Privacy policy

Check Twice is made and operated by FusedFrames Technologies Ltd (“FusedFrames”, “we”), a company registered in England and Wales under company number 17097980, with its registered office at 23 King Street, Suite 191, Cambridge CB1 1AH, United Kingdom. We are the controller of the personal data Check Twice uses. Contact our privacy officer at legal@fusedframes.com or at our registered office.

What we use, and why

• Your phone numbers, up to three, to prove each is yours with a code, and so people who have one saved, and whom you have saved, can see you are verified. Needed to provide the service.
• Your photo ID, photographed in the app and read from its chip if it has one, to read your name and confirm that you are 18 or over. We keep your name as it is on your ID. People on Check Twice who have one of your phone numbers saved, and whom you have saved, see your first name and the first letter of your last name, so they can tell it is really you, and when you last proved it, which kind of ID you joined with and whether its chip was read. If you turn on “Anyone with phone number”, anyone on Check Twice with one of your phone numbers sees this too. If you turn on “Show full name”, whoever sees this sees your full name instead, and if you share your full name with one person from their page, that person does. We keep a coded fingerprint of its number, never the number itself, so that someone whose account we suspend can’t sign up again with it. We do not keep the photos of it, the data on its chip, its number, your address or your date of birth.
• Images of your face, to check you are a live person and that you match your ID, and a photo of your face taken when you join, kept so we can check it is you in future. A check in a browser, from a link sent with “Verify them on another phone”, compares your live face with the face your Check Twice account already holds. This is biometric data, and we use it only with your explicit consent, as our biometric policy sets out.
• Your face photo, shown only if you choose, as further proof it is really you: to everyone who can see you are verified, if you turn on “Show face photo”, or to one person at a time, if you share it from their page. It is the photo from when you joined, or from your latest Reverify while you show it. You can stop showing it at any time, in Account, then Security & privacy.
• Requests and results: who asked whom, when and what the checks found, so the person who asked can see the result.
• Your links: what you write in each, who it is for, whether it shows one of your phone numbers and when it was opened, never by whom, so the people you share it with can see it is really you. Anyone on Check Twice who opens one sees your name as above, how you joined and what you wrote, and a phone number only if you chose to show it. A key you make for an agent is kept as its name and a code it can be checked against, never the key itself.
• Your contacts: names never leave your phone. Each phone number is turned into a code on your phone before it is sent, and we keep none of them. We keep only which people on Check Twice each of your phones has saved, until it next looks at your contacts, so we know who may see you are verified, and the codes for the phone numbers of a contact you block (never the phone numbers themselves), so they are blocked if they join.
• Invites: when you invite someone, the code for their phone number (never the phone number), which of your phones sent it and the code in its link, so we know when they join. Once they verify and can see you, they count towards the people’s identities you have helped protect, which everyone who sees you verified sees, and we tell you. Whoever opens the link sees your first name and the first letter of your last name, and that count.
• Your phone and network: a code for your phone, its model, your notification address and signs that a camera or device is being tampered with, to keep the checks honest and the service secure.
• An issue you report or feedback you give: what you write, any photos you add and which of your phones sent it, so we can put it right and make Check Twice better.

Checks are automated. They use the photos of your face, your ID and what is read from it to decide whether you can join (for example, if you are under 18) and what a result shows. A result is shown to the person who asked. You can ask a person at FusedFrames to look at a decision again, and to tell you what it was based on, at check-twice.com/help.

Who else handles it

Check Twice reads your ID itself. Amazon Web Services finds the photo on the side of your ID that has it, compares faces, sends codes and stores photos for us, your face encrypted with our own key. Our hosting and notification providers (including Apple, Google and Expo, who carry what each notification says) handle data only to run the service. Every one of them is on our subprocessors page. We never sell personal data or use it for advertising. Check Twice stores and processes data in the United States, and we look after it from the United Kingdom. Where data leaves the United Kingdom, the European Economic Area or Switzerland, it is protected by the safeguards the law requires, such as standard contractual clauses. If you are in Canada, Australia or New Zealand, your data is held in those two countries, where courts and government authorities may be able to access it under their laws.

How long we keep it

• Your name, as it is on your ID, and your phone numbers: until you delete your account or 3 years after you last use Check Twice, whichever comes first, or, for a phone number, until you remove it.
• Your face photo from when you join: until you delete your account or 3 years after you last use Check Twice, whichever comes first. After 3 years unused, the whole account goes.
• Your face photo from your latest Reverify: only while you show your photo to someone, and never longer than the one from when you join.
• If we suspend your account: your face photo and your photo ID’s coded fingerprint, so you can’t sign up again, until the suspension is lifted, even if the account is deleted.
• Who you share your face photo or full name with: until you stop sharing it, or you or they delete your account.
• Other photos taken for a check: not kept once the check is done.
• Requests, results and your history: 90 days. A result someone got when you proved it was you stays with them for those 90 days, even if you delete your account.
• A link: until you delete it or your account. When it was opened: 90 days. A key: until you delete it.
• A signed-in phone: until it is signed out, or your account goes.
• Who you block: until you unblock them, or you or they delete your account.
• An invite: 90 days, or, once the person you invited counts towards the people’s identities you have helped protect, until you or they delete your account.
• A report, what happened as you chose it and what you wrote: until we have looked at it, then 90 days.
• An issue you report or feedback you give, and any photos with it: until we have read it, then 90 days.
• Records that limit how often something can be tried: 2 days.
• Anonymous scores from checks, which can’t be linked to you, to improve them: 180 days.
• A sign-up you never finish, with the photo of your face you took for it: 30 days from when you started it, or from when you last chose to verify later.

Your rights

You can ask for a copy of your data, have it corrected or deleted, take it elsewhere, object to how we use it or restrict it, free of charge. You can withdraw consent at any time by deleting your account in the app (Account, then Delete account), which deletes your data.

If you are unhappy with how we have handled your data, tell us first and we will look into it and reply in writing. You can also complain to the Information Commissioner’s Office (ico.org.uk); in the European Economic Area or Switzerland, to the data protection authority where you live; in Canada, to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your province’s commissioner; in Australia, to the Office of the Australian Information Commissioner (oaic.gov.au); or in New Zealand, to the Privacy Commissioner (privacy.org.nz).

Age

Check Twice is only for people aged 18 or over.