Verath app privacy policy

This policy explains how VERATH LLC (“Verath”) handles personal data in the Verath mobile app, the web app at verath.io/app and the identity-monitoring service behind them. Our website privacy statement covers the public website and its forms.

• Account details: your email address, used to sign you in and send alerts; your phone number, if you add it, used only to send alerts; and an account identifier we create for you.
• Identity numbers: the NIN and/or BVN you choose to protect. They are encrypted as soon as they reach us and are never shown in full again. We match identity checks using scrambled codes (keyed hashes), not the numbers themselves.
• Proof of ownership: the result of confirming that the identity is yours (for example, a verification code check). We keep the result and a reference, not photographs or biometric data.
• Identity-check history: the checks reported to us by connected institutions (institution, purpose, time) and your responses, such as “This was me” or “Not me”.
• Device information: a push-notification token, if you allow notifications.
• Diagnostics: crash and performance reports, with identity numbers and personal details removed before they are sent. Our error-reporting provider keeps them for up to 90 days.

We do not collect your location, contacts, photos, browsing history or bank account information. Face ID and fingerprint unlocking happen on your device; we never receive biometric data. We do not show ads or track you across other apps or websites.

• To confirm that you own the identities you protect, so nobody else can monitor them.
• To alert you when a connected institution checks your identity, and to send your “Not me” disputes to that institution.
• To provide your history, downloads, identity lock and settings.
• To keep the service secure, prevent abuse and fix faults.

We process this data with your consent, which you give when you protect an identity, and to provide the service you asked for. You can withdraw consent at any time by deleting your account.

• Institutions you dispute: when you tap “Not me”, the institution that reported the check receives a dispute with its own reference for that check. It does not receive your name, contact details or identity numbers from Verath.
• Service providers that process data for us under contract: cloud hosting and database (United Kingdom), website hosting, email delivery, push-notification delivery (including Apple and Google, who deliver notifications to your phone), SMS and WhatsApp delivery where you use them, and error reporting (EU). A list of our service providers is available on request.
• Authorities where the law requires it.

We do not sell your data. Some providers are outside Nigeria; transfers are made in line with the Nigeria Data Protection Act 2023.

• Your account, protected identities and alert history: until you delete your account.
• Records used only to process institutions’ reports: up to 35 days.
• Records of attempts made while your identity is locked: up to 2 years, or until you delete your account.
• A security audit log of account changes is kept as required by law and regulation.
• Deleted data is removed from our backups within 7 days.

Identity numbers are encrypted and matched only by keyed hashes that differ for every institution, so institutions cannot combine records to track you. Access to our systems is restricted, protected by multi-factor authentication and logged.

• Download your history: in the app or web app, Settings → Download my history.
• Delete your account and data: in the app or at verath.io/app, Settings → Delete my account.
• Notifications: turn alert channels on or off in Settings and in your phone’s settings.
• You can also ask us to access or correct your data by emailing support@verath.io, and you can complain to the Nigeria Data Protection Commission.

Verath is for adults aged 18 and over.

We will update this policy when the service changes and show the date above. Questions: support@verath.io.