KYC & Vendor Verification Policy

1. Introduction

Makeatask uses Dojah for identity verification. You can post tasks, send offers, chat, and list services without identity verification. Verify your identity through Dojah before paying to accept an offer or withdrawing funds. This policy explains the verification process and how we handle identity data.

2. Scope

• KYC applies to every individual user of Makeatask, including both Task Posters and Service Providers.
• You can post tasks, send offers, chat, and list services without identity verification. Verify your identity through Dojah before paying to accept an offer or withdrawing funds.
• Makeatask does not currently support business or organisational accounts. Where this changes, an enhanced verification process will apply.

3. Data We Collect for Verification

During KYC we collect the following data and pass it to our licensed verification partner for checking against authoritative Nigerian databases:

• Full legal name (first name, middle name, last name) as it appears on a government-issued ID.
• Date of birth.
• Gender.
• Phone number supplied during account setup or verification.
• Email address, verified by one-time-passcode before KYC starts.
• Residential address.
• Government-issued identity number — either a National Identification Number (NIN) or a Bank Verification Number (BVN).
• Document type and document number (e.g. NIN, driver’s licence, international passport, voter card) where relevant.
• A live selfie image used for face-match and liveness against the photo held on the identity record.

4. Verification Partner

We use Dojah (https://dojah.io) — a Nigerian identity verification provider — to validate identity data, run face-match against NIN/BVN, and perform liveness on the selfie. Dojah is contracted under a written data-processing agreement and is only authorised to use the data we send for the verification request we initiated. We do not share the data with any other identity provider.

5. Step-by-Step Verification Flow

• Email verification: the user enters an email and confirms it with a one-time code we send to that address. Unverified emails cannot proceed to KYC.
• Contact details: provide your phone number during setup and follow any checks requested in the verification flow.
• Personal details capture: the user enters their full legal name, date of birth, gender, and residential address inside the app.
• ID submission: the user enters their NIN or BVN and selects the document type they will rely on.
• Liveness selfie: the user records a live selfie inside the app. The capture is recorded with anti-spoofing controls (motion check, lighting check) and is not allowed to be a pre-existing photo from the device’s gallery.
• Match and check: we send the captured data to Dojah, which validates the identity number against the official Nigerian databases and runs a face-match between the live selfie and the photo held on the identity record. We also store a hash of the document image to detect re-use of the same document across multiple accounts.
• Outcome: the user is marked as verified, pending review, or rejected (see “Outcomes and Retries” below).
• Final review: where any field comes back inconclusive — for example the NIN exists but the face-match score is borderline — the case is escalated to our internal Trust & Safety team for manual review before the user is allowed to transact.

6. Outcomes and Retries

• Verified: the user can pay to accept an offer and withdraw available funds. Posting, offers, chat, and service listings do not require KYC.
• Pending review: where the case is borderline, it is escalated to our Trust & Safety team for human review. The user is told the case is in review.
• Rejected: where the data does not match or the liveness check fails, the user is told their attempt failed. The user can correct the data and retry while attempts remain. A maximum of four (4) unsuccessful attempts is allowed.
• Suspended after repeated failure: after the fourth failed attempt the user’s account is suspended and they must contact support@makeatask.com to re-open the case. This is to prevent brute-force attempts using stolen identity documents.

7. What Verification Confirms

A successful KYC confirms that (a) the identity number provided exists on the official Nigerian identity database, (b) the personal details the user gave us match that record, and (c) the live selfie matches the photo held against that record at the moment of capture. KYC does not vet a user’s skills, professional licences, or background. Where a task requires a regulated licence (medical, legal, electrical, etc.) the relevant Provider is responsible for holding and producing it; we deal with claims of unlicensed practice through our Acceptable Use Policy and dispute process.

8. Ongoing Monitoring

After verification, we may review account activity and request further checks where needed:

• Behavioural signals: we flag unusual login locations, sudden changes in payout bank accounts, rapid wallet movements that look like layering, and bursts of cancellations.
• Device signals: we tie sessions to device identifiers and flag when a verified identity suddenly switches device or appears across many accounts.
• Transaction signals: we monitor for self-dealing (Poster and Provider operating from the same device, IP, or bank), wash-trades, and clusters of fake reviews.
• Re-verification: we may ask a user to re-run KYC at any time, particularly after a flagged event or a long period of inactivity. The user cannot transact until re-verification completes.
• Sanctions screening: we screen against publicly available sanctions and PEP lists where relevant, and refuse accounts that match.

9. How We Handle KYC Data

• KYC data is collected, transmitted, and stored using encryption in transit (TLS) and encryption at rest for sensitive fields.
• Access to KYC records is restricted to authorised members of our Trust & Safety, fraud-operations, and engineering teams, on a need-to-know basis, and is audit-logged.
• KYC outcomes are persisted in our backend (verification status, reference identifier, document hash, timestamps). We do not store full payment-card numbers; those are handled by our regulated payments partner.
• KYC data is retained for the life of the account and for the period required by Nigerian financial-services and anti-money-laundering law after account closure.
• We do not sell or rent KYC data. We share it only with our verification partner (to run the check), with our payments partner (to satisfy their own KYC obligations), with cloud-infrastructure providers we use to run the platform, and with regulators or law enforcement where we are legally required to disclose.

10. Your Rights Over KYC Data

Subject to the limits of Nigerian financial-services and anti-money-laundering law, you can ask for a copy of the KYC data we hold about you, ask us to correct inaccurate fields, or ask us to delete your account. Where the law requires us to keep certain records for a defined period, we will retain only that subset and delete the rest. Requests can be made to privacy@makeatask.com. Our full position on data handling and your data-subject rights is described in the Privacy Policy.

11. Changes to This Policy

We may update this Policy when Nigerian regulation or our verification stack changes. Material changes are communicated in the app, by email, or both, and the “Last updated” date above is moved.

12. Contact

Questions about a specific KYC outcome should be raised through the in-app help flow so the support ticket is linked to your verification case. General questions about this Policy can be sent to safety@makeatask.com.