and verification status, name or display name, login-provider association and account profile details you provide.
Sign-in and security information: authentication events, session and device/browser-related technical information, security status, recovery events, authentication assurance signals, IP addresses and records needed to diagnose or prevent unauthorized access. Authentication itself may be processed by the IO PATINA authentication service or an identity provider you choose.
Product connections and account administration: connected-product identifiers, relevant access or entitlement status, account settings, requests and their results, and records of important account or permission changes.
Age and family information, when enabled: age or date-of-birth information you provide for eligibility assessment, jurisdiction and product-policy decisions, guardian-child relationship and invitation/confirmation status, and choices about any permitted family information sharing. Participating products generally receive the eligibility or permission result needed for their service rather than a full copy of underlying age evidence.
Parent verification and consent information, when requested: parent email and account identifiers, product and country, language, opaque verification request references, workflow state and times, the notice/version presented, consent choices, typed signature name where required, the verification service selected, the verification result, transaction references and limited integrity/audit records.
Support and privacy requests: the information you send us and the communications and records needed to respond.

We seek information necessary for the applicable account or consent function. The nature of a product's activity data is explained by that product's privacy notice, not by this general Account notice.

3. Why we process this information

We use Account information to register and maintain an account; authenticate and secure access; maintain sessions and account settings; connect the account to participating products; provide access or eligibility decisions; send relevant security and service communications; facilitate family relationships and parental verification where enabled; record the scope and history of consent choices; address privacy and support requests; investigate abuse; and meet applicable legal obligations.

An identity or parental-verification result is used for eligibility, consent and related safeguards, not as a blanket authorization to process information for unrelated purposes. We do not treat a completed adult check as a parent's consent to a product's data practices.

Account works with our authentication service and, where offered, external identity providers. The selected identity provider may send us account identity, contact or authentication-status information needed to sign you in. That provider's own privacy information also applies to its interactions with you.

We use security- and session-related browser mechanisms needed to maintain authentication, prevent cross-site request forgery and protect Account operations. Our hosting and security infrastructure also processes technical request records. Optional analytics, marketing cookies or tracking, if any, must be explained and presented with the controls required for their actual use before being introduced; this notice is not permission to add undisclosed tracking.

5. Parent verification and the role of Epic Kids Web Services

When a parent-verification route using Epic Kids Web Services (KWS) is available, Account sends the information needed to start and associate the request, such as the parent's email, the request's country and language and an opaque reference. KWS may send a verification email and present the available verification methods on its own page. Methods depend on the country and the provider configuration and may include identity or payment-card checks. A path labeled “Card” or “Identity” in Account identifies the KWS service route, not a guarantee of the exact method completed.

Account does not ask the parent to upload a government identity document, provide a payment-card number or SSN, or submit a facial scan directly into Account for this KWS check. Sensitive verification details are entered on the verification provider's own interface, where the provider's notice and processing practices apply. Account receives an authenticated verification outcome and transaction reference rather than the original identity document, card details, SSN or biometric image. Our adapter is designed to record selected result fields and integrity digests rather than retain the unfiltered original webhook payload.

The parent must separately review and decide whether to grant the specific product consent requested. Adult verification by itself is neither that consent nor approval to create a child's account. See Parent Verification and Consent.

6. Who may receive information

The service can use organizations that provide authentication or login integration, secure hosting and infrastructure, email/service-message delivery, abuse prevention, customer support and, when a parent check is used, Epic Kids Web Services. Participating IO PATINA products may receive the account-status, entitlement, eligibility and consent decisions they are authorized to receive. The information actually shared depends on the enabled function and the product's documented needs. We may also disclose information when necessary to comply with applicable law, respond to legitimate legal process, or protect accounts and users.

A verification provider may process information directly on its own pages. Its notices describe its separate processing, including retention of evidence supplied to that provider. We do not represent that a provider immediately deletes its source materials or that its procedures are identical in every country.

7. Children, parents and product-specific direct notices

IO PATINA Account supports age- and family-related safeguards for participating products where legally and operationally available. Eligibility depends on the relevant jurisdiction and the particular product's policies; there is no single Account age rule that substitutes for every jurisdiction or product.

Where a product needs verifiable parental consent, the parent is given a product-specific direct notice that describes the child's information involved, its uses and disclosures and the choices available. A parent can decline a request. Depending on the product and applicable law, a parent may request information about the child's records, ask for deletion, or revoke consent to further collection or use. We coordinate such requests with the relevant product and distinguish Account records from product-held records. Contact our Privacy Center for assistance.

8. Retention and deletion

We retain personal information only for legitimate purposes related to account operation, authentication, security, fulfillment and documentation of the requested parental decision, resolving disputes and complying with applicable obligations. The retention period or criterion depends on the record category and whether the relevant account, verification request, product relationship, incident or legal obligation remains active.

Pending verification requests close or expire under the configured workflow. Expiration of an uncompleted request is not the same as deletion of every consent, transaction or audit record. Parent-consent evidence and security records may require a different retention decision from the pending request. The retention schedule and deletion process for parental-consent evidence, typed signature names and verification-result records have not yet been finalized. Account currently has no scheduled deletion process for those evidence records. Request expiration can remove a parent's contact email without removing the associated notice, consent, transaction or audit evidence. Account closure or withdrawal of consent does not necessarily mean that every legally required evidence record is erased immediately.

For questions about the applicable retention of a specific category of your Account information, contact privacy@iopatina.com. Product-held information is subject to that product's applicable notice and retention practices.

9. Security and international handling

We use safeguards appropriate to the information involved, including authentication, access restrictions, workflow controls and integrity checks. No online service can guarantee absolute security. Account information may be handled in the United States and in locations used by service providers where the applicable rules and safeguards permit it. The places and parties involved depend on the particular service interaction. Contact us for more information about handling relevant to your request.

Where particular data-protection laws apply, the legal bases for processing depend on the purpose and can include providing a requested account service or contract, complying with legal obligations, our legitimate interest in safe service operation, or a specific consent where required. Consent for one product or purpose is not consent for unrelated purposes.

10. Your privacy choices and requests

You may request access to or a copy of personal information associated with your Account, correction of inaccurate information, or deletion of information where applicable. Depending on the law and context, you may also have rights to portability, restriction, objection or withdrawal of consent. Parents can ask about a child's information and consent for a connected product, subject to verification of their authority.

Send requests to privacy@iopatina.com or use any applicable Account controls made available to you. You do not need to open a new Account merely to make a privacy request. For a sensitive request, we may ask for proportionate identity or guardian-authority verification. We will explain when information cannot be removed immediately because of a legal or security reason. See the Privacy Center.

11. Changes and contact

We will update this notice when our relevant practices change and identify the update date. We will communicate material changes and request fresh consent where required. Replacing the wording on this page does not itself change a prior parental choice or authorize new uses of personal information.

IO Patina LLC
California, United States
Privacy and data-rights enquiries: privacy@iopatina.com
Account/product help: support@iopatina.com
Legal questions: legal@iopatina.com
Contact page