--- title: "Biometric policy — Check Twice" description: "How we collect, use, protect, keep and destroy images of your face, who we disclose them to and how to withdraw your consent." url: https://www.check-twice.com/legal/biometric --- # Biometric policy Last updated: 30 October 2026 This policy explains how FusedFrames Technologies Ltd (“we”, “us”) collects, uses, keeps and destroys biometric data through Check Twice. It is our written policy under the biometric privacy laws that apply to us, including Illinois’ Biometric Information Privacy Act and the Colorado Privacy Act, and forms part of our [Privacy policy](https://www.check-twice.com/legal/privacy). ## What we collect Biometric data means images of your face and the measurements of your face made from them. We collect: - scans and quick photos of your face, taken in the app or, to verify on another phone or delete your account on our website, in a phone’s browser; - the photo of your face on your photo ID; - one photo of your face, kept so we can recognise you later (your face photo), which a later photo you take in the app may replace; - the photo of your face others see on your verified card, which is the one from your sign-up until you sign in on a new phone, Reverify or use Retake face photo. To take these photos, the app or your phone’s browser finds your face on your phone. Those measurements never leave your phone and aren’t kept. ## Why we use it Only to verify identity, and to show your face photo to the people who can see you’re verified, unless you hide it: to check that you are a real person, that you match your photo ID and that it is you when you sign in, when you take an action that needs a quick photo or when someone asks you to verify. The face photo others see is the photo from your sign-up, or a newer one from signing in on a new phone, a Reverify or Retake face photo, which we first compare with your face photo, as we do every quick photo. We never use it to work out anything else about you, such as your age, ethnicity or health, and never for advertising or to train artificial intelligence. ## Your consent Before we collect your biometric data, we tell you what we collect, why, for how long and how to withdraw, and ask for your consent for us and our service providers, including Amazon Web Services. We record your consent and when you gave it. We don’t collect biometric data from anyone who hasn’t consented. ## Who we disclose it to We disclose biometric data only: - to Amazon Web Services, which compares faces and stores your face photo for us, and Cloudflare, which carries it securely to our servers, as our service providers under contracts that bar them from using it for anything else; - to other people on Check Twice: the result of each check and, unless you hide it, your face photo, as our Privacy policy sets out; - where the law requires it, or under a valid warrant or subpoena. We never sell, lease or trade biometric data, or otherwise profit from it. ## How long we keep it - **Images from a check, other than your face photo:** destroyed when the check ends. - **An unfinished sign-up:** destroyed after 30 days. - **Your face photo and the one others see:** destroyed when you delete your account, or 24 months after you last use Check Twice, whichever comes first, even while you hide it. We tell you a month before the 24 months end. We destroy biometric data permanently, including every copy, as soon as it falls due, unless the law, or a valid warrant, subpoena or court order, requires us to keep it. ## How we protect it We protect biometric data with at least the care we use for our other confidential data, and to the standard expected in our industry. It is encrypted in transit and stored encrypted with our own keys. Only the staff who need it can access it, and we keep a record when they do. ## If there is a security incident We have a written plan for responding to any security incident that may affect biometric data. We contain and investigate it, then tell the people affected and the authorities as the law requires. ## Reviewing what we keep We review this policy and the biometric data we hold at least once a year, and destroy any we no longer need within 45 days. ## Withdrawing your consent You can withdraw your consent at any time by deleting your account in the app (Account, then your name, then Delete account, under Leave) or at [check-twice.com/delete](https://www.check-twice.com/delete). If you can’t take a quick photo, email [support@fusedframes.com](mailto:support@fusedframes.com) and we will delete your account once we have confirmed it’s you. Check Twice can’t work without biometric data, so withdrawing ends your account, and we destroy your biometric data as set out above. ## Contact us Email [legal@fusedframes.com](mailto:legal@fusedframes.com) or write to FusedFrames Technologies Ltd, 23 King Street, Suite 191, Cambridge CB1 1AH, United Kingdom.