faceping.ai

Biometric data retention schedule

Last updated 12 November 2026

Wiretouch Ltd (trading as FacePing) provides face check-in to businesses, our customers. This schedule sets out how long FacePing keeps face data and how we permanently destroy it. It applies to every customer, in every data region. Each customer, as the controller of its people's data, also tells the people it enrols how long it keeps their data, in its own privacy notice.

1. What we hold

  1. Face templates. A set of numbers made from a photo of the person, used only to check, at check-in, that they are the person enrolled. A face template is not a photo.
  2. No photos. The photo a person enrols with is used once to make their face template, then discarded. We don't store photos.
  3. Consent records. Which consent wording the person agreed to, and when.
  4. The customer's ID for the person, such as a ticket or membership number. We never need a name.

2. How long we keep it

We collect face data for one purpose: to verify the person at check-in for one of a customer's check-in lists. That purpose ends, and the face template and consent record are permanently destroyed, at the first of these:

  1. A list with an end date (a show, a festival, a course): 0 to 30 days after the list ends, as the customer chooses (7 days unless they choose otherwise).
  2. An ongoing list (members, visitors): when the list's maximum age has passed since the person enrolled, from 1 to 36 months as the customer chooses (12 months unless they choose otherwise).
  3. Withdrawal or removal: at once, when the customer removes the person (for example because they withdrew their consent) or deletes the list.
  4. The customer leaves FacePing: all their remaining data within 30 days.
  5. Practice lists (testing in a sandbox account): 24 hours after enrolment.

In every case, face data is destroyed no later than 36 months after the person enrolled, and so never more than 3 years after their last interaction with FacePing.

3. How we destroy it

  1. Automatically. A process runs at least every 15 minutes and permanently deletes face templates and consent records from our database when they reach their deletion date.
  2. On check-in devices. The copies on a customer's check-in devices are encrypted, and are dropped at the same deletion date, even when the device is offline. A revoked device wipes its copy at its next sync.
  3. Backups. Deleted data may remain in our encrypted database backups until they expire on their normal rolling cycle, within 35 days. We don't use backups to restore deleted data, except to recover the service after a disaster, and then we apply every deletion made since the backup again.
  4. Never sold. We never sell, lease, trade or otherwise profit from face data.

4. Asking for your data to be deleted

If you enrolled your face with a business that uses FacePing, ask that business to remove you: they can do it at once. You can also email [email protected] with the business's name and we'll pass your request on to them straight away.

5. Contact

Questions about this schedule: [email protected], or Wiretouch Ltd, 71 Church Road, Hove, BN3 2BB, United Kingdom. See also our Data Processing Agreement (clause 15) and Privacy and compliance in the docs.