Last updated: 18 August 2026
How SafeTag handles your data, who can see it, and what happens if something goes wrong. SafeTag is operated by SafeTag Verify Limited, the data controller for everything described here. If your security or compliance team needs more than this page covers, ask us and we'll answer in writing.
A SafeTag page holds a business name, short code, logo, social handles, and the payment details that business chooses to publish. We hold the account owner's email, and optionally a phone number. We do not hold customer payment data, card details or transaction records — SafeTag never sits in a payment flow.
The application runs on managed cloud infrastructure with the database hosted in a managed Postgres service. Backups are managed by that provider. SafeTag is not a payment system participant or payment switch — it verifies accounts that businesses publish, it does not sit in any payment transaction flow. We can confirm the current region in writing on request, and arrange in-country data residency where a partner requires it.
SafeTag Verify Limited (RC 9842561, Lagos, Nigeria) processes personal data in line with the Nigeria Data Protection Act 2023, collecting only what the service needs. SafeTag never holds customer funds.
All traffic is served over HTTPS (TLS). Data is encrypted at rest by the hosting provider. On top of that, sensitive identifiers — bank account numbers, phone numbers, report contents and multi-factor secrets — are encrypted by SafeTag before they reach the database, so they are unreadable in a raw database export. Lookups use one-way hashes rather than plain values.
Access is row-level enforced: a business owner can only read and change their own records. SafeTag staff hold scoped internal roles (support, reviewer, super admin) and only super admins can change billing or system settings. Every staff action against a business — verification approvals, suspensions, status changes — is written to an append-only audit log that cannot be edited or deleted, including by us.
Owners get their own trail. The dashboard shows every change to their accounts and verifications, whether it came from them or from SafeTag, and a Download my data button exports everything we hold for that account as a JSON file — no support ticket, no waiting on us. Account numbers are masked to the last four digits in the export; the encrypted originals never leave our systems.
Data is kept for as long as the account is open. Deleting an account removes the business's pages, payment records and verification history. Audit and abuse records are retained in de-identified form for 12 months after the related account is deleted, then removed. Owners can start deletion from the dashboard or from Delete my data.
A badge on SafeTag means a specific check passed, not a general endorsement. Social handles are verified by a one-time code the owner publishes on that account. A bank account is only marked verified after a ₦200 transfer from that exact account is matched to a one-time reference — name matches alone are shown as a weaker signal, labelled as such.
Verification requests submitted during working hours are usually confirmed within 3–4 hours. If we miss four hours on a paid account, we credit that account automatically — the credit is applied without the customer having to ask. Abuse reports and impersonation claims are triaged the same working day.
If we become aware of a breach affecting personal data, we notify affected account owners and the Nigeria Data Protection Commission in line with NDPA 2023 timelines, with what happened, what data was involved and what we are doing about it. Security issues can be reported to support@safetag.ng — we do not pursue researchers who report in good faith and give us time to fix.
Region confirmation, subprocessor list, penetration-test posture, uptime history, data processing terms and integration scoping. Contact us and we'll respond with specifics.