# Data Packages

The Contact and Identity packages decide which user data the merchant
receives. Verification is the same for both packages.

Privy sets one data package for each merchant at onboarding. The merchant
cannot select a package for a session. Both packages use the same
[user journey](/digital-id/concepts/user-journey). Only the delivered data is
different.

| Capability | Contact package | Identity package |
| --- | --- | --- |
| User input | PrivyID, email, NIK, or mobile number | Same |
| Verification | Selfie liveness, face match, and OTP | Same |
| Data sections | Contact data (`my_contact_data`) | Contact data (`my_contact_data`) and identity data (`my_identity`) |
| Data items | Verified email and phone | All Contact items, plus PrivyID, full name, NIK, date of birth, KTP image URL, and selfie URL |
| Delivery | Signed JWT. Contact data is readable: signed, not encrypted. | Signed JWT. Contact data is readable. Identity data is encrypted for the merchant. |

Privy configures the data items in each package. Treat each item as optional.

The field names start with `my_` because they match the consent screen. The
user sees "My Contact Data" and "My Personal Identity".

> Session creation, widget loading, callbacks, exchange codes, and JWT
> verification are the same for both packages. The merchant credentials are
> separate from the package: the API key, and the RSA private key for the
> Identity package.

See [Data Delivery](/digital-id/guides/data-delivery) and
[Encrypted Identity Data](/digital-id/guides/encrypted-identity-data).