Our Privacy Policy
Last Updated: September 2026
1. Introduction
This Privacy Policy explains how Trustify Market Limited (“Trustify”, “we”, “us”, or “our”) collects, uses, stores, shares, and protects your personal data when you use the Trustify mobile application (“App”) or any associated services.
This policy is intended to comply with the Nigeria Data Protection Act (NDPA) 2023 (which supersedes the 2019 NDPR) and other applicable Nigerian data protection laws.
By using Trustify, you consent to the practices described in this Privacy Policy.
2. Data Controller Information
| Field | Details |
|---|---|
| Data Controller | TRUSTIFY MARKET LIMITED |
| RC Number | 9425469 |
| Registered Address | NO. 23, NWAEGBEIGWE STREET, OBOSI, ANAMBRA STATE, NIGERIA |
| Contact Email | info@trustify.ng |
| Data Protection Officer (DPO) | Ifeanyi Zion Chidiebere |
3. Data We Collect and Why
3.1. Account Registration Data
Collected when you create an account.
| Data Field | How It’s Collected | Why We Collect It |
|---|---|---|
| Full Name (fullname) | You provide it at signup | Account identification |
| Email Address (email) | You provide it at signup | Account creation, email verification, communications |
| Email Verification Token | 4-digit code generated by us, stored temporarily in Redis (5-minute TTL) | Verifying your email address |
| Password | You set it after email verification; stored as a bcrypt hash — plaintext is never stored | Account authentication |
3.2. Profile Data
Collected when you update your profile — all optional unless stated.
| Data Field | How It’s Collected | Why We Collect It |
|---|---|---|
| Phone Number | You provide it in profile settings | Contact/verification purposes |
| Profile Photo | You upload it; stored in AWS S3 (eu-north-1 region) | Profile display |
| Default Address | You provide it | Delivery destination autofill |
| Pickup Address | You provide it | Receiving parcels default |
| Country | You provide it | Platform features and compliance |
| User Rating | Calculated from completed transactions | Displayed on public profile |
3.3. KYC / Identity Verification Data
Collected when you initiate identity or address verification.
KYC is processed by our third-party partner QoreID. The following data is transmitted to QoreID and the verification result (plus the full webhook payload from QoreID) is stored by Trustify.
Identity Verification:
| Document Type | Data Sent to QoreID |
|---|---|
| NIN | NIN number, first name, last name, middle name, date of birth, phone number, email, gender |
| Voter’s Card | VIN number, first name, last name, date of birth, gender |
| International Passport | Passport number, first name, last name, date of birth, gender |
Address Verification: Street address, LGA name, state name, city, nearest landmark, applicant first name, last name, and phone number.
What Trustify Stores:
- KYC session reference and session ID
- Verification event type, sub-type, status, match status
- Full raw JSON payload received from QoreID’s webhook (contains detailed verification results)
- Audit log of all KYC status changes (verified/revoked, timestamp, who acted)
- On your user record: whether identity is verified, whether address is verified, which document type was used, and the timestamp of verification
SDK-Based Verification (e.g., Workflow Mode): If you use QoreID’s SDK-based flow (face-liveness or multi-step workflow), your selfie/liveness video or image may be captured by the QoreID mobile SDK and processed on QoreID’s infrastructure. Trustify does not receive or store raw biometric images — only the verification result payload.
Rate Limits: Direct identity verification is limited to 3 attempts per hour per account to prevent misuse.
3.4. Financial Data
Bank Account (Withdrawal Accounts):
| Data Field | Stored By |
|---|---|
| Account number | Trustify database |
| Account name | Trustify database |
| Bank code | Trustify database |
| Bank name | Trustify database |
| Account type (savings/current/fixed) | Trustify database |
Bank account details are verified at the time of entry using the NUBs API service.
Payment Cards: Trustify does not collect, transmit, or store card numbers, expiry dates, or CVV at any point. All card payments are entered directly into Paystack’s own secure, PCI-DSS-compliant checkout — Trustify only ever receives a payment reference and status from Paystack, never the underlying card data.
Payment Transactions: Transaction records including amount (in kobo/smallest currency unit), payment reference, payment method, and transaction status are stored in Trustify’s database.
Disbursements: Seller payout records including amount, currency (default NGN), transfer code, status, and failure reason are stored.
3.5. Marketplace Activity Data
| Data | What’s Stored |
|---|---|
| Products listed | Name, description, categories, prices, inventory, image URLs, seller ID |
| Cart items | Product, quantity, seller ID |
| Wishlists | Product IDs, user ID |
| Orders | Order number, items (as JSON), amount, delivery info, buyer/seller confirmation status, tracking details |
| Negotiations | Product, buyer, seller, original price, negotiated price, quantity, status |
| Reviews | Star rating, review text, reviewer ID |
| Search History | Search query text, timestamp, user ID |
3.6. Communications and Messaging Data
| Data | What’s Stored |
|---|---|
| Chat messages | Message text, sender ID, chat room ID, message type (text/offer/negotiation/agreement), offered price, read status, timestamps |
| Chat rooms | Buyer/seller IDs |
Chat message content may be reviewed by Trustify administrators in the course of investigating reports or disputes.
3.7. Reports and Disputes Data
When a report is filed, we store:
- Reporter and reported user IDs
- Reason and additional details you provide
- Linked negotiation, order, or transaction ID
- Report status history and admin notes
- Audit log of all actions taken on the report
3.8. Device and Technical Data
| Data | What’s Stored | Purpose |
|---|---|---|
| Firebase Cloud Messaging (FCM) device token | Trustify database | Sending push notifications |
| Device type (Android/iOS/web) | Trustify database | Platform-specific notification delivery |
| JWT access token | Client-side only; 24-hour expiry | API authentication |
| JWT refresh token | Redis (7-day expiry) | Token renewal |
| Email verification/password reset tokens | Redis (5-minute TTL) | One-time verification codes |
| Biometric public key | Trustify database | Biometric login verification |
| Biometric device ID | Trustify database | Binding biometric key to a device |
IP Addresses and Server Logs: Our server logs may capture IP addresses and request metadata as part of standard server operation.
3.9. Notification Preferences
We store your communication preferences:
- Order update notifications (on/off)
- Promotional notifications (on/off)
- Chat message notifications (on/off)
- Product insight notifications (on/off)
- Push notifications (on/off)
- Email notifications (on/off)
- SMS notifications (on/off — default: disabled)
4. How We Use Your Data
| Purpose | Legal Basis |
|---|---|
| Create and manage your account | Contractual necessity |
| Process payments and escrow | Contractual necessity |
| Disburse funds to sellers | Contractual necessity |
| Verify identity (KYC) | Legal obligation / Contractual necessity |
| Send transactional emails (verification, password reset, order updates) | Contractual necessity |
| Send push notifications | Consent (adjustable in preferences) |
| Investigate and resolve disputes and reports | Legitimate interest / Legal obligation |
| Prevent fraud and maintain platform security | Legitimate interest |
| Maintain audit logs (KYC, report actions) | Legal obligation / Legitimate interest |
| Improve platform features | Legitimate interest |
| Comply with regulatory and law enforcement requests | Legal obligation |
5. Data Storage and Security
5.1. Where Data Is Stored
- Primary database: PostgreSQL
- Cache / Session data: Redis (JWT tokens, verification codes)
- File storage: AWS S3 in the eu-north-1 (Stockholm, Sweden) AWS region
- Push notification routing: Google Firebase
Files stored in the AWS eu-north-1 region are held on servers outside Nigeria, which means some personal data is transferred internationally.
5.2. Security Measures
- Passwords stored as bcrypt hashes (never plaintext)
- JWT tokens signed with secret keys (configured via environment variables)
- KYC webhook payloads validated using HMAC signature verification before processing
- Rate limiting applied to sensitive endpoints (KYC verification: 3 requests/hour)
- Access to admin endpoints protected by role-based access controls
- All card payment data is handled exclusively by Paystack’s PCI-DSS-compliant infrastructure; Trustify’s own systems never receive or store raw card data
5.3. Data Retention
| Data Category | Retention |
|---|---|
| Active user account data | Until account deletion + soft-delete period |
| Soft-deleted accounts | Until permanently deleted by admin |
| KYC verification records | [TO BE SPECIFIED] |
| KYC audit logs | [TO BE SPECIFIED] |
| Transaction records | [TO BE SPECIFIED] |
| Chat messages | Until account deletion (cascade delete) |
| Search history | Until user clears it or account is deleted |
| Redis session data | JWT: 7 days; Verification codes: 5 minutes; Password reset codes: 5 minutes |
| Server logs | [TO BE SPECIFIED] |
6. Who We Share Your Data With
| Recipient | Data Shared | Purpose |
|---|---|---|
| QoreID | Name, date of birth, government ID number/type, address details (as applicable) | Identity and address verification |
| Paystack | Order amount, payment reference, user email | Payment processing (Paystack handles all card data directly — Trustify never receives it) |
| Solana Network | Transaction amount (on-chain — publicly visible) | Cryptocurrency payment verification |
| AWS (Amazon Web Services) | Profile photos and product images | File storage (S3, eu-north-1) |
| Google Firebase | Device FCM tokens, notification payloads | Push notifications |
| Gmail / SMTP (Resend API) | Email address, name, token | Transactional emails (verification, password reset) |
| NUBs API | Bank account number | Bank account name verification |
| Law Enforcement / Regulators | As required by applicable Nigerian law | Legal compliance |
| Trustify Administrators | All user data | Platform operations, dispute resolution |
We do not sell your personal data to third parties.
7. Cookies and Tracking
The Trustify App does not use browser cookies. The App uses:
- JWT tokens stored on the device for authentication
- Firebase device tokens stored server-side for push notifications
- Redis server-side cache for session tokens and verification codes (not on-device)
The Trustify App does not currently integrate any third-party analytics SDK (e.g., Google Analytics, Mixpanel). If this changes, this policy will be updated.
8. Your Rights Under the NDPA
Under the Nigeria Data Protection Act, you have the right to:
| Right | How to Exercise |
|---|---|
| Access — obtain a copy of your personal data | Email info@trustify.ng |
| Rectification — correct inaccurate data | Update profile in-app, or email us |
| Erasure — request deletion of your account and data | Use in-app account deletion, or email us |
| Portability — receive your data in a portable format | Email info@trustify.ng |
| Objection — object to processing based on legitimate interest | Email info@trustify.ng |
| Withdraw Consent — where processing is based on consent | Adjust notification preferences in-app, or email us |
| Restriction — restrict processing in certain circumstances | Email info@trustify.ng |
We will respond to data subject requests within 30 days.
9. Children’s Privacy
The Services are not directed to persons under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has registered, we will delete their account.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified via email and/or in-app push notification at least 14 days before taking effect. Your continued use of the App after the effective date constitutes acceptance.
11. How to Complain
If you believe your data privacy rights have been violated, you may lodge a complaint with:
Nigeria Data Protection Commission (NDPC)
Address/contact: [TO BE CONFIRMED — per NDPC’s official site]
Website: ndpc.gov.ng
12. Contact Us
For privacy-related queries:
Email: info@trustify.ng
Address: NO. 23, NWAEGBEIGWE STREET, OBOSI, ANAMBRA STATE, NIGERIA