Privacy Policy

1. Introduction

This Privacy Policy explains how Mobiverse Solutions Limited ("Mobiverse", "TrueFaktor", "we", "us", or "our") collects, uses, and shares personal information when you use TrueFaktor, our phone-based identity verification platform, whether through our website, our customer console/dashboard, or our API (together, the "Service").

Mobiverse Solutions Limited is registered in Ghana, with a registered office at P.O. Box LG265, Legon, Accra, and is registered as a data controller with Ghana's Data Protection Commission.

2. Who this policy covers, and who it doesn't

TrueFaktor is used in two different ways, and this policy covers both, but not identically:

• Customers, the people and businesses who sign up for a TrueFaktor account, create an "App", and use our API or dashboard to verify phone numbers. This policy fully covers customer account data.
• End users, the people a customer verifies through TrueFaktor (for example, a customer's own app user completing an OTP check). We generally have no direct relationship with end users and process their data on the customer's instructions, as described in Section 8. If you are an end user and have questions about a verification you received, please contact the business that asked you to verify, they are best placed to answer, and in most cases we cannot identify you without their help.

3. Information we collect

a. Information you give us directly

• Account information: name, email address, password, phone number, and optionally company name, when you register a customer account.
• Team members: if you invite others to your account, we collect their name, email, and the role/permissions you assign them.
• Billing information: billing name and contact details. We do not collect or store your card details, payments are processed by Paystack (see Section 9).
• Support communications: anything you send us when contacting support.

b. Verification data

When a customer uses TrueFaktor to verify someone, we process:

• The phone number (MSISDN) being verified.
• The channel used (SMS, Voice, USSD, Email, or WhatsApp).
• OTP codes, session identifiers, tracking IDs, and verification results (success/failure).
• Timestamps and metadata needed to route and bill the verification (call/message detail records).

We do not collect government-issued ID numbers, ID documents, facial images, voice recordings, or other biometric data as part of the verification flow. We do not use AI or automated decision-making to evaluate or score verifications.

c. Information collected automatically

• IP address, device type, browser type, and similar technical information when you use our website, console, or API.
• API and application logs generated as you integrate with and call our API.
• Security logs used to detect abuse and protect the Service.

d. Information from third parties

We receive confirmation and delivery status information from the messaging and telecom providers used to carry out verifications (see Section 9), and payment confirmation data from Paystack.

4. How we use information

• To provide the Service: creating and managing accounts, running verifications, routing messages through the correct channel, billing usage, and providing support.
• To keep the Service secure: detecting and preventing fraud, OTP/SMS-pumping abuse, and unauthorized access, and enforcing our Terms of Service.
• To communicate with you: service notices, security alerts, billing notices, and responses to your inquiries.
• To meet legal obligations: tax, accounting, and regulatory record-keeping, and responding to lawful requests from authorities.

We do not sell personal information, and we do not use verification data for advertising.

5. Our legal bases for processing

Where applicable law requires a legal basis (including the Ghana Data Protection Act, 2012 (Act 843) and, for individuals in the EEA/UK, the GDPR/UK GDPR), we rely on:

• Contract, processing needed to create your account and deliver the Service you signed up for.
• Legitimate interests, securing the Service, preventing fraud and abuse, and improving reliability, balanced against your rights.
• Legal obligation, record-keeping, tax, and responding to lawful requests.
• Consent, where we ask for it specifically, such as optional marketing communications.

6. Verification data: who controls it

Because TrueFaktor is a verification tool that businesses and individuals integrate into their own products, our role in the data varies by data type:

• For your account and billing data, Mobiverse is the controller: we decide why and how it's processed.
• For end-user verification data, our customer decides who gets verified and why, so we act as a service provider/processor, carrying out verification on their instructions.
• For a narrow set of purposes over that same verification data, detecting fraud and OTP abuse, keeping the Service secure, and billing usage, Mobiverse has its own independent interest and acts as a controller for those specific purposes only.

If you are a customer, you remain responsible for having a valid legal basis to ask us to verify your end users, and for your own privacy notice to them.

7. Cookies and similar technology

Our marketing website and console currently do not use analytics or advertising cookies. We use:

• Strictly necessary cookies, to keep you signed in and protect against cross-site request forgery.
• Google reCAPTCHA, on our contact form, to prevent spam and automated abuse. This sets a cookie and shares limited interaction data with Google, governed by Google's Privacy Policy.

If this changes, for example, if we add analytics, we will update this section.

8. How we share information

We share personal information only as described here:

• Delivery channels, same company: SMS and Voice messages are routed through MobiMessenger, and USSD sessions through Uzo, both Mobiverse Solutions Limited services [CONFIRM]. This is internal routing within the same legal entity, not sharing with an outside company.
• WhatsApp (Meta): verification messages sent via WhatsApp are delivered using Meta's WhatsApp Business API directly. Meta Platforms, Inc./Meta Platforms Ireland Ltd processes the message content and recipient number under its own terms and privacy policy.
• Email delivery: transactional email is sent via Google's SMTP infrastructure.
• Payments: Paystack processes payment transactions; we never receive or store your full card details.
• Hosting: our infrastructure is hosted with Linode.
• Legal and safety: where required by law, or where we believe in good faith it's necessary to investigate fraud, abuse, or a security incident, or to protect the rights, property, or safety of Mobiverse, our customers, or the public.
• Business transfers: if Mobiverse is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction, subject to this Policy or a successor policy notified to you.

Our infrastructure and delivery providers are bound by their own standard data-protection terms and policies as accepted when we contracted with them; we have not separately negotiated bespoke data processing agreements with each provider.

9. International data transfers

TrueFaktor started in Ghana and is expanding to serve customers and end users globally, including through WhatsApp delivery. As a result, personal information may be processed in Ghana and in other countries where our providers operate, including the United States and Ireland (Meta) and the region where our hosting infrastructure is located (currently Linode, region [CONFIRM]).

Where we transfer personal information out of the country where you are located, we rely on the transfer mechanisms and safeguards our providers make available under their own standard terms. We have not entered into bespoke Standard Contractual Clauses with each provider beyond what they offer as standard.

10. Data retention

We don't currently operate on fixed, published retention periods for every category of data. Instead, we keep personal information for as long as it's needed for the purpose it was collected, for example, for as long as your account is active, plus a reasonable period afterward for legal, security, billing, or dispute-resolution purposes, and then delete or anonymize it. If you'd like more detail about a specific type of data, contact us at the address in Section 17.

11. Data security

We take reasonable, appropriate measures to protect personal information, including:

• Encrypting data in transit using HTTPS/TLS.
• Restricting access to personal information to staff who need it to operate the Service.
• Individually issued, revocable API keys so customers can control and rotate their own credentials.

We're honest that no method of transmission or storage is 100% secure, and we can't guarantee absolute security. You're responsible for keeping your password and API keys confidential and for activity that occurs under your account, notify us immediately at the contact in Section 17 if you suspect unauthorized access.

12. If something goes wrong

If we become aware of a data breach that's likely to put your rights or freedoms at risk, we will notify affected customers and, where required by the Ghana Data Protection Act or other applicable law, the relevant regulator, without undue delay.

13. Your privacy rights

Subject to applicable law and some exceptions, you generally have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your information, unless we have a legal reason to keep it.
• Restrict or object to certain processing.
• Port your data to another provider, where technically feasible.
• Withdraw consent at any time, where processing is based on consent.

If you're in Ghana

These rights are provided under the Data Protection Act, 2012 (Act 843). You may also lodge a complaint with Ghana's Data Protection Commission if you believe we've mishandled your information.

If you're in the EEA or UK

You have the rights above under the GDPR/UK GDPR, and may lodge a complaint with your local supervisory authority (or the UK Information Commissioner's Office).

Everywhere else

We apply the same set of rights on a best-efforts basis to all users, regardless of location, even where not strictly required by local law.

To exercise any of these rights, contact us at support@truefaktor.com. We may need to verify your identity before acting on a request.

14. Children's privacy

TrueFaktor accounts are only for people who are at least 18 years old, or the age of legal majority in their jurisdiction if higher. We do not knowingly collect account information from anyone under 18. If you believe a child has created an account, contact us and we will take appropriate action.

If you're a customer using TrueFaktor to verify your own end users, you're responsible for ensuring you have a proper legal basis to process their data, including where an end user may be a minor.

15. Deleting your account

You can request account deletion by contacting support@truefaktor.com. We will delete or anonymize your account data, subject to what we're legally required or permitted to retain (for example, billing records for tax purposes, or logs relevant to an open security investigation).

16. Changes to this policy

We may update this Privacy Policy as our practices, technology, or applicable law changes. If we make a material change, we'll update the "Last updated" date above and, where appropriate, notify you directly. Continued use of the Service after an update means you accept the revised policy.

17. Contact us

Mobiverse Solutions Limited
P.O. Box LG265, Legon, Accra, Ghana
Phone: 0302908210
Email: support@truefaktor.com