LAMINATE

Laminate Privacy Policy

Version 0.4.

Last updated:

Laminate is software that organizations use to run access control at the doors and desks of their own projects: events, sites and other places where people come and go for a set period. If an organization has invited you to sign up through Laminate, this policy explains what is held about you, why, for how long, and who to ask.

This policy covers two things: information handled for the organization that invited you, for which Laminate is the processor, and messages sent through the contact form on this website, for which Laminate Systems decides how they are used: to reply to you.

You do not have to agree to face recognition. If you would rather not, say so at the desk, or leave it undone on your sign-up link, and your face will not be learned for recognition at the doors. Two things work differently, and are described below: an ID check, if the organization uses one, compares your face with the photo on your document; and a watchlist, if the organization keeps one, is made without asking the people on it. Everything else on this page explains what happens either way.

Who is responsible

The organization that invited you decides why your information is collected and how it is used. In data protection terms it is the controller. It chooses who is invited, what each person must provide, which checks are used at its doors, and who on its staff can see your information.

Laminate Systems provides the software and runs it on the organization's behalf. We are the processor: we handle your information only to run the service for that organization, and only as it instructs.

Requests about your own information (to see it, correct it, or have it erased) go to the organization that invited you, because it holds the decision. If you are not sure who that is, or you need help reaching them, write to us and we will pass your request on.

Each organization's information is kept apart from every other organization's. We do not combine people across organizations, sell personal information, build advertising profiles, or use anyone's information to train any model.

What we hold

Depending on what the organization asks for, Laminate may hold:

  • Your name, the company you work for, your role, and the days you are scheduled to work.
  • Your email address, used to send you your sign-up link, codes and receipts.
  • Your phone number, if the organization has it. It is held so staff can reach you; Laminate does not message it.
  • Your photo.
  • Face data learned from your photo, if you agree to face recognition.
  • Details from an ID document, if the organization asks for an ID check: a photo of the document and what was read from it, such as the document number and date of birth.
  • Agreements you sign, and your signature on them.
  • Your wristband's identifier, if you are issued one.
  • Records of what happened at the doors and desks: who was let through or referred to staff, when, and by which device. When a device raises an alert, or a staff member takes a picture at a desk, that picture is kept with these records.
  • A record of what the organization's staff changed, and who changed it.

Photos and face recognition

Your photo is kept whether or not you agree to face recognition. It lets a person check the system's work: staff with access to the organization's console can see it, and the devices at the doors hold a copy so the person on the door can compare it with you.

Face recognition is separate, and it needs your agreement. Before you are asked, you are shown what it involves. On a desk device you must scroll to the end before you can agree, and you can say "Not now". If you agree, our servers learn your face from your photo, and the face data is sent, encrypted, to the devices at that project's doors. Matching happens on those devices. Your face data is only used for the project you were invited to.

If a device does not recognize you, that is not a refusal. Where wristbands are in use, you are asked to tap your wristband instead.

An organization can also set a project, or particular days within it, to wristbands only. On those days faces are not matched at the doors: your wristband identifies you. If you are only invited for such days, you are not asked to agree to face recognition, and no face data is learned from your photo. If you are also invited for other days, your agreement and any face data apply to those days only. A photo may still be collected, if the organization asks for one, and used by the person on the door to compare with you, as described above.

Your agreement to face recognition is given on the notice shown to you when you are asked, not by this policy. That notice explains what face recognition involves, why it is used, and how long what we learn of your face is kept, and it is the one to read before you decide.

You can change your mind at any time. Tell the person at the desk, or use your sign-up link, where we email you a code to confirm it is you. When you withdraw, your face data is deleted from our servers straight away, and the devices stop using it when they next connect. Your photo stays, on the schedule below, and agreeing again later learns your face from the same photo.

If the organization uses an ID check, the check also compares your face with the photo on your document to see whether they match. That comparison is part of the ID check, not face recognition at the doors. Didit and Stripe Identity run their own comparison under their own terms. When Laminate runs the check, a selfie that matches your document can become the photo on file, and face data is kept for recognition at the doors only if you have agreed to face recognition.

Laminate does not check whether a face is a live person or a picture, and its own ID check does not prove that a document is genuine. The organization decides what weight to give a match.

Decisions at the doors

Matching is automated: a device compares the face it sees, or the wristband tapped on it, with the people it expects, and shows the result on its screen. Laminate is built to support the person checking people in, who makes the decision. It does not open or lock doors. A face that is not recognized is not a verdict on you. When someone needs a second look, the screen says so and leaves what happens next to the organization's staff.

Watchlists

An organization can keep a watchlist: people it has a security reason to look out for, such as someone banned from its sites. The people on a watchlist are not asked to agree. The organization adds them with a photo, and the devices at its doors compare the faces they see against that photo.

A watchlist entry applies either to one project or to every project the organization runs. The organization chooses, and one project is the default.

Before any device matches against a watchlist, someone at the organization must confirm the lawful basis for doing so (crime prevention), and that confirmation is recorded. An entry can be given an end date. When it reaches that date, or the organization removes it, its photo and face data are deleted. An entry for one project also goes when that project closes. An entry for every project lasts until its end date or until it is removed.

Watchlist entries are never shown to the assistant described below.

How long we keep it

Retention follows your schedule, not a fixed date. Your last scheduled day moves later if you are given more days, and earlier if days come off.

By default, 7 days after your last scheduled day, we delete:

  • Your face data.
  • Photos of your ID document, and what was read from it, such as the document number.
  • The email address and phone number held as your contact details.
  • Your agreement to face recognition, and the results of any ID check.

Kept until the project closes, which is 90 days after the project's last day (by default):

  • Your name and your photo. Your photo is kept until the project closes, so that if you come back to work on it you do not have to start again.
  • Agreements you signed.
  • The records of what happened at the doors and desks, including alert pictures.
  • What the organization's connected people list (a spreadsheet) said about you, such as your name, email address and phone number.

When the project closes, all of this is deleted and the project's encryption key is destroyed.

If you ask the organization to erase you, and it does, your photo, face data, ID details, contact details, signed agreements and what its people list said about you are deleted then, and your own key is destroyed. Your name and the records of what happened at the doors and desks are kept until the project closes. A record that the erasure happened is kept too.

Our backups keep a copy of the database and stored files for up to 7 days. Information that has been deleted or erased can remain in those backups for up to 7 days, and then it is gone.

Where it is stored and who processes it

Our servers, stored files and backups are in the United Kingdom, in London. Connections to them are encrypted, and stored files are encrypted. The most personal parts are also sealed with encryption keys of their own. Each organization and each project has its own key in a key management service. Your face data, your ID details, the contact details on your record and your signature agreeing to face recognition are sealed under a key of your own, which is itself sealed under the project's key. Your name, your photo, the agreements you sign and what the organization's people list said about you are sealed under the project's key. Watchlist entries are sealed under the organization's key.

Devices at the doors store what they hold encrypted. If a device cannot reconnect to Laminate for a set time, it wipes what it holds and stops using it.

We use these companies to run the service:

  • Amazon Web Services, in its London region, runs our servers, stores files and backups, and holds the encryption keys.
  • Cloudflare carries traffic to our website and console, and protects them from attack. Some device traffic goes straight to our servers instead. Cloudflare Turnstile also checks the contact form on our website to keep out spam.
  • Mailgun sends our emails, such as your sign-up link and codes. Email is sent through Mailgun's United States region, so your name, email address and the content of the email pass through the United States.
  • Google: if the organization keeps its people list in Google Sheets, or its photos (including watchlist photo folders) in Google Drive, Laminate reaches them through its own Google service account, which the organization shares them with. Laminate reads them, and writes updates back into a connected Google Sheet.
  • Didit and Stripe Identity: an organization may switch on an ID check from either company. If it does, you photograph your ID document and yourself with that company, under the organization's own account with it.

Someone at Laminate can open an organization's console through support access, to help it. That access is read-only and ends after 60 minutes. Support access is on unless the organization's administrators switch it off, which they can do at any time; switching it off ends any open session at once. Every session is recorded, with the pages it opened, and the organization can see that record.

The assistant

An organization can connect its own AI assistant, such as Claude or ChatGPT, to help its staff with everyday tasks. The organization chooses the assistant and has its own agreement with the company that provides it. What the assistant reads is sent to that company.

The assistant is never given photos, face data, ID document numbers, ID check evidence, signatures, wristband identifiers or watchlist entries. It sees a person's email address, phone number or date of birth only when a staff member asks about that one person. Every change it makes is recorded.

One exception: a staff member can use the assistant to bring in a batch of photos. In that case the photo files pass through the assistant on their way into Laminate.

If you write to us through our website

The "Talk to us" form on our website is separate from any organization's project. For these messages, Laminate Systems decides how they are used: to reply to you.

This form collects your name, email and message, and emails them to the Laminate team. The email is sent through Mailgun, in the United States, and is then kept in the Laminate team's mailbox. Your message is not stored on this site. Cloudflare Turnstile checks the form to keep out spam, and receives your IP address when it does.

Your choices and how to reach us

  • You can decline face recognition at the desk, or leave it undone on your sign-up link. You can withdraw your agreement at any time, at the desk or through your sign-up link.
  • You can ask the organization that invited you to see, correct or erase your information.
  • You can ask us anything about this policy, or ask us to pass a request to the organization.

Laminate Systems privacy@laminate.systems

We may update this policy as the product changes. The version and the "Last updated" date at the top show when it last changed.