Skip to content
Privacy & consent

Nothing is shared unless you say so.

Consent is the whole product, not a checkbox in the flow. Here is exactly what a partner sees, what they never see, and what you can take back.

Get verifiedSee the trust center
The model

Four steps, and you are in charge of all of them.

Consent is not a checkbox at the end of a form. It is the mechanism by which anything moves at all.

You see the request first

Before anything moves, you see who is asking, which attributes they want, why, and whether it is one-time or standing access.

They get a claim, not a document

"Over 18" instead of a date of birth. "KYC passed" instead of a NIN. Attribute-level sharing is the default.

The share is recorded

Each approval writes a consent receipt to your wallet: requester, scope, attributes, timestamp, expiry.

You can revoke it

Standing access ends the moment you withdraw it. The partner is notified and further requests fail.

Worked example

A lender asks for five things. Two leave your wallet.

This is a real request shape against the documented API. The left block is what a partner sent. The right block is what came back after you approved.

What the partner requested
POST /v1/verify
{
  "credential_id": "tid_8fK2mQ",
  "purpose": "Age-restricted product and KYC check",
  "requested": [
    "date_of_birth",
    "full_name",
    "nin",
    "kyc_status",
    "address"
  ],
  "scope": "standing"
}
What was actually returned
200 OK
{
  "verified": true,
  "matched_source": "NIMC",
  "claims": {
    "over_18": true,
    "kyc_status": "passed"
  },
  "withheld": [
    "date_of_birth",
    "nin",
    "address"
  ],
  "consent": {
    "scope": "one_time",
    "expires_in": 900,
    "receipt_id": "rcp_3nQ7xB"
  }
}

What happened in between

Five steps, none of which required you to understand the API. In the wallet this was one screen with toggles.

  1. 01

    The partner asked for five attributes

    Nothing stops a partner requesting broadly. Their form was probably built around a document upload, so it asks for everything a document would have shown.

  2. 02

    You saw the request before it moved

    The prompt named the partner, listed each attribute, showed the stated purpose, and flagged that they wanted standing rather than one-time access.

  3. 03

    You narrowed it to two claims

    Date of birth became "over 18". The NIN and address were declined outright — the product needs an age gate and a KYC status, and it got both.

  4. 04

    You downgraded the scope

    Standing access became one-time with a 15-minute expiry. If they need to check again, they ask again.

  5. 05

    The receipt landed in your wallet

    rcp_3nQ7xB records who asked, what was released, what was withheld, and when. It is yours to read, and the withheld list is part of the record.

Consent receipts

What a consent receipt contains

  • requesterVerified partner name and registration
  • attributesExactly which claims were released
  • purposeThe stated reason for the request
  • scopeone_time or standing, with expiry
  • granted_atTimestamp of your approval
  • revocableWhether and how you can withdraw it

Receipts are append-only. A revoked consent stays in your log marked revoked rather than disappearing, because a history you can edit is not a record.

Selective disclosure

The narrowest true answer.

Most questions institutions ask do not need the underlying fact. They need whether a threshold was met.

  • Is this person an adult?

    over_18: truestays in your wallet: Date of birth

  • Have they passed KYC?

    kyc_status: passedstays in your wallet: NIN, BVN, documents

  • Do they live in Lagos State?

    state_matches: truestays in your wallet: Street address

  • Are they a Nigerian national?

    nationality: NGstays in your wallet: Passport number
Taking it back

Consent you cannot withdraw is not consent.

Four mechanisms, including an honest account of the one limit revocation has.

Revoke standing access

One tap in the consent log. The partner is notified by webhook and their next request fails immediately — there is no grace period.

One-time shares expire themselves

A one-time consent carries an expiry measured in minutes. Nothing to remember and nothing to clean up later.

Delete your account

Self-serve in the app. Your credential is revoked, your data is removed on our published schedule including from backups, and every partner holding standing consent is notified.

What revocation cannot undo

A partner who lawfully received a claim during the consent period keeps it under their own retention policy and regulatory duties. Revocation stops future access — we will not pretend it rewrites history.

Never

Commitments with no exceptions clause.

See retention periods in the trust center
We will not
  • Sell your personal data, ever
  • Share attributes with a partner you have not approved
  • Use your biometric template for anything other than verifying you
  • Track your activity across partner services for advertising
  • Keep verification documents after your credential is issued

The last item is the one with teeth: document images are deleted once your credential is issued, so a future request for them — from anyone — has nothing to answer with.

Your data, your call.

Verify once, then approve each share on your own terms — and revoke whenever you change your mind.

Get verifiedHow we secure it