Privacy notice

This notice covers this website, sandbox accounts and applications to go live. Face data processed by our customers (at events, gyms, workplaces or kiosks) is covered by those customers' own privacy notices and our data processing agreement with them: for that, our customer (the organisation running check-in) is the controller and FacePing is their processor.

Who we are

FacePing is a service of Wiretouch Ltd, United Kingdom. Contact: support@faceping.ai.

What we collect, and why

• Visiting this site and our docs: no cookies and no tracking across sites. Our hosting and security provider (Cloudflare) processes connection data such as IP addresses to deliver the sites and protect them from abuse. We use Cloudflare Web Analytics to count page views: it sets no cookies, doesn't identify or follow you, and gives us only totals such as pages viewed, countries and referring sites. Our legitimate interest is understanding which pages are useful.
• Signing in (customers): we email a one-time sign-in link to your account address. Once signed in, your browser keeps a sign-in token in local storage (not a cookie) for up to 7 days, or until you sign out. It's strictly necessary for the dashboard (app.faceping.ai) to work. We store only a scrambled (hashed) copy of the token.
• Signing up for a sandbox account: your email, name, organisation or project (optional), the platform you build for, and which version of the sandbox terms you accepted and when. We email you a link to confirm your address; no account exists until you use it. We use these to run your account and help you get started (lawful basis: providing the service you asked for).
• Using the SDK sandbox: when an app with your sandbox key first runs, it sends us the key, a random install id, the platform and the SDK version, and we record when each install was activated. We use this to issue the install's licence, enforce the sandbox's limits and prevent abuse (lawful basis: providing the service, and our legitimate interest in preventing misuse). Sandbox faces never reach us: they're enrolled, stored and matched on your device only.
• Practice lists in the sandbox: when you, or testers you enrol, are added to a sandbox practice list, we process the face on behalf of the account holder, who is the controller (we're their processor, under our data processing agreement). The photo is used once to make an encrypted face template and isn't kept; the template is deleted automatically 24 hours after enrolment, or sooner if the person is removed or the list is deleted. A practice list holds up to 25 people and is never used for anything else.
• Applying to go live: your organisation, your name, country, preferred data region, what you'll use FacePing for, expected people per month, how you'll use it (including whether you need 1:N search) and your data protection contact. We use these to assess your application and contact you about it (lawful basis: steps before entering a contract, and our legitimate interest in only offering FacePing for lawful, appropriate uses).
• Contacting us or joining a notify list: your name, email, company and message, used to reply or to tell you when an SDK is available (lawful basis: our legitimate interest in answering you, or your request to be told).

How long we keep it

• Approved applications: for as long as you're a customer, then as required for our accounts.
• Rejected applications: 180 days (in case you have questions), then deleted automatically.
• Sign-ups never confirmed: deleted automatically a day after the link expires.
• Sandbox accounts: until you close the account. We may close accounts unused for 12 months, after emailing you first.

Who processes it for us

• Microsoft Azure (hosting and database, EU region).
• Twilio SendGrid (sending service emails; may involve transfer to the US under standard contractual clauses).
• Cloudflare (website delivery and security).
• Google Workspace (our support mailbox, when you email us).

Your rights

You can ask for a copy of your data, or for it to be corrected or deleted, and you can object to how we use it. Email us at the address above. In the UK you can also complain to the Information Commissioner's Office (ico.org.uk).

Last updated 11 October 2026.