Identity and Biometric Privacy Notice and Consent

Version 3.0. Effective October 29, 2026.

This notice is given by mjonesone, LLC, a California limited liability company doing business as ICONS ("ICONS", "we", "us", "our"). It is our written policy on identity and biometric data, including our retention schedule and destruction guidelines, and it is available to the public at iconsai.com/legal/identity-privacy-notice. Read it before you start identity verification. It supplements the Privacy Policy and controls if the two conflict on identity or biometric data. Capitalized terms not defined here have the meanings in the Terms of Service.

Before you can start the identity check, we ask for your written consent (Section 11). You do not have to give it. If you do not, we cannot verify you and you cannot become Bookable for paid work, but you can keep an Inquiry only profile.

What changed in version 3.0. Identity checks are now done by our identity-verification provider, Stripe Identity, a service of Stripe, Inc. ("Stripe"). Stripe uses automated document checks and face matching. If you consented to an earlier version, you will be asked to read this version and consent again before you start a new check.

1. Why we verify identity

ICONS lets Brands license a real person's Likeness and commission AI-generated content of them. Before any paid work, we must confirm that:

• you are a real person, captured live;
• you are at least 18 years old;
• you are the person shown in the profile and the person whose Likeness will be licensed, or, for a Virtual Persona, the adult rights owner; and
• no one else is using your face or name to sell your Likeness.

A signup checkbox, a matching email, a follower count or an imported avatar is not identity proof. Verification is the only way a profile can become Bookable.

2. How verification works

When you start the check from your activation page, ICONS opens a verification session with Stripe Identity and sends you to Stripe's hosted page. There you:

1. take a photo of a government-issued photo ID (a driver's license, passport or national ID card); and
2. take a live selfie with your camera.

Stripe, not ICONS, captures and stores the ID image and the selfie. Stripe checks that the document is genuine and compares the face in your selfie with the photo on your ID. That comparison uses facial geometry, which is biometric data under the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), Washington's biometric identifier law (RCW 19.375), the California Consumer Privacy Act and similar laws. Stripe does this for ICONS, as our service provider for identity verification. In this notice, "Identity Evidence" means your ID image, your selfie and the biometric data Stripe derives from them.

Stripe then tells ICONS the result. If Stripe verifies you, ICONS reads your verified legal name and date of birth from Stripe and approves the check only if you are 18 or older. ICONS does not receive or store your ID image, your selfie or any facial template. If a person at ICONS needs to confirm your age, they do it in Stripe's dashboard for that session.

Stripe also handles your information under its own Privacy Policy.

Before version 3.0. Until October 29, 2026, ICONS did the check itself: you recorded a short challenge video and added a photo of your ID, and a person on the ICONS identity team compared them, with no outside provider and no automated face matching. Files collected that way are stored by ICONS and destroyed on the schedule in Section 6.

3. What is captured, and by whom

4. How it is used

The information in Section 3 is used only to:

1. confirm that your ID is genuine and that you are the person in it;
2. confirm you are 18 or older;
3. confirm that you are the person whose profile and Likeness are offered, and detect duplicate or impersonating accounts;
4. keep a record that verification happened; and
5. prevent fraud and enforce the Acceptable Use and AI Content Policy.

We do not use Identity Evidence, your legal name or your date of birth to create content, as a reference for Production, to train any AI model, to build a likeness or voice model, for marketing or advertising, for emotion or personality analysis, or to infer anything other than identity and age.

5. Who can see it

• Stripe. Stripe captures and processes Identity Evidence to verify you, as our service provider.
• ICONS identity staff. Only ICONS staff with the identity reviewer or administrator role can see your legal name, date of birth and verification result, and, where an age check is needed, the session in Stripe's dashboard.
• Nobody else on the Service. Brands, Agencies (including their finance users), production vendors and other Users never see your Identity Evidence, legal name or date of birth. They see only a "Verified" status.
• Legal disclosure. We disclose verification records only with your consent, to complete a transaction you ask for, or when required by law, subpoena or court order.

We do not sell, lease, trade or otherwise profit from Identity Evidence or any biometric data.

6. Retention and destruction schedule

An automated job runs every hour, asks Stripe to redact each session that falls due, and records the date Stripe confirmed it. A request that fails is retried on the next run. Redaction removes the images and verified details from the session at Stripe. Stripe may keep some information where the law requires it, as described in its Privacy Policy. In every case, ICONS requests destruction of Identity Evidence no later than the earlier of (a) when the purpose of collecting it has been satisfied, and (b) 3 years after your last interaction with ICONS, or sooner if the law requires.

We delay redaction only under a legal hold required by a subpoena, court order or active investigation. A hold is recorded with its reason, covers only what it requires, and ends when the obligation ends; redaction then happens on the next run. If you need to verify again, you start a new session under a current consent.

7. Security

Your verification happens on Stripe's hosted page, over an encrypted connection. ICONS stores only the session reference, the result, and your legal name and date of birth, in a restricted record that Brands, Agencies and other Users cannot reach. We protect this data using a reasonable standard of care within our industry, and at least as carefully as our other most sensitive information.

8. Your rights

You may ask what identity information we hold about you, ask for correction, or ask for deletion by emailing privacy@iconsai.com. You may withdraw this consent at any time by email; we then stop any further collection and ask Stripe to redact your verification sessions promptly, and in any case within 30 days, unless a legal hold applies. Withdrawal does not undo a verification already completed, but your profile can no longer be Bookable for new paid work. Residents of California and other states, and people in the EEA and UK, have the additional rights described in the Privacy Policy.

9. Virtual Personas

If your profile is a Virtual Persona, you verify yourself as the adult rights owner. You must not submit someone else's face or ID. Verifying you does not verify the persona as a real person, and the persona must always be labeled as virtual.

10. Failed verification and Sandbox Mode

If Stripe can't verify you, or you are under 18, you see that the check failed. You can start a new session from your activation page, or ask for another review by emailing hello@iconsai.com. Until you pass, your profile cannot be Bookable, and no payment, Production or Likeness rights can start.

While the Service runs in Sandbox Mode, verification uses the in-house review described in Section 2 and results are labeled sandbox. This notice, the retention schedule and your consent apply in full to anything you submit, sandbox or not.

11. Written consent and release

By typing your full name and checking the consent box, you confirm that you have read this notice and you give your written consent, as a written release under the Illinois Biometric Information Privacy Act and consent under the Texas and Washington biometric laws and similar laws, for:

(a) Stripe, as ICONS's service provider, to collect, capture, store and use your ID image and selfie, and to create and compare biometric data from them, to verify your identity and age for ICONS;

(b) ICONS to receive and keep your verification result, legal name and date of birth from Stripe for the purposes in Section 4, and to disclose them only as described in Section 5; and

(c) retention, redaction and destruction according to the schedule in Section 6.

You confirm that you are at least 18 years old, that the face and ID you submit are your own, and that you are giving this consent voluntarily. You understand that you may decline, that declining only prevents identity verification and paid work, and that you may withdraw consent at any time by emailing privacy@iconsai.com.

This consent covers identity verification only. It does not license your Likeness for any campaign. Use of your Likeness in any Booking requires a separate AI Likeness and Digital Replica Rider that you personally sign for that Booking.

12. Contact

mjonesone, LLC (ICONS), Los Angeles, California. Privacy: privacy@iconsai.com. Legal: legal@iconsai.com. Support: hello@iconsai.com.