1. About this staging service
This is the UnifyID staging service operated by VerifyNova Limited. It is used to test registration, verification and account features before production release. Identity providers perform real checks on real information; staging does not make a passport, face image or phone number fictional. Payments use test mode.
Use your own information and documents. Do not upload another person’s documents to test a feature. Test accounts and configuration may be reset; do not rely on this environment as your only copy of an identity record or for a live customer service.
2. What you consent to
With your explicit consent, AWS Rekognition checks that a live person is present and searches the face collection for an existing enrolment. Didit receives captured document and face images for document verification, liveness and face matching. A one-to-many search compares a new face against enrolled face templates to prevent duplicate accounts; it is not only a comparison with your document.
The results can lead to approval, refusal or manual review. A mistaken match or rejection can be challenged through [email protected]. Consent is recorded against the exact notice version with the time and relevant request evidence.
3. Where information is processed
The application, identity evidence and AWS face collection run in Ireland. Recovery backups may be held in Frankfurt, Germany. This is an international transfer for people in Nigeria, Ghana, South Africa and Kenya. Hosting in Europe is not, by itself, an adequacy decision for a transfer from your country.
Didit documents Ireland as its default verification processing location. Resend and Twilio also process information in the United States and use delivery and support subprocessors. Email and SMS delivery involves the recipient’s email provider or mobile network. Cloudflare handles incoming web traffic and security signals on its global network; this deployment does not provide country-restricted edge processing.
We use the applicable provider data-processing terms and transfer safeguards for these services. For sensitive-data transfers that require your consent, we ask for it before verification. You can decline and leave the test or contact [email protected]. Foreign laws and access rights may differ from your home country. A provider’s published policy is not a claim that a regulator has approved this deployment.
4. Retention and deletion
Our policy is to retain selected evidence from a successful verification for 90 days after the final decision; rejected evidence for 30 days after rejection; and abandoned verification evidence for 30 days after the last activity. An active case is not treated as abandoned. Temporary processing copies should be removed within 24 hours after processing.
Verified account attributes remain while needed for the active account. A face template is retained while needed for identity continuity and duplicate-account prevention, with necessity reviewed separately from the image-retention window. If the staging face index is lost after the source images expire, you may need to verify again.
Minimal application audit records are retained for seven years. Consent evidence is retained while relied on and for seven years after withdrawal or expiry. Generated personal downloads and staff report/export files have a 30-day policy; their underlying records have their own retention periods. Infrastructure log files have a one-year policy; AWS Config’s managed internal history remains seven years. Recovery backups roll off after 35 days.
A documented legal hold can preserve only the records it covers. On release, the original retention deadline applies. Erasure must also be reapplied if a backup is restored. The evidence and staff-export purge schedules are still being commissioned in staging: these are the adopted retention deadlines, not a claim that every automated deletion job has already been verified. Contact [email protected] for deletion or the current status of a specific record.
Provider-held copies require separate handling. Their retention and optional model-improvement settings have not all been independently verified for this staging account. We do not promise that deleting a UnifyID record automatically deletes every provider copy, or that all optional provider training has been disabled.
5. Declining and withdrawing
You can decline before capture and leave the test. This flow requires biometric verification and does not currently provide a separate non-biometric account-creation path. Contact [email protected] about accessibility, an alternative or a privacy request; contacting us is not a guarantee of verification.
After enrolment, contact us or use account closure to withdraw and request removal of the face template. The request may end the verified account because the template is used for identity continuity and duplicate prevention. Lawfully retained evidence and records under a documented hold are considered separately; withdrawal does not undo processing already lawfully completed.
Neither an application you connect nor another account holder receives your face template from UnifyID.
6. Contact and privacy requests
The controller is VerifyNova Limited, NO 65, FABIAN NWAORA STREET, EFAB METROPOLIS, KARSANA, ABUJA, Nigeria. Send privacy requests to [email protected], account questions to [email protected], security reports to [email protected], and legal notices to [email protected].
No Data Protection Officer has yet been appointed. The privacy mailbox handles requests while that appointment is being arranged. This does not remove any duty to appoint an officer or register with a regulator where required.