How we protect your data.

Laminate keeps what the organization that invited you asks for. Usually that is your name, the company you work for, the days you are scheduled, an email address for your sign-up link, and your photo. If you agree to face recognition, it also keeps face data learned from that photo.

We do not sell personal information, build advertising profiles, combine people across organizations, or use anyone’s information to train a model.

For the technical reader on what we keep

• ID document details are held only when the organization switches on an ID check, and are deleted seven days after the person’s last scheduled day by default.
• A phone number, where the organization has one, is held so its staff can reach the person. Laminate does not message it.
• The organization is the data controller and decides what is collected. Laminate Systems is its processor, and handles the data only to run the service on its instructions.

Your face data and ID details are encrypted under a key that belongs to you alone. Your name, photo and contact details are encrypted as well.

When a key is destroyed, what it sealed can no longer be opened. That is how erasing a person, or closing a project, is made final.

For the technical reader on keys

• Sensitive values are encrypted one by one, and each is tied to its project, so one project’s data cannot be opened in another.
• Each person’s key is protected by the keys above it, which are held in a managed key service at our hosting provider and never on our servers. A copy of the database on its own opens none of the sealed values.
• Erasing a person destroys their key. Closing a project also schedules its key for deletion.

When you walk up to a gate, the iPad or iPhone there compares your face with the people it expects, on the device itself. The check does not wait on the network, and keeps working offline.

Your face is learned only if you agree. Before you are asked, you are shown what it involves; you can say “Not now” at the desk, or leave it undone on your sign-up link. If you withdraw later, your face data is deleted from our servers straight away, and the devices stop using it when they next connect.

The device informs; it does not decide. At a gate, the screen shows green when someone is expected and orange when they need a second look, and never a red screen. A face it does not recognize is not a verdict; where wristbands are in use, the screen asks for a tap instead. Laminate does not open or lock doors. It is there to help the person at the gate decide.

For the technical reader on face matching

• Matching runs on the device, against a gallery synced from the server.
• For a person invited to enroll, face data is created on the server from their photo, and only while their consent is on record.
• The gallery reaches each device encrypted and is stored there encrypted (see Where it lives).
• Devices match against the organization’s own watchlist only after someone at the organization has recorded the lawful basis for doing so.

Each organization sees only its own people. That separation is enforced by the database itself, not only by the screens on top of it, and each project’s records are kept apart within an organization too.

Inside an organization, roles decide who can do what. Administrators and managers use the console; desk staff sign in at a station with their own PIN.

For the technical reader on keeping organizations apart

• Roles: platform administrator, organization administrator, manager and desk user. Console sign-in is by passkey, or through the organization’s own single sign-on.

Someone at Laminate can open an organization’s console through support access, to help it. That access is read-only and ends after 60 minutes.

Its administrators can switch support access off at any time, which ends any open session at once. Every session is recorded, with the pages it opened, and the organization can see that record.

For the technical reader on support access

• Support sessions are read-only: they cannot change anything. There is one session per staff member at a time, with a fixed 60-minute life, and the organization’s switch is checked on every request.
• The page a session opened is recorded, not the records on it, so the log never becomes a second copy of anyone’s details.

Each check at a door or desk is recorded: who came through or was referred, when, and on which device. So are the access changes staff make, consent given and withdrawn, changes to how the organization signs in, and every change made through the assistant.

Opening the evidence a person provided, such as the result of an ID check, is recorded too, with who opened it and when.

For the technical reader on records

• Door events, access changes, sign-in events and assistant calls are kept as a record that is not edited afterwards. They leave only through retention, on the schedule below.
• Opening a person’s evidence, such as the result of an ID check, is recorded as well.

Your details are kept for your schedule, then removed. Seven days after your last scheduled day, by default, your face data and ID details are deleted, along with the contact details on your record. When the project closes, 90 days after its last day by default, the rest is deleted and the project’s key is destroyed.

If the organization erases you, your photo, face data, ID details, contact details, signed agreements and what its people list said about you are deleted then, and your own key is destroyed. Your name and the records of what happened at the doors and desks, including any alert or snapshot picture taken there, stay until the project closes. Our backups keep copies for up to seven days; after that, what was deleted is gone from them too.

For the technical reader on deletion

• A daily process applies the retention schedule.
• An erasure destroys the person’s key and records that the erasure happened.

Our servers, stored files and backups are hosted with Amazon Web Services. Connections to them are encrypted, and stored files are encrypted.

The iPads and iPhones at the doors keep what they hold encrypted. If a device cannot reconnect to Laminate for a set time, it wipes what it holds and stops using it.

For the technical reader on where it lives

• Hosting, file storage, backups and key management are with Amazon Web Services. Stored files are encrypted at rest.
• Browser and device traffic to the app passes through Cloudflare, which we use as our network edge, and is encrypted in transit.
• On each device, the project’s key is protected by the device’s own hardware security, what it holds locally is encrypted, and it is wiped when its lease runs out.

A Laminate wristband holds no name or photo, only identifiers. Each tap carries a fresh code the band works out with its own key, and the iPad or iPhone checks that code on the spot.

Laminate has no chatbot or language model of its own, and nothing it holds is used to train a model. An organization can connect the assistant it already uses, such as Claude or ChatGPT, to help its staff with everyday tasks.

Laminate never gives that assistant photos, face data, ID document numbers, signatures, wristband identifiers or watchlists, and every change it makes is recorded.

The one exception runs the other way: when a staff member has the assistant send a batch of photos into Laminate, those photo files pass through the assistant on their way in.

For the technical reader on the assistant

• Contact details and date of birth reach the assistant only when a staff member asks about one person.
• A photo import started through the assistant gives the staff member a one-time upload link, or the assistant sends the files itself. Only in the second case do the photos pass through the assistant.
• Each call the assistant makes is recorded.