Privacy Policy

1. Introduction

Welcome to Witness, a media verification service operated by Beck-AI ("we," "us," or "our"). This Privacy Policy explains how we collect, use, and protect your information when you use our mobile application and web portal (the "Service").

Witness is designed with privacy first: Your photos and videos never leave your phone. We only collect small digital fingerprints to enable verification, not your actual media files.

By using Witness, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Verification Data (Automatically Collected)

When you capture media with Witness, we collect verification data that proves the media is authentic:

• Digital Fingerprint: A unique identifier for your media (like a fingerprint)
• Verification Signature: A digital signature created by your phone's security chip
• Timestamp: When the media was captured
• Media Type: Whether it's a photo or video
• Record ID: A short code (8 characters) to identify the signature

Important: We do NOT collect your actual photos or videos. Only the verification data is uploaded to our servers.

2.2 Optional Location Data (Your Choice)

Location is turned OFF by default for your privacy. If you choose to turn it on:

• GPS Coordinates: Where the media was captured
• Location Display: Human-readable address (e.g., "Lagos, Nigeria")

You control how much location detail to show:

• State only (e.g., "Lagos State")
• City and state (e.g., "Ibadan, Oyo State")
• Street, city, and state (e.g., "Allen Avenue, Ikeja, Lagos")
• Exact GPS coordinates

You can turn location on or off anytime in the app settings. Location data is stored on your phone and only uploaded if you enable "Upload Location."

2.3 Device Information

When you first use Witness, we collect basic device information:

• Device Model: Your phone's make and model (e.g., "Samsung Galaxy A52")
• Security Features: Whether your phone has advanced security hardware

We do NOT collect your phone number, IMEI, or personal identifiers.

2.4 Web Portal Usage

When you verify media through our website (witness.beck-ai.com):

• Uploaded Files: Processed temporarily in memory, then immediately deleted (never stored)
• Social Media Links: If you verify a video from TikTok/Instagram/WhatsApp, we download it temporarily for verification, then delete it
• IP Address: Logged automatically by our hosting provider for 30 days (for security)

2.5 What We Do NOT Collect

• Your photos or videos (only verification data)
• Email addresses, phone numbers, or user accounts
• Browsing history or cookies
• Your contacts or messages
• Audio recordings (unless you record a video with audio)

3. How We Use Your Information

3.1 Media Verification

We use verification data to:

• Check if uploaded media was originally captured with Witness
• Detect if the media has been edited or tampered with
• Show when and where (if enabled) the media was captured

3.2 Blockchain Timestamping

We periodically record verification data on the Bitcoin blockchain. This creates a permanent timestamp that proves when your media was captured. This cannot be faked or changed later.

3.3 Service Improvement

• Count total verifications (for statistics on our website)
• Prevent spam and abuse
• Fix bugs and improve performance

We do NOT use your data for advertising or marketing.

4. Data Sharing

4.1 Service Providers

We share data with these trusted partners:

• Supabase (Database): Stores verification data securely with encryption
• Vercel/Railway (Web Hosting): Hosts our verification website
• Bitcoin Blockchain: Public ledger for permanent timestamps (only encrypted fingerprints, not your media)

All service providers are required to protect your data and only use it for providing the Witness service.

4.2 Legal Requirements

We may share information if required by Nigerian law or to:

• Comply with court orders or legal process
• Protect our rights or safety
• Prevent illegal activities

4.3 We Never Sell Your Data

We will never sell, rent, or trade your personal information to third parties for marketing. Ever.

5. Your Privacy Rights

5.1 Nigerian Data Protection Rights (NDPR)

Under the Nigeria Data Protection Regulation (NDPR) 2019, you have the right to:

• Access: Request a copy of your verification data
• Correction: Fix inaccurate information
• Deletion: Request deletion of your verification data (see limitations below)
• Objection: Object to how we process your data
• Withdraw Consent: Turn off location sharing anytime

To exercise these rights, email privacy@beck-ai.com with your Record ID or device information.

5.2 International Users

If you live outside Nigeria, you may have similar rights under GDPR (Europe), CCPA (California), or local privacy laws. Contact us to exercise these rights.

6. Data Storage and Deletion

6.1 How Long We Keep Data

We keep verification data indefinitely by default because:

• Media may need verification years after it was captured (e.g., for journalism, legal evidence)
• Blockchain timestamps are permanent and cannot be removed

6.2 What Happens When You Request Deletion

If you request deletion:

• ✅ We delete: Verification data from our database, device information, and location data
• ⚠️ We cannot delete: Blockchain timestamps (Bitcoin blockchain is permanent)

After deletion, verification of your media will fail with "Not recorded with Witness."

6.3 Automatic Deletion

• Uploaded files (during verification): Deleted within seconds
• IP address logs: Deleted after 30 days

7. Security

We protect your data using:

• Encryption: All data is encrypted during transmission and storage
• Hardware Security: Your phone's built-in security chip protects verification keys
• Secure Servers: Our database is protected with access controls
• No Passwords: No user accounts means no password breaches

However, no system is 100% secure. If your phone is lost or stolen, contact us immediately.

8. International Data Transfers

Our servers are located in the United States. When you use Witness from Nigeria or other countries, your data is transferred to and stored in the US.

By using Witness, you consent to this transfer. We ensure your data is protected according to international standards.

9. Children's Privacy

Witness is not for children under 13 years old. We do not knowingly collect information from children.

If you are a parent and believe your child has used Witness, contact us at privacy@beck-ai.com. We will delete their information.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted here with a new "Last Updated" date.

Important changes will be announced through:

• Notification in the Witness app
• Banner on our website

Continuing to use Witness after changes means you accept the updated policy.

11. Partner Organizations: Additional Privacy Terms

This section applies to news organizations and media partners who register for and use the Witness Partner Dashboard. By completing the partnership application, Partner Organizations agree to these additional privacy obligations.

11.1 Information We Collect from Partners

When an organization registers as a Witness partner, we collect:

• Organization Name and Slug: Public-facing identifiers for your newsroom
• Contact Email: Used for partnership coordination and account setup
• Logo URL: Displayed in the dashboard and to submitters (optional)
• Team Member Accounts: Email addresses and authentication credentials for dashboard users
• Review Activity: Records of submission decisions (approved, rejected, flagged) and associated review notes, logged in an audit trail for accountability

11.2 Submitter Data Accessed by Partners

When Witness users (eyewitnesses) submit media to a Partner Organization, Partners receive:

• The submitted media file (available for 3 days)
• Cryptographic verification data (content hash, digital signature, device public key)
• Capture metadata (timestamp, GPS location if provided by submitter)
• Optional contact information if the submitter consented to being contacted (email, phone)
• An optional text note from the submitter

Partners are data processors of submitter data. By accepting a submission, you assume responsibility for handling it in compliance with applicable privacy laws (GDPR, NDPR, or other relevant regulation). You must:

• Use submitter contact information only to correspond about the specific submission it was provided for
• Not add submitters to marketing lists or contact them for unrelated purposes
• Delete submitter contact details when they are no longer needed for editorial purposes
• Not share submitter identities with third parties without the submitter's explicit consent

11.3 How We Use Partner Data

Beck-AI uses data collected from Partner Organizations to:

• Operate and display the Partner Dashboard
• Authenticate dashboard users
• Maintain audit logs of submission review decisions for integrity and accountability
• Send account setup emails and partnership-related notifications
• Investigate complaints or reports of policy violations

We do not use Partner organization data for advertising or share it with third parties outside of our service providers listed in Section 4.

11.4 Audit Logs

All submission review actions taken by Partner team members (status changes, review notes) are recorded in a tamper-evident audit log. This log is visible to all members of the Partner Organization within the dashboard and is retained by Beck-AI for the duration of the partnership and for 12 months thereafter. Audit logs may be disclosed to law enforcement or courts if required by law.

11.5 Partner Account Deletion

Upon termination of a partnership, Partners may request deletion of their organization data by contacting privacy@beck-ai.com. We will:

• ✅ Delete organization profile, team member accounts, and associated login credentials
• ✅ Remove the organization from the submitter-facing search directory
• ⚠️ Retain audit logs for 12 months as described in Section 11.4
• ⚠️ Retain submission records (without media files) in accordance with our standard data retention policy

12. Contact Us

For questions or concerns about your privacy:

13. Regulatory Compliance

For Nigerian users: You can file complaints with the National Information Technology Development Agency (NITDA) if you believe we have violated NDPR.

NITDA Contact:
Website: nitda.gov.ng
Email: info@nitda.gov.ng