Home section

Our Privacy Policy

Whetstone Studio® Privacy Policy for the Processing of Biometric and Other Data

Whetstone Studio®, LLC (“Whetstone Studio®”) has instituted the following policy related to any U.S. resident biometric data that is collected, processed and/or stored by Whetstone Studio® or Whetstone Studio®’s Customers or is subject to the requirements of any law expressly governing the collection, storage, use and/or disclosure of biometric data.

Not all Whetstone Studio® products and services utilize biometric technologies, and not all Whetstone Studio®’s biometric technology products and services involve Whetstone Studio® in the collection, storage or use of biometric data. In some cases, Whetstone Studio® may provide hosting services for certain biometric data collected by a customer of Whetstone Studio® (“Customer”) on such Customer’s behalf.

In the case of Whetstone Studio®’s InSERVio® product and all products built using InSERVio®’s architecture the biometric data is collected by a customer of Whetstone Studio® (“Customer”) and hosted using a 3rd party hosting provider.

In other cases, Whetstone Studio® products may be installed on the Customer’s computers and servers where Whetstone Studio® is not involved in the participation of the collection, storage or use of biometric data. The Customer decides if it purchases a product that utilizes biometric data, and whether such data is collected, stored or utilized by Customer or Whetstone Studio®.

Biometric Information

The biometric data covered by this policy includes “Biometric Identifiers” as defined by BIPA (including, a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry) and “Biometric Information” as defined by BIPA (i.e., any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s Biometric Identifier used to identify an individual).

At the direction and on behalf of its Customers, Whetstone Studio® may collect, store and/or use biometric data. Customers may utilize Whetstone Studio®’s products and services to collect, store and/or use biometric data for employment-related purposes, including but not limited to verifying and identifying employees for purposes of tracking of time and attendance, in accordance with this policy and applicable law.

When an individual enrolls with, or authenticates themselves to the Customer’s Device, the Device temporarily captures and stores an image of that individual’s biometric identifier, the individual’s face, (the “Identifier”) but only for the time needed to create the individual’s biometric template (the “Template”) used for subsequently recognizing that same individual.

Thereafter, only the Template is stored in a database owned by the Customer.

Customer’s Responsibilities

It is the sole responsibility of the Customer that collects, captures, stores, or otherwise uses Biometric Data relating to an individual, whether using Whetstone Studio®’s cloud hosted products and services or using Whetstone Studio®’s products installed locally on the customers’ computers and servers, to do each of the following:

1. Inform the individual (i.e. employee, supervisor, end-user) from whom Biometric Data will be collected, in writing and prior to collecting the individual’s Biometric Data, that Biometric Data is being collected, stored, and/or used.
2. Indicate the specific purpose(s) and length of time for which Biometric Data is being collected, stored, and/or used.
3. Receive a verbal consent and release from the individual (or a legally authorized representative) authorizing the Customer and Whetstone Studio® to collect, store, and/or use the Biometric Data and authorizing the Customer to disclose such Biometric Data to Whetstone Studio® and any Customer third-party service providers for use and storage pursuant to this Policy.
4. Develop, maintain, and inform all individuals about any Customer policies for Biometric Data collection. The Customer must maintain its own data collection, disclosure, retention, and storage policies in compliance with all applicable laws. Where required by law, Customer agrees to adopt a privacy policy in alignment with all applicable laws governing the collection, use, transfer and retention of Personal Data.
5. Ensure that Whetstone Studio® is immediately notified of use of, or discontinuation of use of, Whetstone Studio®’s products or services involved in the collection, storage or use of biometric data.

Disclosure and Sharing of Biometric Information

Whetstone Studio® will not sell, lease, trade or otherwise profit from any biometric data that it receives from Customer’s employees. Biometric data will not be used for any purpose other than as described herein.

Whetstone Studio® will not disclose, redisclose or otherwise disseminate any biometric data received from Customers to any person or entity other than Whetstone Studio® and Whetstone Studio®’s third-party service providers except for if disclosure or redisclosure is required by state or federal law or municipal ordinance or disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.

Retention of Biometric Information

Whetstone Studio® may retain biometric data for up to ninety-three (93) days after receiving notice from customers on the discontinuation of use of Whetstone Studio® products and services. Whetstone Studio® shall permanently destroy all copies of the employee’s Biometric Data in its possession after the time period has elapsed, unless Whetstone Studio® is required to hold Customer Personal Data pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.

Storage of Biometric Information

Whetstone Studio® will use a reasonable standard of care, consistent with the industry in which Whetstone Studio® operates, to store, transmit and protect from disclosure all biometric data, and shall store, transmit, and protect from disclosure all biometric data in a manner that is the same as or more protective than the manner in which Whetstone Studio® stores, transmits, and protects other confidential or sensitive data that can be used to uniquely identify an individual or an individual’s account.

Revision 2024.12