Privacy notice

1. What Readily is

Readily is a free credential wallet for trade workers. You add your licenses and certifications, keep their expiry dates current, and share only what you choose with an employer or school.

2. What we collect and why

• Account details: email address for sign-in, your legal and display name, an optional phone number, and your time zone for reminder timing.
• Credential records: the licenses and certifications you add, including issuing authority, credential number, issue and expiry dates, and any document you upload. We store a hash of each file to detect changes, not to certify its authenticity.
• Photo-import (OCR) data, if you use it: a photo of a credential card sent to Readily's private scanning pipeline to extract text. The photo is processed on our private OCR worker and stored privately. We never store or log the extracted field values or the image itself in analytics; we only log that a scan attempt happened.
• Identity verification, if you choose it: our partner Didit verifies your identity. We store the verification outcome and the name from your document. The ID photo and selfie used for the check live with Didit under their own privacy terms.
• Sharing records: which employer or school you accepted a link with, and the summary status they can see.
• SMS opt-in, if you choose it: your phone number and opt-in status for text reminders. This channel is prepared but not yet live in production.
• Usage events: basic product events tied to your account, used to run and improve the product. We never sell your data.

3. The OCR photo flow and consent you give

When you photograph a credential through photo import, you must first confirm that you own the photos or have permission to upload them. We record that confirmation with the exact notice version you saw (version 2026-08-29) and a fingerprint of the notice text, so a future audit can prove what you accepted.

The results extracted by OCR stay self-reported until they are separately verified. They never become “Verified” on their own, and you review them before they are saved.

4. How long we keep data

The periods below describe what the product actually does today. Nothing is removed automatically without a separately approved and disclosed removal step.

• Original scan photos are kept for 7 days after upload, so you can review and save a credential. A retry of the same photo after that window is rejected.
• Uncommitted card crops and extracted field values are kept for 7 days. Once you save a credential, the saved crop becomes your credential document.
• OCR callback event records are kept for 90 days.
• Credential documents stay in your wallet while it is active. A 90-day maximum retention for card images is a provisional idea being researched, not an approved rule: it has no legal sign-off (provisional decision D-17). Any real removal schedule must be approved before it is applied, and this page will match whatever is approved.
• A legal hold pauses removal for a named record and reason.
• Backups must not bring an already-fulfilled removal back into use. Readily's safe-recovery drill proves this separately before any removal runs.

5. Your rights

• Access: you can see everything in your wallet, including whether each credential is self-reported or verified.
• Export: you can download a CSV of your active credential records at no cost. Worker Pro adds a formatted print-ready summary. An export is prepared only for your own signed-in session.
• Correction: today you correct a mistake by archiving the wrong entry and adding a corrected one. Archiving hides the entry from your active wallet; it does not erase the underlying record, which we keep for audit integrity.
• Withdrawing sharing: you can end a share with any employer or school at any time. This stops future sharing; it does not erase the historical record of what was shared while the link was active.
• Deletion: there is no self-serve button that secretly removes anything. Removing a credential archives it rather than erasing the underlying row. A full data-removal request is handled through a verified privacy request, runs as a non-destructive rehearsal first, and is only fulfilled after the required approvals exist. A provisional 90-day preference is not deletion authorization.

6. Children

Readily is not directed at anyone under 18.

7. Contact

To ask a question, request your data, or ask us to correct or remove something, email adam@adammiko.com. This is the operator contact for the draft period; the published version will confirm the final address.