1. Summary
Ayonix Attendance Verify verifies the identity of people attending training delivered over Zoom, so that an organisation can evidence who actually attended. Doing that requires processing biometric data — a mathematical representation of a face. We treat that as the most sensitive category of data we hold, and this policy says plainly what we do with it.
We do not record meetings. We do not store meeting video or audio. Video frames are analysed and discarded.
To recognise a face, a cropped image of the face is sent to our face-recognition engine, which turns it into a face template. The image is held in memory only for that computation and is then discarded — it is never written to disk or stored (see section 4).
Roles
The organisation that runs the training (our customer) is the data controller. Ayonix is the data processor, acting on that customer's instructions. If you are a trainee and want your data removed, contact the organisation running your course; if you cannot reach them, contact us and we will route your request.
2. What we process, and why
| Data | Purpose | Retention |
|---|---|---|
| Face template — a numeric vector derived from an enrolment photograph. Not an image, and the original photograph is not kept. | Verify that the person attending is the person enrolled. | Until the trainee record is deleted, or on request. |
| Enrolment thumbnail — a small cropped face image kept with a registration, so an administrator can see who is enrolled. | Let an administrator confirm a template is attached to the right person. | Disabled by default. When enabled, kept for the life of the registration and deleted with it. |
| Trainee record — name, trainee ID, department, email. | Identify who a course result belongs to. | Controlled by the customer. |
| Monitoring events — timestamped observations such as "face not visible", "camera off", "identity not confirmed". | Attendance evidence and host alerting. | Configurable; 90 days by default. |
| Analysis samples — per-sample results of face analysis. | Produce the attendance report. | Configurable; 14 days by default. |
| Evidence snapshots — a still image captured when a rule triggers. | Let a human check an automated detection before acting on it. | Disabled by default. 7 days when enabled. |
| Zoom meeting and participant data — meeting ID, topic, schedule, display name, email, join/leave times. | Link a Zoom meeting to a training session and match attendees to trainees. | Controlled by the customer. |
| Zoom OAuth tokens. | Call the Zoom API on the customer's behalf. | Deleted immediately on disconnect or uninstall. |
| Administrator accounts — name, email, password hash. | Authenticate staff using the console. | Until the account is removed. |
| Audit log — who did what, and when. | Accountability. Deliberately excludes face templates, image keys and tokens. | Controlled by the customer. |
| Facial-expression labels (optional) — an advisory label such as "smile" or "surprised" computed from a participant's face on the organizer's screen. | A real-time hint for the organizer only. Never used for alerts, reports or any decision. | Disabled by default; only an administrator can enable it. Computed in the organizer's browser and never stored or sent to our servers. |
| Read-aloud text (optional) — a short sentence with a participant's name and the warning, e.g. "Sato: away from the camera". | Speak new warnings aloud on the organizer's console (AI voice). | Disabled by default. Sent to OpenAI to generate the audio (see section 6); not stored by us. The generated audio may be cached at the edge for up to one day. |
| Organization backups — an encrypted copy of the organization's data above (including encrypted face templates; excluding sign-in sessions, evidence images and generated exports). | Let an administrator restore the organization's data, and protect against mistakes before a restore or reset. | Automatic backups are kept in the number the administrator chooses; manual ones until deleted. Encrypted (AES-256-GCM) and stored in Cloudflare R2. |
Meeting video and audio are never recorded or stored. Frames are analysed in memory and discarded. Ayonix Attendance Verify does not access Zoom chat, files or cloud recordings.
3. Legal basis and consent
Face data is biometric personal information. Under Japan's Act on the Protection of Personal Information it is 個人識別符号 (a personal identification code); under the GDPR it is a special category of data under Article 9.
- Enrolment requires the trainee's explicit, recorded consent, captured in the product with the version of the consent text the person actually saw.
- Consent is revocable. Withdrawing it stops further processing and triggers deletion of the template and of any stored enrolment thumbnail.
- Customers are responsible for notifying participants that identity verification is in use before a session begins.
4. How the data is protected
- Face templates, OAuth tokens, evidence images and enrolment thumbnails are encrypted at rest with AES-256-GCM.
- Templates are never sent to a browser. Comparison happens server-side, so a tampered client cannot assert a match.
- Face images sent for recognition are not stored. At enrolment, at a trainee's identity check and during live monitoring, the browser sends a cropped face image so the face-recognition engine can compute a template. The engine runs on Cloudflare's network (Cloudflare Containers) with no internet access, holds the image in memory only while computing, and deletes it immediately afterwards. Enrolled templates are never sent to the engine; it returns a template and keeps nothing.
- Evidence images are reachable only through HMAC-signed links that expire after 60 seconds, and every access is written to the audit log.
- All traffic uses TLS 1.2 or higher; TLS 1.0 and 1.1 are refused.
- Each customer is a separate tenant. Every record carries an organisation identifier and every query is filtered by it.
- Access is role-based. Viewing an evidence image and exporting evidence in bulk are deliberately separate permissions.
- Enrolment thumbnails are off by default, and with them off no face image is stored anywhere in the product. When an organisation turns them on, viewing one requires the same permission as viewing an evidence image, every retrieval is written to the audit log, and deleting a registration deletes the stored image itself rather than merely hiding it.
Further detail, including known limitations, is in our Security Policy.
5. Automated decisions
Ayonix Attendance Verify does not make automated decisions with legal or similarly significant effect. Detections are signals for a human to review. The product will not mark a trainee as having failed a course on its own, and it reports only observable facts — whether a face is visible, whether the camera is on, whether an identity was confirmed. It does not infer attention, comprehension or any other mental state.
Optional facial-expression labels. One feature, disabled by default and switchable only by a customer administrator, shows advisory facial-expression labels (angry, smile, laugh, sad, complicated, surprised) on the organizer's console. They are an automatic estimate of a visible facial expression — not a measurement of what anyone feels — computed in the organizer's browser, shown in real time only, and never stored, alerted on, included in reports, or used for any decision about a person. Some jurisdictions restrict or prohibit emotion recognition, for example the EU AI Act in workplaces and education; the customer is responsible for checking that enabling it is lawful where it operates and for informing participants before doing so.
6. Sharing and sub-processors
We do not sell personal data and do not use it for advertising or for training machine-learning models.
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Application hosting, database (D1), object storage (R2), CDN and WAF. | Asia-Pacific region |
| Cloudflare, Inc. | Face-recognition engine (Cloudflare Containers): computes face templates from cropped face images, in memory. Nothing is stored there. | Cloudflare's network |
| Zoom Communications, Inc. | Only where the customer has connected Zoom: meeting and participant metadata is read from Zoom. No personal data from Ayonix Attendance Verify is written back to Zoom. | Per the customer's Zoom agreement |
| OpenAI, L.L.C. | Only where the customer enables AI voice: the sentence to be read aloud (a participant's name and the warning) is sent to generate speech. Not used by OpenAI to train models; OpenAI may retain API data for up to 30 days for abuse monitoring. | United States |
We disclose data to a public authority only where legally compelled, and will notify the customer unless prohibited from doing so.
7. Where data is stored
Data is stored in Cloudflare's Asia-Pacific region (D1 and R2). Face images sent for recognition are processed in memory by the face-recognition engine on Cloudflare's network and are not stored anywhere. Customers with a strict domestic-residency requirement should confirm this with us before deployment.
8. Your rights
Depending on where you live you may have rights of access, correction, deletion, restriction, objection and portability. Because Ayonix acts as a processor, please direct requests to the organisation running your training. If that is not possible, email privacy@ayonix.com and we will help.
We respond to rights requests within 30 days. Verifying who is making the request may take longer where the request concerns biometric data.
9. Deletion
- Withdrawing consent deletes the face template.
- Deleting a trainee deletes their template, events and evidence.
- Disconnecting Zoom deletes the stored Zoom tokens immediately.
- Data past its retention window is deleted automatically by a scheduled job, and the deletion is itself recorded in the audit log.
- To delete an entire account, email support@ayonix.com from the administrator's address. We confirm deletion in writing.
10. Cookies
Ayonix Attendance Verify sets one strictly necessary cookie, zoomer_session, which keeps an
administrator signed in. It is HttpOnly, Secure and SameSite=Lax,
and expires after 12 hours. We use no advertising or cross-site tracking cookies.
11. Changes and contact
Material changes will be notified to customer administrators before they take effect. The version and effective date at the top of this page always reflect the current text.
- Privacy: privacy@ayonix.com
- Support: support@ayonix.com
- Security reports: security@ayonix.com
日本語要約
Ayonix Attendance Verify は、Zoomで実施する研修の受講者本人確認を行うため、顔特徴量（個人識別符号） を取り扱います。会議の録画は行わず、映像・音声は保存しません。解析後のフレームは破棄されます。
- 顔の原画像は保存せず、暗号化した特徴量のみを保存します（AES-256-GCM）。
- 顔の照合のため、顔部分の切り抜き画像を顔認識エンジンへ送信します（顔登録時・本人確認時・ライブ監視中）。エンジンはCloudflareのネットワーク上（Cloudflare Containers）でインターネットから隔離して動作し、画像は特徴量の計算中のみメモリ上に保持され、計算後ただちに破棄されます。ディスクへの書き込みや保存は一切行いません。
- 顔写真サムネイルの保存は既定で無効です。既定の設定では、顔の画像はいかなる形でも保存されません。組織の管理者が有効化した場合に限り、顔登録時の小さな顔画像（サムネイル）を暗号化して保存し（AES-256-GCM）、受講者一覧での本人確認に使用します。閲覧には
evidence:view権限が必要で、閲覧はすべて監査ログに記録されます。顔登録を削除すると、サムネイルの実データも同時に削除されます。 - 特徴量をブラウザへ送信することはありません。照合はサーバー側で実行します。
- 証跡画像の保存は既定で無効です。有効化した場合も、60秒で失効する署名URL経由でのみ閲覧でき、閲覧はすべて監査ログに記録されます。
- 顔情報の登録には本人の明示的な同意が必要で、同意はいつでも撤回できます。撤回により特徴量およびサムネイルは削除されます。
- 自動判定のみで受講可否を決定することはありません。理解度・集中度などの心理状態は判定しません。
- 表情ラベル（任意・既定で無効・管理者のみ有効化可）：主催者の画面に、表情の自動推定（怒り・笑顔・笑い・悲しみ・複雑・驚き）を参考表示する機能があります。本人の感情を測るものではなく、主催者のブラウザ内で計算してその場で表示するだけで、保存・送信・警告・レポート・判定には一切使いません。EUのAI法など、職場や教育の場での感情認識を制限・禁止する法令があるため、有効化する組織は所在地の法令を確認し、受講者に事前に知らせる責任を負います。
- AI音声（任意・既定で無効）：有効化した場合、読み上げ文（参加者名と警告の種類）を音声生成のため OpenAI（米国）に送信します。当社では保存しません。OpenAI はAPIデータを学習に使用せず、不正利用監視のため最大30日保持することがあります。
- 組織バックアップ：管理者が作成・設定したバックアップは、暗号化（AES-256-GCM）してCloudflare R2に保存します（暗号化済みの顔特徴量を含み、ログインセッション・証跡画像・生成済みCSVは含みません）。
- 通信はすべて TLS 1.2 以上です。データはCloudflareのAPACリージョンに保存されます。
受講者ご本人からの削除・開示のご請求は、まず研修を実施する組織へご連絡ください。 難しい場合は privacy@ayonix.com までご連絡ください。