Privacy Policy

Operator: Tunnel Light Global Concept Ltd ("we", "us"), operating the Verify platform on behalf of participating brands ("tenants").

What we collect

• Scan data. When you scan a product's QR code we record the code scanned, the verification outcome, an approximate location derived from your IP address, and coarse device/browser information. Your IP address is cryptographically hashed at the moment it is received — we never store it in readable form.
• Report data. If you report a suspected counterfeit, we collect the details you provide (description, photos) and, only if you choose to give it, a contact email or phone number so we can follow up with you.
• Tenant account data. Brands and their staff who use the console provide business, contact, and identity-verification information.

Why we collect it (lawful basis)

We process scan data under legitimate interest: detecting and deterring counterfeit goods protects consumers and the brands we serve, and this interest is not overridden by your privacy rights because the data is minimised (IP hashed on arrival, precise location never stored) and kept only as long as documented in our retention schedule. Report data you submit is processed on the basis of your consent, which you may withdraw at any time. Tenant account data is processed to perform our contract with the tenant.

How long we keep it

See docs/compliance/retention-schedule.md. In summary: scan verdicts, tiers, and country are kept indefinitely as anti-counterfeit evidence; city-level location and device details are deleted after 180 days; report photos are deleted after 2 years unless subject to a legal hold.

Your rights

Under the Nigeria Data Protection Act (NDPA) and, where applicable, the UK GDPR, you may request a copy of your data or its deletion. See our Data Subject Access Request process, available from any report reference, or contact us at [email protected] (placeholder — see docs/compliance/data-map.md for the live contact and NDPC/ICO registration status).

Subprocessors

We use a small number of subprocessors to operate the platform. The current list is published at /legal/subprocessors.

Changes to this policy

Material changes are versioned; the version and publication date are shown at the top of the rendered page, and previous versions remain available.