Privacy Notice

1. Who we are, and our roles

thibit is operated by NM Technology Services & Solutions (Grupo NMTSS), Beira, Sofala, Mozambique, under Xibo Labs.

For the personal data of people verified through the Service ("verifiees"), our customer — the organisation that requested the verification — is the data controller; thibit processes that data on the customer’s documented instructions. For integrator account data and website data, thibit acts as the controller.

2. Data we process

Verification data: identity-document images; selfie photos and liveness frames; data extracted from documents and entered in forms (name, date of birth, document numbers, nationality); assessment results and supporting evidence.

Technical data: IP address, device and browser metadata, timestamps, and request logs.

Account data: integrator name, email, OAuth identity (Google or GitHub), and organisation/project membership.

3. Purposes

We process data to deliver the verification assessment; for quality assurance and calibration during the pre-launch phase; for security and abuse prevention; for support; and to comply with legal obligations.

Customer data is not used to train third-party models, and thibit does not sell personal data.

4. Storage and retention

Verification evidence (document images, selfie and liveness frames) is stored encrypted on AWS (Amazon S3) and deleted automatically after 60 days.

Assessment records and audit metadata may be kept longer for integrity and compliance purposes. Account data is retained while the account is active.

5. Subprocessors

We use the following subprocessors: AWS (hosting, storage, and model inference via Amazon Bedrock); Cloudflare (network and content delivery); Vercel (web frontends); and AWS SES (email delivery). We bind subprocessors to data-protection obligations consistent with this Notice.

6. International transfers

Data is processed in AWS’s us-east-1 (United States) region. Where cross-border transfer rules apply to you or your verifiees, we support our customers with appropriate safeguards.

7. Your rights

Subject to applicable law, you may request access to, correction of, or erasure of your personal data, or object to its processing.

If you were verified through thibit, contact the organisation that asked you to verify first — they control your data and decide on it. You can also reach us at legal@thibit.id and we will support your request with the controller.

8. Security

Technical and organisational measures protecting this data are summarised in our Security overview at thibit.id/security.

9. Changes

We may update this Notice from time to time; updates are posted on this page with a new "Last updated" date.

10. Contact

Privacy questions and requests: legal@thibit.id.