Clearme

The Terms assert CLEAR owns all rights to the Services and Memberships and grant users no license, but do not clearly address ownership of the identity/biometric data users submit. The privacy documents describe collection and use of personal information without a clear ownership statement. Users retain privacy rights but ownership of submitted data is not spelled out.

This is an identity verification service rather than a content-generation tool, so 'output' primarily means verification results and credentials. The Terms state CLEAR owns the Services and any derivative works and grant no license to users. There is no explicit provision assigning generated outputs to users.

The Member Terms permit CLEAR to use biometric data to 'operate, improve, and administer' its Services, which could encompass model improvement, though 'train' is not used explicitly. The Canadian privacy policy references using data to 'develop new products and services' and generate insights, but neither document explicitly addresses AI/ML model training on user biometric data. The core membership privacy policy is unavailable.

The Member Terms provide an unusually clear biometric retention schedule with specific jurisdiction-based timelines (e.g. Illinois 3 years, Colorado/Texas/Europe/India 2 years) and a deletion-on-request mechanism via email. The Canadian privacy policy uses a more general 'as long as necessary' standard. CLEAR does reserve the right to retain personal data after termination subject to privacy rights, which is a modest caveat.

The Canadian privacy policy states CLEAR never sells or rents personal information and shares with service providers under confidentiality obligations, which is appropriate for the service. However, the same policy discloses participation in third-party advertising networks and interest-based advertising, and the Terms allow engaging contractors and partners. The core membership privacy policy governing biometric sharing was inaccessible.

The documents provide multiple opt-out mechanisms: users can unsubscribe from marketing emails, opt out of SMS with 'STOP', withdraw consent for advertising/third-party sharing, and request biometric data deletion at any time. GDPR and CCPA users are granted access, deletion, and objection rights. These are meaningful, clearly documented choices.

The documents reference compliance with the CCPA and GDPR/UK GDPR (including appointment of an Article 27 representative, VeraSafe, and a Data Protection Officer), and reference jurisdiction-specific biometric laws (implicitly Illinois BIPA via retention). No SOC 2, ISO 27001, ISO 42001, or NIST certifications are named, and there are no third-party audit attestations. Because this is a consumer service, COPPA is relevant and is partially addressed (does not knowingly collect from children under 13).

Neither document addresses model explainability, algorithmic transparency, accuracy of biometric matching, or enterprise auditing rights. For a service that makes automated identity-matching determinations, this silence is a significant gap. No audit or transparency commitments are disclosed.

The Canadian privacy policy describes administrative, technical and physical safeguards including encryption, firewalls, intrusion detection, access controls, and personnel security, plus a commitment to breach notification as required by law. However, no penetration testing, bug bounty, SOC 2, or trust center is referenced, and these controls appear in the Canadian-services policy rather than the core membership policy. No breach history is disclosed.

The Terms distinguish free, paid, family, and corporate membership tiers, and marketing references a 'CLEAR1' business identity product, but no enterprise agreement, DPA, or MSA was accessible. The documents do not describe any material difference in data handling between free and paid tiers — the same biometric collection and retention terms appear to apply. Enterprise-specific terms could not be assessed.

The documents do not explicitly state whether staff may review biometric data or inputs, though the Terms authorize engaging contractors and service providers to perform obligations, and the privacy policy grants service providers access under confidentiality duties. There is no explicit human-review disclosure for identity data. The core membership privacy policy was inaccessible.

The privacy policy explicitly discloses that data may be disclosed in response to law, legal process, court orders, subpoenas, and government/law enforcement requests, and that service providers abroad may be subject to foreign courts and authorities. The Terms impose binding individual arbitration with a class-action waiver and detailed mass-filing procedures, indicating anticipated litigation volume. This transparency is appropriate but signals meaningful government-request and dispute exposure.

CLEAR collects highly sensitive biometric data — faceprints, fingerprints, iris scans, and digital images of fingers, eyes, and face — which is Sensitive Personal Information, alongside identifiers, email, IP address, flight/booking data, and usage data. While collection is disclosed and consented to with a deletion mechanism, the breadth and sensitivity of the biometric SPI, combined with the inaccessibility of the core membership privacy policy, warrants a high-risk rating. Notably, the Canadian queueing policy's CCPA table marks 'Biometric information' as 'No' collected — because that policy covers only the non-biometric queueing service, not core membership.

The Member Terms carry an effective date of August 24, 2026, which is current relative to the August 27, 2026 analysis date. However, the only accessible privacy policy governs Canadian virtual queueing services and carries no discoverable date, and it does not cover the biometric/eGate/CLEAR ID capabilities visible in the product surface. The core membership privacy policy referenced throughout the Terms was inaccessible, so coverage of the AI/biometric-matching product cannot be fully verified.

Two documents were supplied but they govern different services and different legal entities (Clear Secure, Inc. for membership Terms; Whyline, Inc. for the Canadian queueing Privacy Policy), which limits direct comparison. A notable tension: the Terms describe extensive biometric collection for the core Services, while the queueing Privacy Policy's CCPA table lists 'Biometric information: No' — reconcilable because they cover different services, but a user reading only the queueing policy could be misled about CLEAR's overall biometric practices. This is a scope-driven ambiguity rather than a direct contradiction within the same service.