ProveIt

Legal

Privacy Policy

Last updated 27 July 2026

This Privacy Policy explains how Corenova Technologies Ltd ("we", "us", or "Corenova"), the operator of the Provelt platform ("Provelt", the "Service"), collects, uses, and protects personal information. Corenova Technologies Ltd is registered in Nigeria. For any privacy question, contact contact@corenovatechnology.com.

1. Data we collect

  • Account data: first and last name, email, phone, date of birth, username, password hash, chosen locale, account type (worker / employer / admin).
  • Identity verification: government-ID images (front / back), selfie image, on-device liveness metrics (blink count, head yaw, mouth-open amplitude, timing signals). Government-ID document numbers, when captured, are stored only as a one-way hash.
  • Work data: gigs and bounties you post, apply to, deliver, or are reviewed on; skill-quiz answers; badges earned; reviews given and received; safety reports.
  • Payments data: Stripe customer id, Stripe Connect account id, escrow / payout status. Full card numbers never touch our servers — Stripe handles them directly.
  • Technical data: IP address (stored only as a salted SHA-256 hash), device / browser user-agent, coarse geolocation derived from IP, an opaque device fingerprint hash used to remember trusted devices.

2. How we use your data

  • To create and secure your account and verify your identity.
  • To match workers with employers and process paid work end to end.
  • To move money in and out of escrow via Stripe (payment processor).
  • To fight fraud, deter spoofing, and enforce our Terms.
  • To comply with legal obligations, including AML / KYC where required.
  • To send transactional email / SMS (verification, notifications).

3. Legal bases (GDPR / NDPR)

We process personal data under one or more of these lawful bases: performance of the contract you enter with us; your explicit consent (e.g. camera access for liveness); our legitimate interests in fraud prevention and platform integrity; and compliance with legal obligations under Nigerian, EU, UK, and US law.

4. Sharing

We share personal data with the following categories of processors:

  • Stripe, Inc. — payments, Connect payouts, refund handling.
  • Sentry / Functional Software, Inc. — error monitoring (payloads are scrubbed of emails, phone numbers, and tokens before transmission).
  • Cloud infrastructure — Postgres database and object storage; data is encrypted in transit (TLS 1.2+) and at rest.

We never sell personal data. We never share ID documents, selfies, or address data with any employer, worker, or third party outside of the processors above and lawful government requests.

5. International transfers

Data may be processed outside Nigeria (including in the EU and US) by our processors listed above. Where required, transfers rely on Standard Contractual Clauses or equivalent safeguards.

6. Retention

  • Account data — for the life of the account plus 90 days after deletion.
  • Identity documents — up to 5 years to satisfy KYC / AML obligations.
  • Payment records — 7 years for tax and accounting compliance.
  • Audit logs — 2 years for security investigations.
  • Liveness metrics — 12 months after the last verification decision.

7. Your rights

Under GDPR, NDPR, and CCPA you have the right to access, correct, delete, restrict, or port your personal data, and to object to processing. You can exercise most of these directly from Dashboard → Danger zone (self-serve account deletion). For any other request write to contact@corenovatechnology.com — we respond within 30 days.

You may also lodge a complaint with the Nigeria Data Protection Commission (NDPC), your local EU supervisory authority, or the California Attorney General.

8. Security

All traffic runs over HTTPS with HSTS enforced. Passwords are hashed with bcrypt. Row-level security is enforced database-side. Sensitive columns (phone, date of birth, address, GPS coordinates, document paths) are readable only by the row owner. IP addresses are stored as salted hashes only. Liveness video frames stay on-device — only the final selfie image is uploaded.

9. Children

Provelt is not directed at children under 18. We do not knowingly collect personal data from anyone under 18; if we learn we have, we delete it.

10. Changes

Material changes to this policy will be announced by email and in-app at least 14 days before taking effect.

Contact: contact@corenovatechnology.com
Data controller: Corenova Technologies Ltd, Nigeria.