Enrolled people and deletion

See who's enrolled, honour withdrawals and erasure requests, and how face data is deleted.

List enrolled people#

Returns people: each person's personId (your ID for them: a ticket, membership or employee number), when and how they enrolled (enrolledAt, and source: Widget, Dashboard or Api), their consentVersion, whether they're under 16 and when their face will be deleted (deleteAfter), never face data. Newest first, 100 per page (?page=2 for the next); total is how many there are. ?search= matches part of a personId.

Remove someone#

When a person withdraws consent, asks for their data to be erased or leaves (a member, a member of staff), remove them. It takes effect immediately; check-in devices drop their face at their next sync. URL-encode the personId in the path. 404 means no one with that personId is enrolled on the list.

DELETE /v1/lists/{listId}/people/{personId} →

Deletion is automatic#

What	Deleted
The photo	Straight away; it is never stored
Face templates and consent records	List with an end date: list end + `retentionDays` (0 to 30, default 7). Ongoing list: `maxAgeMonths` (1 to 36) after the person enrolled. Each person's `deleteAfter` shows the date
Copies on check-in devices	At the same time (even offline), or when you revoke the device
Everything for a list	Immediately when you delete the list

DELETE /v1/lists/{listId} →

Every deletion is recorded in your deletion log (Dashboard): what was deleted, when and why, never who. Use it to show a regulator, or the person themselves, that retention is enforced.

Usage and billing#

You pay for each person stored with FacePing in a month. A person counts if their face is still stored at the end of the month, or if they were enrolled and deleted within it, so removing someone doesn't take them off that month's bill, and nobody counts twice in a month. Billing records hold no face data. See Dashboard → Billing for this month's people so far and the per-list breakdown, and Errors and limits for the plans.