Privacy Notice

1. Who we are, and our roles

thibit is operated by Xibhongolowa, Lda., a private limited company registered in Mozambique (NUEL 101558517, NUIT 401292624), with its registered office at Rua Pero de Covilha, UC B, Casa n.º 355, 7.º Bairro Matacuane, Beira, Sofala, Mozambique.

For the personal data of people verified through the Service ("verifiees"), our customer — the organisation that requested the verification — is the data controller; thibit processes that data on the customer’s documented instructions. For integrator account data and website data, thibit acts as the controller.

2. Data we process

Verification data: images of identity documents and of the face, including biometric data; data extracted from documents and entered in forms (name, date of birth, document numbers, nationality); assessment results and supporting evidence.

Technical data: IP address, device and browser metadata, timestamps, and request logs.

Account data: integrator name, email, OAuth identity (Google or GitHub), and organisation/project membership.

3. Purposes

We process data to deliver the verification assessment; for security and abuse prevention; for support; and to comply with legal obligations.

Calibration uses only data from participants who consent to it in our friends-and-family test rounds on verifi.thibit.id.

Outside those rounds, a verifiee’s images are used only for that verification and its review, as the hosted onboarding tells them.

Customer data is not used to train third-party models, and thibit does not sell personal data.

4. Storage and retention

Verification evidence (images of identity documents and of the face) is stored in Amazon S3 in AWS’s us-east-1 (United States) region, encrypted at rest with Amazon S3 managed keys (SSE-S3). The evidence and the rest of each verification’s data are deleted automatically 90 days after the verification is created.

Audit metadata may be kept longer for integrity and compliance purposes. Account data is retained while the account is active.

5. Subprocessors

We use the following subprocessors: AWS (hosting, storage, and model inference via Amazon Bedrock); Cloudflare (network and content delivery); Vercel (web frontends); and AWS SES (email delivery). We bind subprocessors to data-protection obligations consistent with this Notice.

6. International transfers

Data is processed in AWS’s us-east-1 (United States) region. Where cross-border transfer rules apply to you or your verifiees, we support our customers with appropriate safeguards.

7. Your rights

Subject to applicable law, you may request access to, correction of, or erasure of your personal data, or object to its processing.

If you were verified through thibit, contact the organisation that asked you to verify first — they control your data and decide on it. You can also reach us at legal@thibit.id and we will support your request with the controller.

8. Security

Technical and organisational measures protecting this data are summarised in our Security overview at thibit.id/security.

9. Changes

We may update this Notice from time to time; updates are posted on this page with a new "Last updated" date.

10. Contact

Privacy questions and requests: legal@thibit.id.