Verath app privacy policy

This policy explains how VERATH LLC (“Verath”) handles personal data in the Verath mobile app, the web app at verath.io/app and the identity-monitoring service behind them. Our website privacy statement covers the public website and its forms.

• Account details: your email address, used to sign you in and send alerts; your phone number, if you add it, used only to send alerts; and an account identifier we create for you.
• Identity numbers: the NIN and/or BVN you choose to protect. They are encrypted as soon as they reach us and are never shown in full again. We match identity checks using scrambled codes (keyed hashes), not the numbers themselves.
• Face check (when you protect an identity): a short video of your face, taken with your consent. Our liveness provider uses it to confirm you’re a real person in front of the camera, and our identity verification provider compares one image from it with the photo on your NIN or BVN record. We keep only the results (passed or not, and the providers’ scores): we don’t keep the video or images, and we don’t create a face template. Our identity verification provider keeps the image it compares for up to 6 months (see “How long we keep it”).
• Identity-check history: the checks reported to us by connected institutions (institution, purpose, time) and your responses, such as “This was me” or “Not me”.
• Device information: a push-notification token, if you allow notifications.
• Diagnostics: crash and performance reports, with identity numbers and personal details removed before they are sent. Our error-reporting provider keeps them for up to 90 days.

Apart from the face check above, we do not collect photos or video. We do not collect your location, contacts, browsing history or bank account information. Face ID and fingerprint app lock happen on your device; we never receive that data. We do not show ads or track you across other apps or websites.

• To confirm that you own the identities you protect, so nobody else can monitor them. This includes the face check, which confirms you’re a real person and that you match the photo on the NIN or BVN record.
• To alert you when a connected institution checks your identity, and to send your “Not me” disputes to that institution.
• To provide your history, downloads, identity lock and settings.
• To keep the service secure, prevent abuse and fix faults.

We process this data with your consent, which you give when you protect an identity, and to provide the service you asked for. You can withdraw consent at any time by deleting your account.

Your face data is sensitive personal data, so we ask for your explicit consent just before the face check. You can choose not to continue; without the check we can’t confirm the identity is yours, so we can’t protect it. The face check is an automated decision: if it doesn’t work for you, contact us and a person will review it with you.

• Institutions you dispute: when you tap “Not me”, the institution that reported the check receives a dispute with its own reference for that check. It does not receive your name, contact details or identity numbers from Verath.
• Service providers that process data for us under contract: cloud hosting and database (United Kingdom), website hosting, email delivery, push-notification delivery (including Apple and Google, who deliver notifications to your phone), SMS and WhatsApp delivery where you use them, error reporting (EU), liveness checking for the face check (EU), and identity verification against NIMC and NIBSS records. A list of our service providers is available on request.
• Authorities where the law requires it.

We do not sell your data. Some providers are outside Nigeria; transfers are made in line with the Nigeria Data Protection Act 2023.

• Your account, protected identities and alert history: until you delete your account.
• Face check video and images: we don’t keep them, and nor does our liveness provider. Our identity verification provider keeps the image it compares with your record for up to 6 months, then deletes it or makes it anonymous. If you want it deleted sooner, email us and we’ll ask the provider to delete it.
• Face check results (passed or not, and scores): with your identity record, until you delete your account.
• Face check statistics used to measure how well the check works (for example, how many people complete it on each type of device): kept without your name, account, identity numbers or images.
• Records used only to process institutions’ reports: up to 35 days.
• Records of attempts made while your identity is locked: up to 2 years, or until you delete your account.
• A security audit log of account changes is kept as required by law and regulation.
• Deleted data is removed from our backups within 7 days.

Identity numbers are encrypted and matched only by keyed hashes that differ for every institution, so institutions cannot combine records to track you. Access to our systems is restricted, protected by multi-factor authentication and logged.

• Download your history: in the app or web app, Settings → Download my history.
• Delete your account and data: in the app or at verath.io/app, Settings → Delete my account.
• Notifications: turn alert channels on or off in Settings and in your phone’s settings.
• Face check: if it doesn’t work for you, or you disagree with the result, contact us and a person will review it with you.
• You can also ask us to access or correct your data by emailing support@verath.io, and you can complain to the Nigeria Data Protection Commission.

Verath is for adults aged 18 and over.

We will update this policy when the service changes and show the date above. Questions: support@verath.io.