PRIVACY POLICY — IDCARD4U.COM
Version: 1.0
Effective date: August 24, 2026
Service provider: Xnova Solutions ("XNOVA")
Platform: idcard4u.com
1. PURPOSE OF THIS POLICY
This Policy explains how XNOVA collects, uses, stores, shares, retains, and deletes information related to the use of idcard4u.com.
idcard4u.com is a portal used by schools, colleges, companies, and businesses to provide the information and photographs needed to produce physical identification cards.
The Platform is not designed as a general academic, medical, employment, or human resources record system. Information about students, employees, or other individuals is received for the limited purpose of managing and producing the identifications requested by the Client and, when authorized, facilitating reprints or duplicates.
2. WHO PROVIDES THE INFORMATION
In most cases, XNOVA does not obtain information about students or employees directly.
The information is provided by an authorized Administrator of the school, college, company, or business that holds the account.
The Administrator may, depending on the available functions:
• create records;
• take or upload photographs;
• edit information;
• deactivate records;
• delete or replace photographs;
• submit IDs to production;
• request reprints; and
• manage orders and billing.
3. CATEGORIES OF INFORMATION WE MAY PROCESS
3.1 Information about the Client and its Administrators
We may process information such as:
• name of the institution, company, or business;
• contact name;
• login username;
• email address;
• information needed to manage the account;
• history of acceptance of terms and policies;
• IP address and date/time associated with security or acceptance processes;
• invoices;
• payments;
• balances, credits, and adjustments; and
• service-related communications.
3.2 Information about the people for whom IDs are produced
Depending on the fields configured for the Client, it may include:
• first name;
• last name;
• photograph;
• position;
• department;
• company;
• group;
• grade;
• section;
• level;
• school or internal identifier;
• ID number;
• email address;
• phone number;
• date of birth; and
• other fields the Client has legitimately enabled for identification purposes.
The Platform may contain information about MINORS, especially when the Client is an educational institution.
3.3 Order and production information
We may process:
• records included in an order;
• date submitted to production;
• production status;
• shipping status;
• reprint requests;
• batches or synchronizations with the production system; and
• technical references necessary to maintain the integrity of those processes.
3.4 Billing information
We may process:
• invoice number;
• date;
• quantities;
• prices;
• shipping cost;
• IVU (sales and use tax);
• payments;
• credits;
• adjustments;
• balance; and
• the minimum detail necessary to document the items included in an invoice or order.
Photographs are not needed as part of the billing history and are not retained for that purpose.
4. HOW WE USE THE INFORMATION
XNOVA uses the information solely for purposes related to providing, securing, and managing the service, including:
1) creating and managing accounts;
2) authenticating Administrators;
3) allowing the Client to prepare records;
4) generating ID previews;
5) producing the physical cards;
6) transferring the necessary information to XNOVA's printing system;
7) processing and monitoring orders;
8) allowing reprints when the information has been validly retained;
9) generating and maintaining invoices;
10) recording payments, credits, and adjustments;
11) managing balances;
12) sending transactional communications;
13) preventing fraud, abuse, or unauthorized access;
14) maintaining audit and security records;
15) complying with legal obligations; and
16) handling Client requests related to its data.
XNOVA will not use student or employee data provided for this service to create independent commercial profiles, for behavioral advertising, or for the sale of personal information.
5. PHOTOGRAPHS
Photographs are used to prepare, produce, and, where applicable, reprint identification cards.
Photographs stored by the Platform are not intended for public access. Access is limited to the Platform's authorized mechanisms and the technical processes necessary for production.
The Client's Administrator may, when the function is available, delete or replace a photograph.
Deleting a photograph from a record may prevent future reprints until the Client provides a new image.
The photograph is not kept as a necessary part of an invoice's history.
6. TRANSFER TO XNOVA'S PRINTING SYSTEM
To produce the cards, the necessary Production Data is transferred from the Platform to the printing system or application used by XNOVA.
This transfer is part of the service requested by the Client and does not constitute a sale of data.
XNOVA will limit the use of the transferred information to the preparation, production, control, and, where applicable, authorized reprinting of the identifications.
7. EDUCATIONAL INSTITUTIONS AND STUDENT DATA
When the Client is a school, college, or other educational institution, XNOVA processes student data in accordance with the Client's instructions and for the limited purpose of providing the identification service.
The institution is responsible for determining the legal basis and institutional authority under which it provides the information to XNOVA and for obtaining the applicable notices or authorizations.
Where the information is subject to FERPA and the institution relies on a permitted exception, including, where applicable, the exception for certain providers acting as "school officials", XNOVA will limit the use and maintenance of the information to the authorized purpose and will not redistribute it for unauthorized independent purposes.
XNOVA will reasonably cooperate with the institution to allow the review, correction, or deletion of information when required and legally appropriate.
8. MINORS AND COPPA
The idcard4u.com administrative portal is designed to be used by authorized staff of schools, colleges, companies, and businesses — not for minor students to create administrative accounts or upload their own data directly.
Where COPPA applies to a specific activity, XNOVA will comply with the obligations of an operator under that law and its regulations.
Where the law allows an educational institution to authorize certain processing on behalf of parents within the school context, XNOVA will use the information solely for the service authorized by the institution and not for other independent commercial purposes.
Nothing in this Policy is intended to transfer to a school COPPA obligations that legally correspond to XNOVA.
9. DATA RETENTION — SCHOOLS AND COLLEGES
XNOVA applies a specific retention rule to the Production Data of educational institutions.
9.1 After the order is completed and shipped
After the order has been produced and marked as shipped, the institution may:
• authorize the deletion of Production Data it no longer needs; or
• authorize its temporary retention to facilitate reprints or duplicates.
9.2 Optional retention for reprints
If the institution decides to retain the Production Data, XNOVA will keep it for reprint purposes during the authorized period.
Retention for reprints will never extend beyond May 31 of the applicable school year.
Example: for the 2026-2027 school year, the maximum retention date will be May 31, 2027.
The institution may request or execute the deletion of a photograph before that date.
9.3 Expiration
At the end of the applicable period, Production Data that is no longer needed will be deleted or anonymized in accordance with XNOVA's procedures.
Where backup copies exist, residual information may remain temporarily until the ordinary replacement or deletion cycle of those copies. That residual information will not be used for new reprints, except where legally required.
10. DATA RETENTION — COMPANIES AND BUSINESSES
Companies and businesses are not subject to the May 31 school date.
Their Production Data may be kept for as long as reasonably necessary to:
• maintain a current identification;
• allow the Administrator to manage the record; and
• facilitate reprints requested by the Client.
The Administrator may, depending on the available functions:
• edit the information;
• deactivate the record; and
• delete or replace the photograph.
Deactivating a record does not by itself amount to deleting all of its data.
When the Client requests deletion, or when the relationship ends and the Production Data is no longer needed, XNOVA will delete or anonymize it subject to legal obligations and the limited retention of transactional information.
11. DIFFERENCE BETWEEN DELETING PRODUCTION DATA AND KEEPING HISTORY
Deleting Production Data does not mean that XNOVA must destroy a legitimate invoice, order, payment, or historical record.
To maintain commercial and accounting integrity, XNOVA may retain the minimum Transactional Data necessary to:
• maintain invoice detail;
• maintain the invoice number and total;
• maintain the count of invoiced items;
• document which items were part of an order;
• document a production batch or synchronization;
• keep payments, credits, and adjustments;
• evidence a transaction;
• comply with accounting or tax requirements; and
• maintain audit and security records.
Data retained for this purpose is limited to what is reasonably necessary.
The photograph is not retained for accounting purposes or as part of the invoice history.
Once Production Data has been deleted, historical invoice or order data will not be used to automatically recreate a new ID.
12. INACTIVE RECORDS
An inactive record may remain in the account for as long as appropriate under the applicable retention policy.
Depending on the available functions, the Administrator may manage an inactive record, including deleting its photograph or reactivating it to edit its information.
"Inactive" means an operational status; it does not necessarily mean "deleted".
This distinction preserves the integrity of historical invoices and orders without requiring the indefinite retention of photographs or Production Data that is no longer needed.
13. WITH WHOM WE MAY SHARE INFORMATION
XNOVA does not sell the personal data provided to idcard4u.com.
Information may be accessed or shared, on a limited basis, with:
13.1 Authorized XNOVA staff
Staff who need the information to operate the Platform, serve the Client, produce IDs, resolve technical issues, invoice, or perform authorized functions.
13.2 Technology vendors
Vendors needed for functions such as hosting, infrastructure, email, security, or other technical services.
13.3 Internal automation systems
Certain events may be sent to automation systems used by XNOVA for internal processes, such as order notifications, billing, collections, or transactional communications.
13.4 Production systems
The necessary information may be transferred to the local application or system used by XNOVA to print the cards.
13.5 Payment providers
If a transaction uses an external payment provider, that provider may process the necessary information under its own terms and policies. XNOVA is not required to retain payment card data if processing is handled directly by an external provider.
13.6 Legal requirements
XNOVA may disclose information when reasonably necessary to comply with a law, court order, or valid request from a competent authority, or to protect the rights, security, or integrity of the service.
XNOVA does not authorize vendors to use student or employee data for behavioral advertising or to create independent commercial profiles from the information received for this service.
14. EMAILS AND TRANSACTIONAL COMMUNICATIONS
XNOVA may use the email address of the Client or its Administrators to send:
• verification codes;
• security notices;
• order notifications;
• production or shipping information;
• invoices;
• balance or collection notifications; and
• communications related to changes to terms or privacy.
These communications are part of the operation of the service.
15. SECURITY
XNOVA applies reasonable measures intended to protect the confidentiality, integrity, and availability of the information.
Measures implemented or forming part of the described service architecture include:
• authentication with username and password;
• password storage using bcrypt;
• controls against repeated access attempts;
• CSRF protection on forms;
• restricted access to photographs;
• authenticated session mechanisms or authorized tokens for synchronization processes; and
• electronic verification for document acceptance.
No system can guarantee absolute security.
If XNOVA detects an incident that triggers legal notification obligations, it will perform the assessment and notifications required by applicable law, including, where applicable, Puerto Rico's Citizen Information on Data Banks Security Act.
16. VERIFICATION AND RECORD OF ACCEPTANCE
When an Administrator accepts the Terms or acknowledges this Policy, XNOVA may record:
• the account or Client;
• the version accepted;
• date and time;
• IP address; and
• the result of the verification process via a code sent to the authorized email.
These records are kept to document the contractual relationship, security, and compliance.
If a new version requiring re-acceptance is published, XNOVA may require a new acceptance process before allowing the Administrator to continue using certain functions.
17. ACCESS, CORRECTION, DEACTIVATION, AND DELETION
The Client has administrative controls to manage part of the information directly.
Depending on the available functions, it may:
• review records;
• correct information;
• deactivate a person;
• delete or replace photographs; and
• request other deletion actions.
For student or employee information provided by an institution, XNOVA will normally follow the instructions of the Client that provided the information.
If a student, parent, employee, or other person contacts XNOVA directly regarding information provided by an institution, XNOVA may refer the request to that institution or coordinate with it before acting, unless the law requires a different direct response or action.
XNOVA will reasonably cooperate with the Client to fulfill valid access, correction, or deletion requests.
18. ACCOUNT CLOSURE OR DEACTIVATION
Deactivating a Client account does not necessarily mean immediately erasing all information.
Upon closing or deactivating an account:
• XNOVA will assess which Production Data should be deleted;
• photographs that are no longer needed may be deleted;
• Transactional Data may be kept where necessary to preserve invoices, payments, orders, audit records, or legal obligations; and
• Production Data will not be kept merely for convenience if there is no longer an authorized purpose for doing so.
19. COOKIES AND TECHNICAL DATA
idcard4u.com may use cookies or session technologies strictly necessary to:
• keep the session signed in;
• protect forms;
• authenticate users;
• remember necessary technical functions; and
• protect account security.
If XNOVA later incorporates tracking, analytics, or advertising technologies involving materially different uses, this Policy must be updated before using them where required by law.
20. NO SALE OR ADVERTISING BASED ON STUDENT DATA
XNOVA does not sell or rent photographs or personal data of students or employees provided to produce IDs.
XNOVA also does not use such data for:
• behavior-based targeted advertising;
• creation of commercial profiles unrelated to the service;
• third-party marketing lists; or
• independent commercialization of student information.
21. CHANGES TO THIS POLICY
XNOVA may modify this Policy to reflect legal, regulatory, technical, or functional changes.
Each version must be identified so that XNOVA can determine which Policy was in effect at any given time.
When a change is material or requires new acceptance or acknowledgment, the Platform may ask the Administrator to complete the corresponding electronic process again.
22. APPLICABLE LAWS AND FRAMEWORKS
Depending on the type of Client, the nature of the data, and the circumstances, the processing of information may be subject, among other rules, to:
• Puerto Rico legislation on the security of information banks;
• Puerto Rico legislation on electronic transactions;
• FERPA, when applicable to the institution and the information;
• COPPA, when applicable; and
• other applicable federal or local obligations.
The mention of a law in this Policy does not mean it necessarily applies to all Clients or all data processed.
23. CONTACT AND PRIVACY REQUESTS
For questions about this Policy, deletion requests, matters related to photographs, or inquiries about data processing, the Client may use the contact channels published on idcard4u.com.
When a request affects data provided by a school, college, company, or business, XNOVA may require validation through the authorized Administrator before modifying or deleting information.
