Pre-release. Digital ID Checker is in development and testing. The ID check is a simulation and the service is not live for shops yet. This policy describes the current design and will be finalised, with a data protection impact assessment, before any shop pilot.
Who we are
Digital ID Checker is made by XFour IT Limited, trading as XFour Labs ("we", "us"). We are a company registered in England and Wales, number 11776254. Our registered office is 100 Berkshire Place, C/O KT Wells Ltd, Winnersh Triangle, Wokingham, RG41 5RD, United Kingdom. We are the controller for shop and staff account data. For the registers, check results and training records a shop keeps in the app, the shop is the controller and we process that data for the shop, on its instructions.
Questions about this policy: gdpr@xfour.co.uk.
The short version
Digital ID Checker helps licensed shops in England and Wales that sell alcohol. Staff check a customer's digital proof of age, log refusals in a Challenge 25 register, record staff training and prepare evidence for test purchases.
Shop managers sign in with email and password. Staff sign in with a shop code, their name and a 4–6 digit PIN. Five wrong attempts lock the account for 15 minutes. Sessions last 14 days.
- We do not collect: customer names, dates of birth, ID photos or document numbers. The system has no place to store them and our tests fail if anyone adds one..
- We do not collect: free-text notes that look like a date of birth or contain long numbers are rejected..
- We do not collect: analytics, crash reports, advertising IDs.
What we collect, where it goes, and how long we keep it
| Data | Where it is stored | Why | How long |
|---|---|---|---|
| Shop: name, address, licence number (optional), time zone, shop code | Our server (UK hosting planned) | To set up and run the shop's account | Until the shop deletes its account |
| Staff: display name, role, manager email and phone, hashed password or PIN, start and leave dates | Our server | To sign staff in and show who did what | Until the person leaves plus 2 years (for training records), or until the shop deletes its account |
| Age check results: a reference ID, pass or fail, the age limit used (18 or 25), the time and the staff member | Our server | To show the shop checked ID, as the licensing rules expect | 12 months |
| Refusals register: time, reason, staff member, optional short note | Our server | Evidence of the shop's Challenge 25 policy | 3 years |
| Training records: staff member, topic, date, trainer, sign-off, refresher date | Our server | Evidence of staff training | Until the person leaves plus 2 years |
| Audit log: who viewed or exported a register | Our server | Security and accountability | 3 years |
| Subscription status, linked to the shop ID | Our server and RevenueCat | To manage the shop's subscription | Until the shop deletes its account |
In-app purchases
- One subscription per shop, bought by the manager in the App Store or Google Play.
Payment is handled by the App Store or Google Play. We never see your card details. We receive only what you bought and whether it is active.
Why we use your data (our lawful basis)
| Purpose | Lawful basis |
|---|---|
| Shop and staff accounts, subscription | Contract with the shop |
| Registers, training records and check results | The shop's legitimate interests and legal duties under the Licensing Act 2003. For this data the shop is the controller and XFour IT Limited acts as its processor |
| Security and audit log | Our legitimate interest in keeping the service secure |
We do not sell your data. We do not use it for advertising. We do not make automated decisions about you that have legal or similar effects.
Service providers
We use these companies to run the app. They may only use your data to provide their service to us.
| Provider | What they do | Location |
|---|---|---|
| RevenueCat | Checks which in-app purchases you own | United States |
| Apple App Store / Google Play | Takes payment for in-app purchases. We never see your card details | Apple / Google |
| Hosting provider (to be confirmed before pilot) | Runs the server and encrypted backups | UK or EU |
| Digital ID provider (to be confirmed before pilot) | Performs the age check. Only a yes/no result comes back to us | UK |
Where a provider processes data outside the UK, we rely on UK adequacy regulations (for example for the EU), or on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or the UK-US Data Bridge where the provider is certified.
Deleting your data
- Managers can export all the shop's data as JSON, CSV or PDF at any time, even after the subscription ends.
- Staff can delete their own account. Their name is replaced with "Former staff member" and their contact details and PIN are removed.
- The shop owner can delete the shop. All its data leaves the live system at once and leaves backups within 30 days. Cancel the store subscription separately.
Children
Digital ID Checker is a business tool for shop staff aged 18 and over. If you think a child has given us personal data, email us and we will delete it.
Security
Data sent between the app and our providers is encrypted in transit. We give access only to the people and systems that need it, and we keep the amount of data we collect small. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the Information Commissioner's Office as the law requires.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of your personal data;
- ask us to correct data that is wrong;
- ask us to delete your data;
- object to, or ask us to limit, how we use your data;
- ask for your data in a format you can move to another service;
- withdraw consent at any time, where we rely on consent.
Email gdpr@xfour.co.uk. We will reply within one month. Much of your data may be only on your device, where we cannot see it. If your request is about a shop's registers or training records, we will pass it to that shop, which decides on it.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113. We would like the chance to fix it first, so please contact us.
Changes to this policy
When the app changes what it collects, we update this page and the date at the top. If a change is significant, we will also tell you in the app.
Contact
XFour IT Limited, 100 Berkshire Place, C/O KT Wells Ltd, Winnersh Triangle, Wokingham, RG41 5RD, United Kingdom.
Privacy: gdpr@xfour.co.uk · Support: support@xfour.co.uk
Policy based on a review of the app's source code (digital-id-checker, main branch) on 29 October 2026.