That doesn't make me feel a lot better. :( The images are enough to generate biometric data such as facial recognition profiles.
It's simply not legal to "not keep records" if you are running payments.
If you ran a payment to "O Bin Laden" but you have a driver's license picture showing that it is Oscar Bin Laden, from CA, DoB 2001, you'd better keep all that information for your records in case you get audited for potential OFAC violations.
> all images captured, extracted data from your ID document including name, date of birth, and ID number, and any information submitted via forms such as name, date of birth, SSN, email, and phone number, and the verification response.
How do you foresee that consent working if your product is used in account recovery flows?
For example, imagine if Steam adopted Stripe Identity as their only way to allow people with $$$$ worth of games to recover hacked accounts. If the user's only choice is to "consent" or lose their valuable account, that makes the "consent" something of a joke.
I'd be interested to hear how you plan to square that circle!