velifiedHow we handle your information
Last updated 15 November 2026
The short version
- We don't ask for your name, ID number, phone number or email address.
- A face scan is biometric information, which POPIA treats as special personal information. We only process it with your consent.
- Your scan is encrypted on your phone, and stored and processed only in South Africa.
- We use it to test and improve our face checks, to pay rewards and to stop the same person claiming twice.
- We never sell it, publish it or share it with advertisers, and we delete it within 12 months.
- You can ask us to delete it at any time: privacy@velified.com.
1. Who we are
Velified is a contactless identity verification product of Muzmu (Pty) Ltd, a company registered in South Africa ("Muzmu", "we", "us"). Muzmu (Pty) Ltd is the responsible party for the personal information described in this notice, under the Protection of Personal Information Act, 2013 (POPIA).
Contact us about privacy at privacy@velified.com.
2. The pilot campaign face scan
Our pilot campaign at scan.velified.com asks adult volunteers (18 or older) to do a short face scan on their phone, in return for an OTT voucher. There are two kinds of scan:
- Normal scan: you look at your phone for a few seconds. We pay R5 for the first completed scan by each person.
- Attack scan: after a normal scan, you may try to fool our check with a photo, a screen, a mask or similar showing your own face. If it gets through and we confirm it was a genuine attempt, we pay R100.
Taking part is voluntary. You give your consent by ticking the box before the scan starts, and you can withdraw it at any time (section 8).
3. What we collect, and what we don't
| We collect | Details |
|---|---|
| Your face scan | A short video of your face from your phone's front camera, still images taken from it, and measurements our software makes from them (for example, a face template, which is a list of numbers used to recognise the same face again). |
| Phone and browser details | Such as the phone model, operating system and browser version, screen size, camera name and settings, language, time zone and connection type. These help us see how well the scan works on different phones. |
| Your IP address, scrambled | We keep only a one-way scrambled form of it, to limit how many scans can be started from one place and to stop abuse. |
| Reward records | Which voucher was issued for which scan, and its PIN. |
We don't collect your name, ID number, phone number, email address, location or contacts, and we don't use your phone's motion sensors or microphone.
Even without your name, a face scan can identify you, so we treat it as personal information and, because it is biometric, as special personal information under POPIA.
4. Why we use it
- To test and improve our face checks: measuring how well our liveness and face-matching software works, and training and testing new versions of it.
- To stop duplicate claims: we compare each new scan with earlier ones, so each person gets one normal-scan reward and can collect an attack reward on a later visit without giving any contact details.
- To pay rewards and keep a record of them.
- To review attack scans before paying the R100 reward.
- To keep the campaign secure and prevent fraud.
We process your scan on the basis of your consent (POPIA sections 11(1)(a) and 27(1)(a)). We do not use it for marketing, we do not use it to make decisions about you outside this campaign, and we do not check it against any government or third-party database.
5. Where it is kept and how it is protected
- Your scan is encrypted on your phone before it is sent. The web server stores it still encrypted; only our separate checking service can open it, and it does so in memory without saving an open copy.
- It is stored and processed on our servers in South Africa (Johannesburg). It is not sent to any foreign face-recognition service.
- Face templates are encrypted with a key that only our checking service holds.
- Access to the servers is limited to the people who run them, and every connection is encrypted.
6. Who can see it
- Normal scans are processed by software only. No person looks at them.
- Attack scans that get through our check may be viewed by a small number of Velified team members, to confirm the attempt was genuine before we pay.
- We never sell your information or share it with advertisers. We don't publish scans or use them in marketing.
- We may share information if the law requires us to, for example under a court order.
- Our hosting provider stores the encrypted data for us under contract, in South Africa, and cannot open it.
7. How long we keep it
We delete campaign scans, templates and phone details within 12 months of the scan. We keep reward records (without any face data) for as long as accounting law requires.
8. Your rights
Under POPIA you may:
- ask whether we hold information about you, and ask for a copy of it;
- ask us to correct or delete it;
- withdraw your consent at any time (this doesn't affect processing that already happened); and
- object to how we process it.
Email privacy@velified.com. Because we don't hold your name or contact details, we may ask you to do a short face scan so we can find your records; we use that scan only to answer your request.
If you're not happy with how we handled your request, you may complain to the Information Regulator (South Africa): inforegulator.org.za.
9. This website
velified.com doesn't use cookies, analytics or advertising trackers. Our web server keeps standard technical logs (such as IP address and pages requested) for up to 30 days to keep the site secure.
The scan page loads face-detection software from a public content network (jsDelivr) and Google's model store. Those downloads contain no information about you beyond a normal web request; the face guidance runs on your phone, and your scan is only ever sent to our servers.
10. Changes and contact
We'll update this notice if how we handle information changes, and show the date at the top. Questions: privacy@velified.com.