Privacy
What we collect, and what we refuse to.
The short version: we collect the minimum needed to verify you, we never sell it, and we never share it without a specific consent from you that you can withdraw.
TrueID is pre-launch. This page describes our intended policy in plain language so you can assess us now. It is not yet a binding agreement, and it will be replaced by a reviewed legal document before registration opens.
Last updated 29 July 2026
What we collect
- Identity data you submit: your name, date of birth, and the identifier on the document you verify with (NIN, BVN, passport, licence, or voter's card number).
- A biometric template derived from your liveness check, used to confirm you are the person the credential belongs to.
- Verification results returned by the issuing source — whether the record matched, not a copy of the source record.
- Consent records: which partner requested what, when, and under what scope.
- Technical data needed for security: device fingerprint, IP address, and request timestamps.
What we do not do
- We do not sell your data, and we do not share it for advertising.
- We do not give a partner more than the specific attributes you approved.
- We do not retain document images after verification completes, beyond the fraud-review window we publish.
- We do not use your data to train models that would let anyone reconstruct it.
Your rights under the NDPR
- Access: request a copy of what we hold about you, from your wallet or by email.
- Correction: fix inaccurate data, including re-verifying against a corrected source record.
- Erasure: delete your account. Your credential is revoked and your data is removed on our published schedule, including from backups.
- Withdraw consent: revoke any standing partner access at any time, with immediate effect.
- Object and restrict: tell us to stop a specific processing activity, and we will either stop or explain the lawful basis we rely on.
Lawful basis
- Consent, for every share of your attributes with a partner.
- Contract, for operating the wallet and credential you asked us to issue.
- Legal obligation, where financial-services regulation requires us to retain a record.
- Legitimate interest, strictly for fraud prevention and platform security.
Retention
- Credential and account data: for as long as your account is open, then deleted on the published schedule.
- Consent receipts: retained as an audit record, because removing them would remove your own evidence of what happened.
- Document images: deleted after the fraud-review window closes.
- Security logs: retained for a limited period, then aggregated beyond identification.
Going deeper
How consent actually works in the product.
This page states the policy. The consent model page shows the mechanics — what a receipt contains, and what a partner receives when you approve a request.
Questions about how we handle your data?
Ask us directly. We would rather answer it once publicly than privately ten times.