Privacy Policy

1. Introduction

Sankofa Network ("AfriVerify", "we", "us", or "our") operates the AfriVerify identity verification platform accessible at afriverify.sankofaapp.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use our Service, whether as a developer integrating our API, an end-user completing an identity verification, or a visitor to our website.

We are committed to processing personal data in accordance with applicable data protection legislation including the Nigeria Data Protection Act 2023 (NDPA), the Kenya Data Protection Act 2019, the South Africa Protection of Personal Information Act (POPIA), Ghana's Data Protection Act 843, and where applicable, the EU General Data Protection Regulation (GDPR) and relevant frameworks across the 54 African Union member states we serve.

2. Data Controller

The data controller for personal data processed through the AfriVerify platform is Sankofa Network, registered in Nigeria, with principal offices in Akwa Ibom, Nigeria. For data protection enquiries, contact our Data Protection Officer at privacy@sankofaapp.com.

3. Information We Collect

3.1 Identity Verification Data

When an end-user completes a verification through our platform or an integrated developer application, we collect:

• Full legal name as it appears on government-issued identification
• Phone number (used as the primary identifier)
• Government ID type and a cryptographic hash of the ID number (we do not store the raw number)
• Nationality and country of identity document
• Biometric data: facial photograph and derived face embedding vector (stored encrypted)
• Device fingerprint identifiers
• IP address at time of verification
• Session metadata (timestamps, verification steps completed, verification channel used)

3.1a USSD Verification Data

When an end-user initiates identity verification via USSD (Unstructured Supplementary Service Data), we additionally collect:

• The MSISDN (mobile number) from which the USSD session was initiated, as proof of phone possession
• Telecom operator identifier and session reference number
• USSD session timestamps and menu navigation sequence
• The developer API key and short code that routed the session

3.1b Inquiry Link Session Data

When an end-user accesses a no-code Inquiry Link created by a developer, we collect:

• Inquiry link identifier (slug) and the developer account that created it
• Completion status, number of attempts, and expiry/max-use thresholds reached
• All standard identity verification data collected during the session (see 3.1 above)

3.1c White-Label Session Data

When an end-user completes verification through a developer's white-label branded flow, we collect:

• Session token and the developer's white-label configuration identifier (company name, logo URL, brand colour)
• All standard identity verification data collected during the session (see 3.1 above)

3.1d AfriApp / Kliqa Integration Data

When a developer connects an AfriApp key issued via the Kliqa store, we collect:

• The AfriApp API key prefix (we do not store the full secret)
• Connection timestamp and the associated AfriVerify developer account

When an end-user redeems a Kliqa voucher for Orbitverse wallet credit, we collect the voucher code prefix (masked), redemption timestamp, voucher tier, and credit amount applied.

3.2 Developer Account Data

When you register as a developer, we collect:

• Full name, email address, company name, and phone number
• Billing information (processed by Flutterwave; we receive payment tokens, not raw card data)
• API usage logs, webhook endpoint URLs
• Account activity and security events

3.3 Automatically Collected Data

• Access logs (timestamp, endpoint, response code, latency)
• Error and exception reports
• Browser type and operating system (for the dashboard)

4. Legal Basis for Processing

We process personal data on the following legal bases:

• Contract performance: to deliver the verification services requested by developers and their users
• Legitimate interests: fraud prevention, AML screening, platform security, and improving the accuracy of our identity models
• Legal obligation: compliance with anti-money laundering (AML), counter-terrorism financing (CTF), and know-your-customer (KYC) regulatory requirements in each jurisdiction we operate
• Consent: for optional features such as voice print storage and cross-platform identity portability via the Verified Identity Token (VIT)

5. How We Use Your Information

• Performing liveness detection, document authentication, and identity verification across all channels (API, hosted flow, USSD, Inquiry Link, white-label)
• Processing USSD sessions to confirm phone possession and return verification outcomes to the requesting developer application
• Routing and completing no-code verification sessions initiated via developer-created Inquiry Links
• Rendering white-label hosted verification flows with developer-supplied branding configuration
• Issuing and validating Verified Identity Tokens (VITs)
• AML screening against global sanctions lists and PEP databases
• Calculating and maintaining trust scores
• Detecting and preventing fraud across the AfriVerify network
• Processing and validating Kliqa voucher redemptions for Orbitverse wallet credit
• Providing developer dashboard analytics and usage metrics
• Billing and invoicing
• Customer support and dispute resolution
• Complying with lawful requests from regulatory and law enforcement authorities

6. Data Sharing

We do not sell your personal data. We share data only:

• Identity verification providers: Smile Identity, Dojah, and Onfido receive only the minimum data required to perform the specific check requested. Each provider is contractually bound to our data processing terms.
• AfriApp / Kliqa: When a developer connects an AfriApp key or an end-user redeems a Kliqa voucher, Kliqa (store.kliqa.africa) receives the voucher code for validation. No personal identity data is shared in this exchange.
• Payment processors: Flutterwave processes billing transactions. We do not store raw card data.
• Cloud infrastructure: AWS (data storage, S3), Railway (API hosting), and Vercel (web hosting). Data processing agreements are in place with each provider.
• Developer applications: Verification outcomes (pass/fail, trust score, verification level) are shared with the developer whose API key initiated the verification. The developer's privacy policy governs their use of this data.
• Law enforcement and regulators: Where required by applicable law, court order, or legitimate regulatory demand.

7. International Data Transfers

AfriVerify operates across multiple African jurisdictions and uses global cloud infrastructure. Where personal data is transferred outside the country of collection, we ensure appropriate safeguards are in place, including standard contractual clauses (SCCs), adequacy decisions, or binding corporate rules as applicable. For transfers involving EU data subjects, we comply with GDPR Chapter V requirements.

8. Data Retention

9. Security

We implement enterprise-grade security measures including: AES-256 encryption at rest for all biometric data; TLS 1.3 in transit; HMAC-SHA512 webhook signatures; scrypt password hashing; SOC 2-aligned access controls; automated security scanning via OrbitShield (our proprietary fraud detection layer); and independent penetration testing. We operate a coordinated vulnerability disclosure programme at security@sankofaapp.com.

In the event of a personal data breach that poses a risk to your rights, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, in accordance with our incident response procedures.

10. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: request a copy of personal data we hold about you
• Rectification: request correction of inaccurate data
• Erasure: request deletion of your data, subject to our legal retention obligations
• Restriction: request that we limit processing of your data
• Portability: receive your data in a structured, machine-readable format
• Objection: object to processing based on legitimate interests
• Withdraw consent: where processing is based on consent

To exercise your rights, contact privacy@sankofaapp.com. End-users may also manage their verified identity record at afriverify.sankofaapp.com/my-identity. We will respond within 30 days.

11. Cookies and Tracking

Our dashboard uses session cookies strictly necessary for authentication. We do not use third-party advertising cookies, cross-site tracking, or analytics services that share data with third parties. The landing page uses no cookies. Developer dashboards use a single first-party JWT stored in localStorage for session management.

12. Children's Privacy

Our Service is not directed to individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, contact us immediately at privacy@sankofaapp.com.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in law, our practices, or our services. Material changes will be communicated via email to registered developers at least 30 days before taking effect. The current version will always be available at afriverify.sankofaapp.com/privacy.

14. Contact Us