Privacy policy

VERIS LABS LIMITED (RC 9414656) ("Veris", "we", "us") provides identity verification software infrastructure to mobile application developers. Our registered address is in Nigeria.

We are the data controller for the data described in this policy: your developer account, your use of our dashboard and website, and our billing records. When you use the Compare API, you are the controller of the images you send and we act as your processor. See our NDPA page for how roles are split.

Contact for data protection matters: [email protected]

2.1 Account data (developer customers)

• Name, email address, phone number, company name and website URL
• How you heard about us, if you choose to tell us
• Business verification details if you apply to go live: business type, country, company registration number and the registration document you upload. We use these only to approve live keys
• Payment records: amounts, references, status and the card type and last four digits that our payment provider returns for receipts. Card numbers and bank details are collected and processed by Paystack and never reach Veris
• Wallet and bank-transfer funding records, if you use the Compare wallet
• An API licence key hash (the full key is shown once and never stored in plain text) and your registered application package names
• Messages you send to support

2.2 Sign-in and security data

When you use the dashboard we record the time, IP address and browser type of sign-ins and key actions. We use these to protect accounts, investigate abuse and keep an audit trail. We also use them to enforce the limits on free sandbox keys.

2.3 SDK telemetry data

When end users of your application use a Veris SDK, we collect the following anonymous telemetry:

• Session outcome (success or failure)
• Error codes (if any)
• Platform (Android, iOS, Flutter, React Native)
• SDK version
• Timestamp

We do not collect face images, biometric feature vectors, user names, phone numbers, email addresses, device identifiers, GPS coordinates, or any data that could identify an individual end user. You can switch telemetry off from your dashboard.

2.4 Compare API data

Images submitted to the Veris Compare API are processed in memory and are never written to disk by Veris. To perform the comparison they are sent over an encrypted connection to a trusted processing partner, which handles them for that single request only. Nothing is retained after the response is returned. No image or derived biometric data is logged or stored by Veris at any level of detail.

2.5 Website visitors

On verisinfra.com we use Google Analytics to count visits and see which pages are read. It sets cookies or similar identifiers in your browser and reports to Google. See Cookies below for how to stop this.

We do not make decisions with legal or similarly significant effect about you by automated means alone, and we do not sell your data.

We share data only with:

• Paystack - for payment processing (subject to Paystack's privacy policy)
• Resend - for transactional email delivery
• Google Analytics - for website visit measurement, as described above
• Infrastructure and image-processing partners - cloud hosting, traffic delivery and security, and the face-comparison service, in secure data centres outside Nigeria, under data processing terms
• Authorities - where the law requires it, or to protect our rights or the safety of others

Our servers and our partners' data centres are in Canada. Your account data is stored there. Compare images pass through them for the single request they are sent for and are not kept. We make these transfers under written data processing terms that require protection of your data, as the NDPA requires. End-user face and document data captured by our SDKs stays on the device and is not sent to us.

• Account data, including business verification details: kept while your account is active and for 90 days after deletion
• Telemetry raw events: aggregated at midnight UTC daily; raw events deleted after 30 days
• Nonces: Redis TTL of 10 minutes; PostgreSQL fallback expiry of 10 minutes
• Compare images: deleted immediately after each request
• Invoice and payment records: kept for 7 years as required by Nigerian financial regulations

You have the right to:

• Confirm whether we hold your personal data, and get a copy
• Have inaccurate data corrected
• Have your data deleted, where the Act allows
• Restrict how we use your data
• Object to processing, including for direct marketing
• Receive your data in a portable format
• Withdraw consent at any time, where we rely on it

To use any of these rights, write to [email protected]. We will respond within 30 days. If you are not satisfied with our answer, you can complain to the Nigeria Data Protection Commission.

• All data is sent over HTTPS (TLS 1.2 or newer)
• Passwords are hashed with bcrypt (cost factor 12 or more)
• Licence keys are stored as SHA-256 hashes, never in plain text
• Webhook secrets, two-factor secrets and payment-provider keys are encrypted at rest
• All administrator actions are logged with the time and the administrator

If a breach puts your rights at risk we will tell you and, where the law requires, the Nigeria Data Protection Commission, within 72 hours of becoming aware of it.

Veris is a service for developers and businesses. It is not meant for anyone under 18, and we do not knowingly collect data from children.

The developer dashboard keeps you signed in using your browser's storage and a session. That is essential to the service and does not track you across other sites. Our marketing website (verisinfra.com) uses Google Analytics to measure visits, as described in section 2.5. We place no advertising cookies.

You can block analytics cookies in your browser settings, or use Google's browser add-on to opt out of Google Analytics.

We will notify registered customers by email of any material changes to this policy at least 14 days before they take effect.

Privacy enquiries: [email protected]
General enquiries: [email protected]
Legal matters: [email protected]