Privacy policy

last updated · 28 July 2026

verza ("we", "us") is a South African verification API at verza.dev, operated as a sole proprietorship. This policy explains what personal information we process, why, who we share it with, and your rights under the Protection of Personal Information Act, 2013 (POPIA).

1. What we process

Identity and VAT numbers you submit for verification

This is verza's core function, and it is the one place we deliberately process the least. ID and VAT numbers submitted for validation are checked in memory and never stored, never written to a database, and never logged, not even in anonymised form. Access logs record the request path and HTTP status only; the value you're checking never reaches them. If you validate the same number twice, we have no record that you validated it once.

Payment data

• Pay-per-call (x402): paid endpoints settle in USDC on the Base blockchain via Coinbase's CDP facilitator. The paying wallet address, amount and transaction hash are public blockchain data, not something we collect privately. We don't request or receive any identity information beyond the wallet address.

Account and API key data (free key)

If you request a free API key: your email address and the key we issue you. There is no card, no billing record and no payment processor involved.

If you contact us

Your name, email address and message, sent to info@verza.dev.

Automatically

Server access logs record request path and HTTP status only. Never query strings, never request bodies, never the identifiers you're validating.

2. Why we process it

• Running the verification API. Legal basis: contract, since the check can't happen without processing the input, even transiently.
• Abuse and fraud prevention, such as telling scraper traffic from genuine buyers. Legal basis: legitimate interest.
• Communication: replying to messages sent to info@verza.dev.

We do not sell data or use it for advertising. verza runs no analytics and no tracking cookies of any kind, so there is nothing to opt out of.

3. Who we share with (sub-processors)

• Coinbase (CDP facilitator): settles x402 payments in USDC on Base. Receives the paying wallet address and amount, not identity data. Global infrastructure.
• Base (public blockchain): x402 payments settle here and are permanently, publicly visible, as with any blockchain payment. That's the nature of the payment rail, not a choice we make about your data.
• Cloudflare: DNS and edge proxy in front of verza.dev, and email routing for info@verza.dev.
• Google (Gmail): info@verza.dev forwards to a Gmail inbox for handling support requests.
• Our server: self-hosted infrastructure in Cape Town, South Africa.

We do not transfer personal information to any other party. If we add or change a sub-processor, we'll update this list.

4. Cookies and tracking

None. verza runs no analytics, no advertising pixels, and no tracking cookies for the API or the docs site.

5. Your rights under POPIA

• Access the personal information we hold about you, which for the verification API itself is essentially none beyond access logs.
• Correct inaccurate account information.
• Delete your account and associated data: email info@verza.dev and we'll action it within 30 days.
• Object to processing, or lodge a complaint with the Information Regulator of South Africa: inforegulator.org.za.

6. Data retention

• Identity and VAT numbers submitted for validation: never stored, so there's nothing to retain or delete.
• Access logs (path and status only): retained for as long as needed for service operation, metrics and abuse detection.
• API key account data: kept while your key is active, deleted within 30 days of a deletion request.
• Email correspondence: kept in our inbox unless you ask us to delete the thread.

7. International transfers

The Coinbase CDP facilitator and Base settlement run on global infrastructure outside South Africa. Where required by POPIA, these transfers are protected by contractual and legal safeguards equivalent to local protection.

8. Security

Identity and VAT numbers are validated in memory only and never touch disk. The server exposes nothing beyond what's needed to run the API, and since verification inputs are never persisted, there is no verification-data breach to notify.

9. Breach notification

If we discover a security breach affecting personal information we do hold (account or billing data), we will notify affected users and the Information Regulator of South Africa within 72 hours of becoming aware, as required by POPIA section 22.

10. Information Officer

Under POPIA section 55, the operator of verza serves as Information Officer and is contactable at info@verza.dev.

11. Changes

We will post a new "last updated" date at the top of this page when we change anything material.

12. Contact

Privacy questions or deletion requests: info@verza.dev.