Privacy Policy

1. Introduction

Flash Drive Limited (RC: 1979256) operating as Vera.ng ("Vera", "we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy outlines how we collect, process, store, and share your data in compliance with the Nigeria Data Protection Regulation (NDPR) and other applicable privacy laws when you utilize our peer-to-peer escrow marketplace.

2. Data We Collect

To provide safe escrow services and fulfill our Anti-Money Laundering (AML) and Know Your Customer (KYC) regulatory obligations, we collect the following categories of data:

• Personal & Identity Information: Full legal name, verified email address, phone number, National Identification Number (NIN), date of birth, and facial liveness biometric scans.
• Financial Data: Wallet balances, bank account details for withdrawals, and payment card details (processed securely by our PCI-DSS compliant payment partners).
• Transaction & Communication Data: Escrow payment amounts, dispute resolution evidence, item listings, and all in-app chat communications between buyers, sellers, and Vera Support.
• Technical & Usage Data: IP address, device fingerprints, browser types, and geolocation data utilized exclusively for fraud prevention and risk assessment.

3. Age Restriction & Children's Privacy

Vera is a financial escrow platform strictly restricted to individuals who are eighteen (18) years of age or older. We do not knowingly collect, maintain, or solicit personal data from minors. If we discover that a user is under 18 and has bypassed our KYC verification, we will immediately freeze the account, refund any active escrows to the source, and delete the user’s personal data in accordance with the law.

4. How We Use Your Data

Your data is strictly utilized for the following core operational and legal purposes:

• To authenticate your identity and prevent fraudulent accounts from accessing the marketplace.
• To process escrow payments, securely hold funds, and execute wallet payouts.
• To arbitrate disputes between buyers and sellers utilizing chat logs and uploaded evidence.
• To comply with binding legal directives from the Central Bank of Nigeria (CBN), EFCC, and Nigerian Police Force.

5. Data Sharing & Third-Party Processors

Vera explicitly does not sell your personal data to advertisers. We share your data strictly with licensed infrastructure partners necessary to operate the platform:

• Identity Verification Partners (e.g., Dojah): As the Data Controller, we utilize licensed third-party data processors (such as Dojah) to securely ping the NIMC Database for biometric matching, facial liveness detection, and National Identity Number (NIN) verification on our behalf.
• Payment Processors (e.g., Paystack): For securing card payments, bank transfer resolution, and automated wallet disbursements.
• Law Enforcement & Regulators: We will disclose your identity, chat logs, and financial records if served with a valid subpoena, court order, or formal request from Nigerian judicial or regulatory authorities investigating fraud or money laundering.

6. International Data Transfers

To provide robust, highly available services, Vera utilizes global cloud infrastructure providers (such as Supabase, AWS, or Vercel). Consequently, your personal data may be transferred to, and stored on, servers located outside of Nigeria. By using our platform, you consent to these international data transfers, provided that Vera ensures these third-party cloud hosts comply with strict global data protection standards (such as GDPR) that offer adequate data security.

7. Cookies & Tracking Technologies

We use strictly necessary cookies, session tokens, and local storage mechanisms to keep your account securely logged in, prevent Cross-Site Request Forgery (CSRF) attacks, and remember your interface preferences (e.g., Dark Mode). We do not use invasive third-party marketing trackers. By continuing to use the platform, you consent to our use of these essential security and operational cookies.

8. Data Retention Policy

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy. However, to comply with Nigerian AML/CFT regulations and financial laws, we are legally mandated to retain all financial transaction logs, KYC documents, and dispute records for a minimum period of five (5) years after the closure of your account.

9. Data Security, Encryption & Breach Notification

Your sensitive identity information (NIN, bank account numbers, biometric data) is encrypted at rest using AES-256 bit encryption and transmitted over TLS 1.3 encrypted channels. Your complete 11-digit NIN is permanently masked (`********1234`) on our database and is never publicly visible. In the highly unlikely event of a severe data breach compromising personal information, Flash Drive Limited will notify the Nigerian Data Protection Commission (NDPC) and all affected users within 72 hours of becoming aware of the breach, in accordance with the NDPR.

10. Marketing Communications & Opt-Out

We may occasionally send you promotional emails or newsletters regarding new features. You maintain the absolute right to opt out of these marketing communications at any time by clicking the "Unsubscribe" link at the bottom of the email. However, you cannot opt out of critical operational communications, including OTPs, escrow transaction alerts, and security notices.

11. Your Privacy Rights

Under the NDPR, you possess the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of any inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your account and personal data, subject strictly to our mandatory 5-year financial data retention obligations under AML laws.
• Right to Restrict Processing: Request suspension of the processing of your personal data under certain scenarios.