Privacy Notice — UnifyID staging
Who processes your information, why, where it goes, and how to exercise your rights.
About this staging service
This is the UnifyID staging service operated by VerifyNova Limited. It is used to test registration, verification and account features before production release. Identity providers perform real checks on real information; staging does not make a passport, face image or phone number fictional. Payments use test mode.
Use your own information and documents. Do not upload another person’s documents to test a feature. Test accounts and configuration may be reset; do not rely on this environment as your only copy of an identity record or for a live customer service.
Contact and privacy requests
The controller is VerifyNova Limited, NO 65, FABIAN NWAORA STREET, EFAB METROPOLIS, KARSANA, ABUJA, Nigeria. Send privacy requests to [email protected], account questions to [email protected], security reports to [email protected], and legal notices to [email protected].
No Data Protection Officer has yet been appointed. The privacy mailbox handles requests while that appointment is being arranged. This does not remove any duty to appoint an officer or register with a regulator where required.
What we process and why
We process contact details, identity attributes extracted from your document, document images, a live selfie and biometric results, verification decisions, consent records, account credentials and security events. We use these to verify you, prevent duplicate identities and fraud, secure the account, deliver messages and provide the features you request.
Account administration relies on the service agreement where applicable; security and fraud prevention rely on an appropriate lawful basis, subject to your rights; legal duties apply where required. Biometric identification uses separate explicit consent. Optional marketing requires a separate choice. Merely accepting this Privacy Notice is not blanket consent to unrelated uses.
Who receives information
AWS supplies application hosting, storage, encryption, backups and Rekognition face checks. Didit supplies document authenticity/extraction, face matching, liveness and screening for the enabled staging routes. Smile ID is configured but is not enabled as a document route in this four-country release. Resend delivers email; Twilio delivers phone messages; Cloudflare supplies DNS, edge protection and Turnstile. Flutterwave is in test payment mode; Pairgate fulfilment is disabled.
Identity providers receive the document and face material required for their checks. Messaging providers receive the destination and message content. Do not send identity documents to support by ordinary email. Connected applications receive only the claims you authorise, subject to the permissions enforced by UnifyID; they do not receive our face templates.
Didit’s terms describe optional model-training and improvement processing. Its organisation-level opt-out has not been confirmed for this account. See https://help.didit.me/data-privacy/opt-out-of-model-training and https://didit.me/terms/privacy-policy before deciding whether to participate.
Where information is processed
The application, identity evidence and AWS face collection run in Ireland. Recovery backups may be held in Frankfurt, Germany. This is an international transfer for people in Nigeria, Ghana, South Africa and Kenya. Hosting in Europe is not, by itself, an adequacy decision for a transfer from your country.
Didit documents Ireland as its default verification processing location. Resend and Twilio also process information in the United States and use delivery and support subprocessors. Email and SMS delivery involves the recipient’s email provider or mobile network. Cloudflare handles incoming web traffic and security signals on its global network; this deployment does not provide country-restricted edge processing.
We use the applicable provider data-processing terms and transfer safeguards for these services. For sensitive-data transfers that require your consent, we ask for it before verification. You can decline and leave the test or contact [email protected]. Foreign laws and access rights may differ from your home country. A provider’s published policy is not a claim that a regulator has approved this deployment.
Retention and deletion
Our policy is to retain selected evidence from a successful verification for 90 days after the final decision; rejected evidence for 30 days after rejection; and abandoned verification evidence for 30 days after the last activity. An active case is not treated as abandoned. Temporary processing copies should be removed within 24 hours after processing.
Verified account attributes remain while needed for the active account. A face template is retained while needed for identity continuity and duplicate-account prevention, with necessity reviewed separately from the image-retention window. If the staging face index is lost after the source images expire, you may need to verify again.
Minimal application audit records are retained for seven years. Consent evidence is retained while relied on and for seven years after withdrawal or expiry. Generated personal downloads and staff report/export files have a 30-day policy; their underlying records have their own retention periods. Infrastructure log files have a one-year policy; AWS Config’s managed internal history remains seven years. Recovery backups roll off after 35 days.
A documented legal hold can preserve only the records it covers. On release, the original retention deadline applies. Erasure must also be reapplied if a backup is restored. The evidence and staff-export purge schedules are still being commissioned in staging: these are the adopted retention deadlines, not a claim that every automated deletion job has already been verified. Contact [email protected] for deletion or the current status of a specific record.
Provider-held copies require separate handling. Their retention and optional model-improvement settings have not all been independently verified for this staging account. We do not promise that deleting a UnifyID record automatically deletes every provider copy, or that all optional provider training has been disabled.
Your choices and rights
You may request access, correction, deletion, restriction or a copy of your information, object where applicable, and withdraw consent. Contact [email protected]; we verify the requester and respond within applicable legal deadlines, with a target of 30 days or sooner where required. You may complain to the regulator named in your country notice.
Verification uses automated checks. An adverse result may prevent registration or place a case in review. You can ask support for human review rather than treating a score as final. Withdrawal does not invalidate processing lawfully completed before it; retaining a record after withdrawal needs its own lawful basis.
People under 18 need the verified-adult approval required by the registration flow before the child’s verification proceeds. A document is still required; the account’s abilities remain subject to applicable country rules and guardian controls.