Privacy Policy

Information you give us

• Your phone number, when you create an account. It is how you sign in and the only identifier your account requires. We do not ask for your name, your email address, your BVN or your bank details.
• Reports you file: whether you were the buyer or seller, the type of scam, the identifiers of the person you are reporting, and any notes you add.
• Evidence images you choose to attach to a report. These are optional.
• Your seller profile, if you create one: a handle and a display name you pick. A profile stays private until you switch it on.
• Disputes: if you file one, the name, contact details and statement you provide, plus any evidence you attach.

Information we collect automatically

• A device token — a random identifier our server generates and your browser stores. It exists so that each device gets its own fair share of free checks. It is not linked to your identity and carries no information about you; if you clear your browser storage it is simply gone.
• Your IP address, used to apply rate limits when no device token is present. It is held briefly in our rate-limiting cache and is not written to our database.
• How you first reached us: a campaign label from the link you clicked, and the website you came from. We keep only the host — facebook.com — and never the full address, because a full referring URL can contain a search you typed or the path of a private group.
• Aggregate counts of checks performed each day, broken down by the kind of check and its outcome. These are totals only and contain nothing about who ran them.

What we deliberately do not collect

Some of the most sensitive data a service like this could hold is data we chose not to keep. This is a design decision recorded in the code, not a policy we could quietly reverse.

• We do not record who checked whom. When you look up an account number we increase a counter against that account number. There is no field for your identity on that record, so no log exists of which people you have investigated.
• We do not store payment screenshots. When you submit a receipt for analysis we keep a mathematical fingerprint of the image and the details printed on it — the amount, the names, the account number, the reference. The picture itself is never written to our storage.
• We do not store the full address of pages that link to us.
• We do not use advertising trackers or third-party analytics cookies on our own site.

Information about other people

PeerVet holds identifiers — bank account numbers, phone numbers, wallet addresses, seller handles and account names — belonging to people who have never used PeerVet. This is unavoidable for a service whose purpose is warning one person about another, so here is exactly where it comes from and what limits we place on it.

Some of it comes from reports filed by traders who say they were defrauded. No report counts towards a rating until a person at PeerVet has reviewed it.

Some of it comes from public sources, such as posts on public Nigerian forums where people warn others about a specific account. Where we use these, we store a short neutral summary of what the post said, stripped of names, quotes and identifying detail. We keep the original link for our own audit and appeal purposes and never publish it, because linking directly to a named accuser's post republishes their accusation far more forcefully than a note that a public community raised a concern.

Information gathered from public sources can never, on its own, produce our strongest warning. A serious verdict requires reports from people who came to PeerVet and described what happened to them. This ceiling is enforced in our scoring code, not by policy alone.

If you have been reported

You can ask us to review any entry about you, whether or not you use PeerVet, and without creating an account. Use the dispute form at peervet.ng/dispute or write to hello@peervet.ng.

A person reviews every dispute. If a report is mistaken, made in bad faith, or cannot be supported, we remove it and its contribution to any rating disappears with it. We will tell you the outcome.

Why we are allowed to hold this

Under the Nigeria Data Protection Act 2023 we rely on two grounds. For your own account and the checks you run, we rely on performing the service you asked for. For information about reported identifiers, we rely on legitimate interest — specifically, the prevention of fraud against members of the public, which the Act recognises.

We have weighed that interest against the rights of the people named. The limits described in this policy are the result of that assessment: no republished accusations, no scraped-only serious verdicts, a free dispute route open to anyone, and human review before any report counts.

Who else sees your data

We do not sell data and we do not share it for advertising. We use a small number of service providers, and personal data reaches only these:

• KudiSMS and BulkSMS Nigeria — receive your phone number in order to deliver your sign-in code by text or voice call.
• OpenRouter — receives payment screenshots you submit for analysis, and public forum posts we analyse. It processes them to return a result and we do not permit them to be used for anything else.
• Cloudflare R2 — stores evidence images attached to reports and disputes. These are kept in a private bucket and are readable only through links that expire after five minutes.
• Meta Platforms — if you use our WhatsApp service, your messages pass through WhatsApp and are subject to Meta's own terms.
• Our hosting providers, which process requests in order to serve the site.

How long we keep things

• Sign-in codes: a few minutes, then they are deleted automatically.
• WhatsApp conversation progress: thirty minutes of inactivity, then discarded.
• Your account: until you ask us to delete it.
• Reports and the ratings built from them: for as long as they remain relevant to warning others, and permanently removed if a dispute succeeds.
• Receipt fingerprints: retained, because their entire value is recognising the same fake receipt when it reaches a different trader months later. They contain no image and are not linked to your account.

Your rights

Under the Nigeria Data Protection Act 2023 you may ask us for a copy of the data we hold about you, ask us to correct it, ask us to delete it, or object to how we are using it. Write to hello@peervet.ng and we will respond within 30 days.

Deleting your account removes your account and your link to any report you filed. Where a report has already contributed to warning others, we may retain it without your identity attached.

If you believe we have handled your data wrongly, you may complain to the Nigeria Data Protection Commission.

Security

Traffic to and from PeerVet is encrypted. Evidence images sit in a private bucket reachable only through short-lived links. Incoming WhatsApp messages are cryptographically verified so that no one can impersonate WhatsApp to our servers.

We will not claim our systems cannot be breached. If a breach affects your data, we will tell you and the Commission as the Act requires.

Children

PeerVet is not intended for anyone under 18, and we do not knowingly hold data about children.

Changes and contact

If we change this policy we will update the date at the top. Material changes will be announced in the product rather than made quietly.

Questions, requests and complaints: hello@peervet.ng. If you need a postal address for a formal notice, ask and we will provide one.