Revolut is testing face-authenticated payments at three London coffee shops, bringing biometric identity checks from its app to the physical checkout. The three-day Pay with Smile pilot is voluntary, but it also creates a more consequential data flow than the launch slogan suggests: Revolut says it deletes each single-use facial embedding after authentication while retaining the original transaction photo and other records under its applicable retention policies.
The distinction matters for payment providers evaluating biometric checkout. Deleting a mathematical face template after a match does not mean every image or record generated by the transaction disappears. Revolut’s dedicated privacy notice says a secure copy of the original checkout photo is uploaded to its internal cloud systems for fraud prevention and payment-dispute investigations. It does not state a fixed retention period for that image, instead referring to the company’s applicable policies.
There is no evidence that the pilot has suffered a data breach or that Revolut has violated data-protection law. The accountability issue is narrower: customers and merchants need to understand which biometric artifacts are ephemeral, which records persist, and what happens to each category when a user freezes or leaves the service.
How the checkout works
The pilot runs from September 24 through September 26 at Kiss the Hippo cafés in Bloomsbury, Chelsea and Soho. Revolut customers must enrol in Pay with Smile through the Revolut app. At checkout, the terminal captures a facial image and converts it into an encrypted, single-use code, or facial embedding, that is used to verify the customer against the identity selfie collected when the customer originally joined Revolut.
Revolut says customers give explicit consent when they enrol and confirm consent again at the terminal. A failed or inconclusive match does not prevent a purchase: the privacy notice says the customer can use a card, phone or in-app Revolut Pay instead and can request human review of a rejected biometric match.
The company says merchants do not store personal data from the service. It identifies Revolut Bank UK as the controller and says processing occurs in its proprietary application environment, with a cloud provider used for storage and infrastructure. Revolut has not named that provider in the Pay with Smile notice.
Immediate deletion applies to one data layer
Revolut’s privacy notice separates the information created by a face payment into several categories. Temporary facial embeddings are deleted immediately after the identity check. The company also processes checkout and device information, encrypted payment parameters, cryptographic device signatures, diagnostic information and records needed for fraud prevention, disputes and regulatory compliance.
The original transaction photo follows a different path. Revolut says it is uploaded to internal cloud systems as a fallback for fraud and dispute investigations and is not used for the primary identity check at the terminal. The notice says the image, checkout information, device information, diagnostic information and fraud and dispute records are kept in line with applicable retention policies, without giving customers a period in days or years.
That is the main disclosure gap for operators to examine. A merchant can accurately tell customers that the café does not retain their face data while the payment provider still holds a transaction image centrally. Clear checkout messaging should therefore distinguish merchant storage from processor storage rather than compress both into a general assurance that data is not kept.
Freeze and withdrawal do different things
The privacy notice also draws a line between freezing the feature and withdrawing consent. Freezing Pay with Smile stops face-match payments but keeps all of the user’s data in Revolut’s system so the service can be restored later. Withdrawing consent permanently deactivates Pay with Smile and triggers immediate deletion of the user’s biometric template.
The notice does not say that withdrawal immediately deletes every prior checkout photo, device record or dispute record. Those categories may remain subject to fraud, legal, regulatory or dispute-retention requirements. That can be legitimate, but the product experience should make the difference visible before enrolment and at exit. Otherwise, a user may read “withdraw consent” as a promise to erase all data created by the service when the published notice makes a narrower commitment.
Incentives put consent design under scrutiny
Revolut is encouraging use with £1 coffees and triple RevPoints during the pilot. It is also charging merchants no processing fee for Pay with Smile transactions and promoting a discounted Revolut Register terminal. These incentives do not by themselves show that consent is invalid, but they make the quality of the consent flow important: customers should be able to see the image-retention terms before accepting the reward, and declining should remain as easy as using an ordinary payment method.
Privacy campaign group Big Brother Watch told Metro that biometric credentials carry lasting consequences if compromised because a person cannot replace a face as they would a password. Biometrics researcher Btihaj Ajana of King’s College London told the publication that routine facial identification can link physical presence to a central identity database and normalize surveillance in exchange for convenience. Those are attributed risk assessments, not evidence of a failure in Revolut’s system.
What payment operators should take from the pilot
For acquirers, processors and merchants, the useful lesson is that biometric checkout governance cannot stop at the match algorithm. Procurement and risk reviews should map every artifact: the live camera frame, facial embedding, enrolled reference template, transaction photo, device signature and dispute record. Each needs a named controller, stated purpose, access controls, retention period, deletion trigger and incident-response plan.
Merchants also need a fallback that does not penalize customers who decline biometrics, along with staff guidance for failed matches and disputes. Revolut’s alternative-payment and human-review provisions address part of that operational requirement. Its public notice is less specific about how long checkout images and related records remain after a transaction or opt-out.
The London trial is small and temporary, and no broad rollout date has been confirmed in the material reviewed. Before face payments move beyond a promotional pilot, the standard should be straightforward: convenience claims should be matched by equally concrete disclosure of what is captured, what is deleted, what is retained and for how long.