Privacy Policy — iVerify

1. Introduction

iVerify ("we", "our", "us") operates an identity verification service that helps Kenyan organisations check national ID details. This privacy policy explains how we handle personal data when you use our service, demo, or API.

We are committed to protecting your privacy in compliance with the Kenyan Data Protection Act, 2019 and applicable international standards.

2. Data We Collect

2.1 Identity Data

When you submit a Kenyan national ID number through our demo or API, we process that ID number along with any optional name you provide. We do not store raw ID numbers, names, or ages. Instead:

ID numbers are stored as HMAC-SHA-256 digests for lookup and AES-256-GCM encrypted ciphertext for verified results.
Names and ages returned by providers are also encrypted before storage.
Provider response bodies are never persisted.

2.2 Usage and Metadata

To protect our service and operate securely, we collect:

IP address — used for rate limiting and abuse detection.
Browser fingerprint — a combined client-side and server-side identifier derived from device characteristics, not cookies or localStorage alone.
User agent string — helps us understand browser compatibility and detect automated traffic.
Timestamps — recorded in UTC for all verification attempts and admin actions.

2.3 Account Data

If you sign in with Google, we store your Google ID, email, display name, and profile picture URL to manage your session and API key access. We do not access your Google account beyond authentication.

3. How We Use Your Data

Identity verification — to check the ID number against configured primary and fallback providers.
Caching — to avoid redundant provider lookups for recently verified IDs, within configured time limits.
Security — to enforce rate limits, detect abuse, and protect against automated misuse.
Administration — to audit admin panel access and manage API keys.
Service improvement — to analyse aggregate usage patterns and improve reliability.

4. Data Storage and Security

All sensitive data is encrypted at rest using AES-256-GCM.
Lookup keys use independent HMAC-SHA-256 digests.
Encryption and HMAC keys are kept separate and never logged.
Our database uses SQLite (local) or Turso libSQL (remote), both with encrypted fields.
Admin access is password-protected and fully audited with IP, fingerprint, and timestamp logging.
API communication uses HTTPS exclusively.

5. Data Retention

Verified results are cached for a configurable period and may be reused for subsequent lookups.
Negative cache entries expire after a configured NEGATIVE_CACHE_TTL period.
Demo visit records are retained for rate limiting and abuse analysis.
Admin audit logs are retained for security compliance.
You may request deletion of your account data by contacting us below.

6. Third-Party Services

We use the following third-party services, each with their own privacy policies:

Identity providers — primary and fallback verification services that process ID numbers. We do not share your data with providers beyond what is required for verification.
Google OAuth — used for authentication. Google's privacy policy governs their processing.
Cap.captcha — used for bot protection on the demo form.
FingerprintJS — used for client-side device identification.
Turso — database hosting for remote deployments.

7. Your Rights

Under the Kenyan Data Protection Act, you have the right to:

Request access to personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your account and associated data.
Object to processing of your personal data.
Withdraw consent at any time where processing is based on consent.

To exercise these rights, contact us at privacy@yourservice.com.

8. Children's Privacy

iVerify is not intended for use by children under 18. We do not knowingly collect personal data from children.

9. Changes to This Policy

We may update this privacy policy to reflect changes in our practices or legal requirements. Material changes will be posted on this page with an updated date.

10. Contact

For privacy-related inquiries, data subject requests, or concerns:

Email: privacy@yourservice.com
Website: iVerify