Federal ID Your data and privacy
What OFIS holds about you, for how long, who can see it, and how to export it, delete it, or revoke a partner's access.
OFIS exists to say three things about a Federal ID: that it exists, what level it holds, and whether it is active. Everything it keeps serves those three statements and the review that earns a level. Nothing else is collected.
What OFIS holds
| Data | When | Kept for |
|---|---|---|
| Email address, display name, member state, country of origin | From registration | While your Federal ID exists |
| Date of birth | From registration or enrollment | While your Federal ID exists; stored, never returned to anyone |
| Phone number, confirmed over WhatsApp | At verification | While your Federal ID exists |
| Face video; photographs of an identity document and of you holding it | At verification (Level 1 and 3) | 90 days after the final decision, appeal included; encrypted at rest in a separate store |
| Face fingerprint (a numeric template, not an image) | After Level 1 | While your Federal ID exists; two years after a refusal for fraud |
| Document type, issuing country, a keyed hash of the document number; legal name and date of birth (Level 3 only) | At Level 3 | While your Federal ID exists; the name and date of birth encrypted |
| Consent records: which partner may read which attributes | When you approve a partner | Until you revoke them, or they expire |
| Membership entitlement: tier, valid-until date, which app granted it | When a community app reports it | While it is live, and afterwards as a record |
| Audit log: issuance, level changes, suspensions, decisions and their reasons, consents, partner lookups | Continuously | For the life of the Federal ID and a period after, still to be set, for accountability |
The full schedule, with the legal basis for each row, is the retention schedule.
Who can see it
- Partners see only what you consent to, attribute by attribute:
verified,verification_level,state_code,status,country,membership_tier. They can also look up, without consent, the non-personal status of a Federal ID they already hold: its level, status, state and membership tier. They never see your documents, video, photographs, phone number, email, name or date of birth. - Reviewers at OFIS see the evidence of a case they are reviewing, and the flagged signals, for as long as the case is open. They never see your evidence as a browsing matter.
- Nobody else. OFIS uses no third-party verification company. Infrastructure providers carry messages and store encrypted bytes; they do not judge identity and cannot read your media.
Your rights
- See and export. Your portal shows your Federal ID, its level and status, the partners you have approved, and your consent history. Write to privacy@federal.africa for a full export of what OFIS holds about you.
- Correct. Display name, country and member state can be changed from the portal; write to the same address for anything else.
- Revoke a partner. Open your consent dashboard in the portal and withdraw a partner’s access. The partner is told by webhook and cannot request assertions about you again until you approve them anew.
- Delete. Closing your Federal ID deletes your face fingerprint and any media still held. The audit log keeps the fact that an ID existed and was closed.
- Complain. grievance@federal.africa for how your case or your data was handled. You may also complain to the data-protection authority in your country.