Privacy notice and terms
How Mefa handles personal data, and the terms under which the API and dashboard are provided. Sections marked for legal review are drafts and will be replaced with counsel-approved text before this page is relied on.
Draft status. This page is a structured skeleton prepared for legal review. It describes how the service is designed to operate; it is not yet a published policy. Placeholders are marked legal review.
Privacy notice
Last updated: October 2026 · Draft
Who we are
Mefa provides identity verification services to businesses through an API and a dashboard at app.mefa.co. The legal entity, registered address and data protection contact will be stated here. legal review
Our role
When a customer submits a verification, Mefa processes the subject's data on that customer's instructions and the customer is responsible for having a lawful basis, including the consent it records in the request. For account, billing, audit and website data, Mefa determines the purposes and means of processing. The precise controller and processor allocation will be confirmed in the customer agreement. legal review
What we process
- Verification subjects — identity numbers and the records returned for them, phone numbers, business registration and tax identifiers, bank account details, document numbers, and, for biometric products, selfie images and derived face templates.
- Customer accounts — names, work email addresses, authentication data, API key metadata, wallet transactions and usage.
- Audit records — for every register lookup: which customer and key asked, what was searched, which source answered, whether a record was found, and when.
- Website — this site sets no analytics or advertising cookies and collects no form data; email you send us is handled in our mailbox.
Consent on register checks
Every verification that touches a government register requires a consent record in the request stating that consent was granted, when, how and by which subject reference. Requests without it are refused. Customers are responsible for obtaining that consent from the data subject before submitting a check.
Where data is stored
Identity data, evidence and audit records are processed and stored in Nigeria. We do not transfer subject data outside Nigeria in the ordinary course of providing the service. Any exception, including sub-processors and their locations, will be listed here. legal review
Nigeria Data Protection Act
Mefa is designed to operate in alignment with the Nigeria Data Protection Act 2023 and the guidance of the Nigeria Data Protection Commission, including purpose limitation, data minimisation, defined retention, subject rights and breach notification. Registration status with the Commission and the outcome of our data protection impact assessment will be stated here. legal review
Retention
The service applies the following defaults. Customers with regulatory record-keeping obligations may configure longer retention for evidence within a hard ceiling. Final retention periods and the legal bases for them are subject to review. legal review
| Data | Default | Notes |
|---|---|---|
| Evidence images (selfies, documents) | 90 days | Per-customer override, ceiling five years |
| Face templates for enrolled subjects | Life of the enrolment | Removed by subject erasure |
| Register-lookup audit records | 7 years | Survive subject erasure; required by register agreements and financial record-keeping rules |
| Account and billing records | legal review | Statutory accounting retention |
Your rights as a data subject
If you are a person whose details were verified through Mefa, you may ask the business that ran the check which data it holds and request access, correction or erasure. Customers can erase a subject from Mefa through the API, which removes evidence images, templates and enrolments and returns a receipt; the record that a lookup took place is retained as the law requires. You may also contact us directly at [email protected] and we will route the request to the responsible customer or act on it ourselves where we are the controller. Complaints may be addressed to the Nigeria Data Protection Commission. legal review
Security
Data is encrypted in transit and at rest. API keys are stored only as hashes. Secret keys never need to reach a device because capture runs on short-lived session tokens. Vulnerability reports go to [email protected].
Changes
We will post changes to this notice on this page with a new "last updated" date and notify account holders of material changes by email.
Terms of service
Last updated: October 2026 · Draft skeleton legal review
1. Agreement
These terms govern access to the Mefa API, SDKs and dashboard ("the Services"). By creating an account or using the Services you accept them on behalf of your organisation. Where a signed customer agreement exists, it prevails.
2. Accounts and keys
You are responsible for the security of your secret keys and for all activity under your account. Secret keys must be kept on your servers; only publishable keys and session tokens may be shipped to devices or pages. Keys can be rotated and revoked from the dashboard.
3. Lawful use and consent
You may submit a verification only where you have a lawful basis to do so and have obtained the data subject's consent where required, and you must record that consent in the request. You must not use the Services to profile, surveil or discriminate against individuals unlawfully, or to look up people with whom you have no legitimate relationship.
4. Wallet and billing
The Services are prepaid. Each completed job is billed at the unit price published in the dashboard at the time of the request, whatever its decision. Jobs with status: failed and all HTTP errors are not billed. Test keys are never billed. Refund terms for unused balance are to be stated. legal review
5. Results are signals, not advice
Verification results reflect the records available from the relevant sources at the time of the request. They support your onboarding and risk decisions; they do not make them, and they are not legal, financial or regulatory advice.
6. Data protection
The parties' respective roles and obligations in respect of personal data are set out in the privacy notice above and in the data processing terms of the customer agreement. legal review
7. Availability and changes
Within API version 1 we add fields, enum values and endpoints without removing or repurposing existing ones. Breaking changes are released as a new version and both versions run in parallel for a published period. Service-level commitments, if any, are stated in the customer agreement. legal review
8. Liability
Limitations and exclusions of liability to be drafted by counsel. legal review
9. Suspension and termination
We may suspend keys or accounts used in breach of these terms, in particular for lookups without lawful basis. You may close your account at any time from the dashboard; audit records are retained as described above.
10. Governing law
These terms are governed by the laws of the Federal Republic of Nigeria. Dispute resolution and venue to be confirmed. legal review
Cookies
Last updated: October 2026
This website (mefa.co) sets no cookies and loads no analytics or advertising scripts. Fonts are loaded from Google Fonts, which receives your browser's request for the font files. The dashboard at app.mefa.co uses strictly necessary cookies and storage for authentication; its own notice applies there. If analytics are ever added to this site, a consent banner will be shown first and this section updated.