Effective date: [[EFFECTIVE DATE]] · Version: [[VERSION]]
This policy explains what happens to your information when you use CredCheck to check whether a product is genuine, report a concern, or earn and redeem rewards. It covers the CredCheck mobile app, the website at [[VERIFY DOMAIN, e.g. v.credcheck.app]], and our USSD, SMS and WhatsApp services.
Who we are
CredCheck is operated by [[LEGAL ENTITY NAME]] ("CredCheck", "we"), [[REGISTERED ADDRESS]], Lagos, Nigeria, registration number [[RC NUMBER]]. For the uses described here we are the data controller.
Our data protection officer: [[DPO NAME]], [[DPO EMAIL]], [[DPO POSTAL ADDRESS]].
The short version
- You don't need an account. The app creates a random device ID. We store only a scrambled (hashed) version of it.
- Each check is logged on our servers, with your approximate location worked out from your internet connection, so we can spot fake products and cloned codes. We keep the detailed log for up to 13 months.
- If you check by USSD, SMS or WhatsApp, we use your phone number to reply. We store a scrambled version of it with your checks.
- Precise location from your phone is only used if you turn it on when you report a concern.
- When you report a concern, the brand that makes the product sees your report, including any photos and location you add.
- We never sell your information.
What we collect and why
When you check a product
| Information | Where it comes from | Why |
|---|---|---|
| The code you scanned or typed, and the result | You | To give you a result and a receipt you can share (receipts expire after 24 hours) |
| Device ID (app), stored only as a hash | Created by the app and kept in your phone's secure storage | To spot cloned codes and abuse (for example the same code checked on many devices), limit repeated attempts, and link your rewards and notifications to your device |
| Phone number (USSD, SMS, WhatsApp), stored as a hash in check records | Your mobile network or WhatsApp | To reply to you, remember your language (for up to 180 days), limit repeated attempts and attribute rewards |
| IP address, stored only as a hash | Your connection | Security, rate limiting and abuse detection |
| Approximate location: country, city and approximate coordinates derived from your IP address by our network provider | Our network provider (Cloudflare) | To detect counterfeits appearing where a product was never shipped, and to show brands and regulators where fakes are found |
| Seller code, if you enter where you bought the product | You | To tell you whether the seller is authorised by the brand |
| Channel (app, web, USSD, SMS, WhatsApp) and time | Automatically | Service operation and statistics |
[[ENGINEERING TO CONFIRM before publishing: coordinates are coarsened (gap 7) and hashes are keyed (gap 3)]]
On the app, your scan history, saved reports, language and preferences are also kept on your phone (see the storage section below). Deleting the app removes them.
When you report a concern
| Information | Why |
|---|---|
| Report type and your description | To investigate the product and let the brand respond |
| Photos you attach. We strip hidden metadata (including GPS tags) and re-encode every photo before storing it. | Evidence for the brand and our trust team |
| Your location, only if you turn on "share location" for that report and allow it on your phone | To help the brand and authorities find where fakes are sold |
| The verification reference, if you report from a result | To link the report to the product, batch and code |
| Device ID or phone number (hashed) | To show you the status of your report, and to protect brands from fake or abusive reports |
When you use "Check the packaging" (beta)
If you add a photo of the packaging, we compare it with the brand's official reference images. To do this we may send your photo to an AI provider that works for us (see "Who we share with"). We clean the photo first. The result is advice only. It never changes your code verification result, and a person at the brand may review it. We keep the photo and result [[RETENTION PERIOD — CONFIRM]].
When you earn and redeem rewards
Some brands reward you for checking genuine products.
- Earning. Points are linked to your device ID (or phone number on USSD, SMS and WhatsApp). New points are held for a short time, currently 24 hours, before you can use them.
- Anti-abuse checks. We look at how many rewards a device earns and how many devices share the same network. If patterns suggest gaming, for example many devices on one connection, our systems may automatically hold or cancel pending points and pause rewards for that device. You can ask a person to review this decision (see "Your rights").
- Redeeming airtime. You give us a mobile number. We encrypt it, keep only the last 4 digits visible, and pass the number to our airtime provider to send the top-up. We keep redemption records for [[RETENTION PERIOD — CONFIRM, likely tied to financial record rules]].
The brand pays for rewards but does not receive your phone number or device ID. It sees totals only.
Push notifications (app)
If you turn on notifications, we store your device's push token (via Expo) with your hashed device ID. We use it to warn you if a product you checked is recalled, and to update you on your reports. Turn notifications off in the app or in your phone settings at any time.
Legal bases
| Purpose | Legal basis ([[COUNSEL TO CONFIRM]]) |
|---|---|
| Giving you a verification result, receipts and replies on USSD, SMS and WhatsApp | Necessary to provide the service you asked for (contract) |
| Logging checks, fraud and counterfeit detection, rate limiting, blocklists | Legitimate interests: protecting consumers and brands from counterfeits and keeping the service secure. Balanced against your interests by using hashed identifiers, limited retention and no advertising use. |
| Statistics for brands and aggregated dashboards for regulators | Legitimate interests (and public interest in product safety) |
| Precise location on reports, push notifications, packaging photos | Your consent. You can withdraw it at any time. Withdrawal does not affect earlier processing. |
| Recall alerts | Your consent (notifications). Also vital interests where a product is dangerous. |
| Rewards and airtime | Necessary to provide the rewards you asked for (contract), plus legitimate interests for anti-abuse checks |
| Keeping records required by law | Legal obligation |
Who we share with
- The brand whose product you checked or reported. It gets check statistics for its products, including city and country. For reports it also gets the description, photos, location (if you shared it), the report's status history, and a summary of how trustworthy the reporting device looks (counts only, never the identifier).
- Regulators (for example product safety agencies) get aggregated counts of suspected counterfeits by country, city and week. They do not get individual check records.
- Service providers who process data for us under contract: hosting (Hetzner, Germany), network and security (Cloudflare), messaging (Africa's Talking, Meta WhatsApp), push notifications (Expo), airtime (Africa's Talking), file storage (Cloudflare R2) and AI providers (Anthropic, OpenAI, Google), used only when the relevant feature is enabled. The current list is at [[SUBPROCESSORS URL]].
- Authorities, where the law requires it, or to protect people from harm or to investigate fraud.
- A buyer or successor if our business is sold or restructured, under the same protections.
We do not sell your information or use it for third-party advertising.
International transfers
Our servers are in Germany. Some service providers are in the United States or other countries. When your information leaves Nigeria (or your own country), we use safeguards the law recognises, such as contractual clauses [[COUNSEL TO CONFIRM mechanism]]. Contact our DPO for details.
How long we keep information
| Information | How long |
|---|---|
| Verification receipts | 24 hours |
| Detailed check records (hashed device, IP and phone, location) | 13 months, then moved to a secured archive for [[ARCHIVE PERIOD — CONFIRM]] and deleted. Aggregated statistics with no identifiers are kept longer. |
| Remembered language for USSD, SMS and WhatsApp | 180 days from your last use |
| Reports and photos | [[PERIOD — CONFIRM, e.g. 24 months after the report is closed]] |
| Packaging check photos | [[PERIOD — CONFIRM]] |
| Reward and redemption records | [[PERIOD — CONFIRM]] |
| Push tokens | Until you turn notifications off, uninstall, or the token stops working |
| Data request records | [[PERIOD — CONFIRM]] |
How we protect information
- Device IDs, phone numbers and IP addresses are stored as hashes in check records.
- Phone numbers for airtime are encrypted (AES-256-GCM).
- Photos are checked for file type, fully re-encoded (which removes metadata and hidden content) before storage, and served only through short-lived private links.
- All traffic is encrypted in transit.
- Staff access is limited by role and logged.
No system is perfectly secure. If a breach puts you at high risk, we will tell you and the regulator as the law requires.
Your rights
Depending on where you live (including under the Nigeria Data Protection Act 2023), you can:
- ask for a copy of your information
- correct it
- delete it
- restrict or object to processing, including processing based on legitimate interests
- withdraw consent
- ask for a person to review an automated decision, such as cancelled reward points
- receive your information in a portable format
- complain to a regulator, such as the Nigeria Data Protection Commission ([[NDPC CONTACT]]), or the authority in your country
How to ask: [[DSR CHANNEL — e.g. in-app "Privacy → Request my data", email DPO EMAIL, USSD menu option]].
Because we don't have accounts, we need to identify your data safely:
- App users: send the request from the app so we can match your device ID. [[ENGINEERING: build this, gap 5]]
- USSD, SMS and WhatsApp users: send the request from the same phone number.
We reply within [[30 DAYS — COUNSEL TO CONFIRM statutory period]].
Deleting your data unlinks your checks from your device or number and removes your reports' personal details, photos and location, your push registration, and your reward identifiers. We may keep limited records where the law requires it, for example financial records of airtime sent, or in backups until they expire.
Children
CredCheck is intended for people aged [[MINIMUM AGE — COUNSEL TO CONFIRM]] and over. Anyone can check a product on public channels without giving personal details. If you believe a child has given us personal information, contact us and we will delete it.
Storage on your device
The app stores the following on your phone. None of it is used for advertising or tracking.
| Item | Purpose |
|---|---|
| Device ID (secure keystore) | Identifies your installation to CredCheck without an account |
| Scan history, saved reports, queued offline checks | So you can see past results and your reports, and checks made offline are sent when you're back online |
| Language, onboarding status, notification and location preferences | Remember your choices |
The website stores only an offline copy of its own pages (a service worker cache), so it loads quickly and works on poor connections. It sets no tracking or advertising cookies. See cookie-consent-audit.md for the full list.
Changes
We will post changes here with a new effective date. If they are significant, we will tell you in the app or on the website before they apply.
Contact
[[LEGAL ENTITY NAME]] · [[DPO EMAIL]] · [[POSTAL ADDRESS]]