Version: 2026-08-29-draft.

Privacy Policy

1. What data we collect

Depending on which check you (or a Client, on your behalf) request, U-verify processes: full name, date of birth, gender, National Identification Number (NIN), Bank Verification Number (BVN), driver's licence number, voter's card number, international passport number, company/CAC registration number, a facial photo/liveness capture, and uploaded identity documents. NIN, BVN, and biometric/facial data are sensitive personal data under the NDPA and are handled with additional safeguards, including field-level encryption at rest independent of the application's general encryption key.

2. Why we collect it

To perform the identity verification you or a Client has requested, and for no other purpose without your consent. We do not sell personal data.

3. Who we share it with

To perform a check, the relevant identifiers are sent to one or more accredited, Nigeria-focused identity verification providers acting as our sub-processors, which in turn query authoritative sources (NIMC, CBN, FRSC, INEC, NIS, CAC). We don't name our specific verification partners publicly — this is standard practice for KYC platforms, comparable to how a bank doesn't disclose the specific vendors behind its fraud-screening stack. We do not share your data with any other third party except: the Client who requested the check (for the result only), payment processing (Paystack, for public search fees — Paystack does not receive your ID number), or where required by law.

4. How long we keep it

• Verification media (documents, facial captures) is retained for

180 days by default, then automatically deleted by a scheduled job.

• Request/audit logs are retained for 365 days by default, then

automatically purged.

• Verification *result* records (used to answer repeat lookups without

re-querying a provider) are retained longer, since they underpin the Service's own database-hit-before-provider-call model — the exact retention period for this category is one of the items pending legal review.

These are the platform's configured defaults (config('kyc.ndpr')); an operator can change them per deployment, but must do so consistent with NDPA data-minimization principles, not silently.

5. Your rights

Subject to the NDPA, you may have the right to request access to, correction of, or erasure of your personal data, and to object to further processing. Contact the support address in the developer docs or mobile app to make a request; identity verification will be required before any request is actioned, for obvious reasons.

6. Consent

Where you submit your own or someone else's identity details through a hosted verification page, the public search tool, or the mobile app, you are asked to affirmatively confirm you have the right to request that check and that you agree to this Policy before submission proceeds. Developer accounts separately accept this Policy and the Terms of Service at registration.

7. Security

Sensitive identifiers are encrypted at rest; API access is signed (HMAC-SHA256) and short-lived-token authenticated; access to raw verification data is scoped to the Client that requested it. No system is perfectly secure; in the event of a data breach affecting personal data, we intend to notify affected parties and the relevant regulator in line with NDPA requirements — the specific notification procedure is pending legal review.

8. Children

The Service is not directed at children and is not knowingly used to verify the identity of a minor outside of a legitimate guardian-initiated process.

9. Contact

Questions about this Policy, or to exercise a data-subject right: see the support contact listed in the developer docs or mobile app.