Privacy Policy

Verify.ug is Uganda's Digital Trust Infrastructure. Institutions (universities, government agencies, hospitals, employers and other authorised organisations) use the platform to issue and verify credentials. Verify.ug never owns institutional records — each institution remains the data controller for the credentials it issues.

For account, billing, verification-portal usage and platform-security data, Citycom Digital Stars Limited acts as controller. When we process credential data on behalf of an institution, we act as processor under a Data Processing Agreement.

Personal data

• Account identifiers: name, email, hashed password, role.
• Authentication metadata: sign-in timestamps, IP address, user agent.
• Support communications and messages you send us.

Institutional data

• Organisation profile, branches, API keys and configuration.
• Team members, roles and permissions.
• Billing and subscription information.

Credential data

• Credential metadata (type, subject reference, issue and expiry dates).
• Verification identifiers, QR payloads and cryptographic signatures.
• Revocation and reissuance records.

Verification logs

• Timestamp, verifier context, outcome and confidence score.
• Truncated IP and coarse device information for abuse prevention.

AI processing

Our AI Trust Engine analyses credential and verification signals to produce authenticity scores, fraud risk indicators and duplicate-detection results. AI outputs are stored as structured events for auditability. We do not use customer or citizen data to train third-party foundation models.

We use strictly necessary cookies for authentication and security. Optional analytics or preference cookies, where used, are described in our Cookie Policy.

• Account data: retained while your account is active.
• Credential and verification records: retained by the issuing institution per their policy; we retain platform copies to enable verification and audit.
• Security and audit logs: retained for a rolling operational window sufficient to investigate incidents.
• Billing records: retained as required by applicable tax and accounting law.

Verify.ug operates on cloud infrastructure that may process data outside Uganda. Where this occurs, we use contractual and technical safeguards to protect the data. Contact us for the current list of sub-processors.

Depending on your jurisdiction, you may have rights to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion where applicable.
• Object to or restrict certain processing.
• Data portability where technically feasible.

For credentials issued by an institution, requests should generally be directed to that institution as the data controller.

Privacy questions and data subject requests: privacy@verify.ug.

We may update this policy from time to time. Material changes will be announced in-app or by email. The "Effective date" above reflects the current version.