What we keep, and why.

Verify is operated by [Company legal name] (“we”, “us”). We provide a phone verification service: your server asks us to send a one-time code, the person types it into your app, and your server asks us to check it.

For the people who receive codes, the organisation that sends them (our customer) decides why their data is used. We process that data on the customer’s behalf and only to deliver and check codes.

Account data: your name, email address, a hash of your password, your two-factor settings, the organisations you belong to and your role in each.

Verification data: for each code, a keyed fingerprint (HMAC) of the phone number, the country, the channel used (WhatsApp or SMS), the status, the number of tries and the times. Raw phone numbers are never stored. We use the number only in memory, long enough to send the message.

WhatsApp connection data: the IDs of your WhatsApp Business account and phone number, and an access token from Meta. The token is encrypted with a key that is itself wrapped by Google Cloud KMS.

Audit logs: a record of important actions in the dashboard, such as connecting WhatsApp, creating or revoking API keys and changing settings, with who did it and when.

To send and check codes, to keep your account secure, to show you logs and usage, to enforce plan quotas and to stop fraud such as SMS pumping.

We do not sell personal data. We do not use it for advertising. We do not send marketing messages to the people who receive your codes.

Phone numbers are stored only as HMAC fingerprints, so a copy of our database does not reveal them.

Every organisation’s records are separated by row-level security in the database. One customer cannot read another customer’s data.

WhatsApp access tokens are encrypted, and the encryption keys are wrapped with Google Cloud KMS. Disconnecting WhatsApp deletes the token at once.

Sign-in sessions use httpOnly, secure cookies that scripts on the page cannot read. Owners and admins must turn on two-factor sign-in before sensitive actions. All traffic uses HTTPS.

We use a session cookie to keep you signed in and a language cookie to remember Arabic or English. Both are strictly necessary. We do not use advertising or cross-site tracking cookies.

Each organisation chooses how many days to keep verification records (the retention setting). After that, the records are deleted for good.

Account data is kept while your account is open. Audit logs are kept for [audit log retention period] so security events can be reviewed.

Requests made with a test key (starting with ov_test_) send nothing to anyone and accept the code 000000. Test verifications are not counted toward your plan.

We use a small number of service providers to run Verify: Meta (WhatsApp delivery from your own number), an SMS provider (fallback delivery), Google Cloud (key management), and our hosting, database and cache providers. They receive only what they need to do that job. A current list is available at [subprocessor list URL].

We may disclose data if the law requires it. We will tell the affected customer when we are allowed to.

You can see, correct or delete your account data, and you can ask us for a copy. Depending on where you live, you may have more rights under local law.

If you received a code from an app that uses Verify, contact that app first: it controls your data. We will help them answer you.

If we change this policy in a way that matters, we will tell account owners by email before the change takes effect.

Questions: [privacy contact email]. [Company legal name], [registered address].