Privacy Policy

1. Who this policy covers

This policy explains how the operator identified below handles personal information for Afnihi's website, client panel, shop catalogue, case assessments and authorized content-removal work. We decide how information is used for these activities. Platforms, payment services and independent escrow providers have their own responsibilities and privacy notices.

2. Information we collect

• Contact and account details: name, email, country, phone number where needed for authorization, client identifier and information about anyone you are authorized to represent.
• Case information: URLs, platform names, descriptions, evidence, ownership or representation documents, instructions, communications, filing responses and case status. Some material may concern other people or include sensitive personal information.
• Identity and authorization: identity-document images, a selfie with ID, verification decisions, signed declarations, typed names, uploaded handwritten signatures and existing drawn signatures, signature time, IP address, browser information and the signed authorization document.
• Orders and payments: agreed services, invoice amounts, currency, payment status and payment references you supply. This website does not collect card numbers or bank-login credentials.
• Website and security information: IP address, browser and device information, request and access records, cookies, verification results, rate-limit identifiers and performance measurements.

Information comes from you, your authorized representative, material or URLs submitted for review, public sources relevant to your case, and responses from platforms, hosts or service providers. Send only what is necessary. Do not upload unlawful material, other people's unrelated documents, passwords or authentication codes.

3. Why we use it

We use information to assess your request, verify identity and authority, provide agreed services, submit and follow up on notices, manage your account and invoices, communicate case updates, prevent misuse, maintain records, resolve complaints and meet legal obligations.

We use your browser's language preference and, where available, a country-only value supplied by Cloudflare to choose a website language. You can change it using the language selector. A manual choice lasts for the browser session unless you ask us to remember it for six months. Cookie settings record your choices for six months. We do not store your country or IP address in these preference cookies. Language does not determine your legal residence or which laws apply to your case.

The Journal accepts anonymous article likes without registration. A like receipt contains the article reference, time and keyed hash of a random browser token. It does not contain a name, email or raw IP address. We retain receipts and counts as reader feedback. Separate short-lived keyed IP/network rate counters help limit automated abuse. Search terms are used to find published articles and are not saved as reader submissions. The Journal does not accept reader text or provide public profiles or discussion threads.

Where the GDPR applies, the legal basis depends on the purpose: steps you request before a contract and performance of that contract; legal obligations where applicable; consent for optional processing; and legitimate interests such as securing the service, preventing false claims and handling disputes, balanced against your rights.

Sensitive information needs an additional lawful condition. Where required, we must obtain separate explicit consent or establish another applicable condition, such as processing necessary for legal claims, before handling that information. A general agreement to these policies does not replace that requirement. You may withdraw consent for future consent-based processing without affecting earlier lawful processing.

You can browse public pages without opening a case. If you do not provide information needed to verify your identity or authority, we may be unable to act for you. We do not use automated decisions to decide whether your content should be removed; platforms make their own decisions.

Where Canadian privacy law applies, we explain the relevant collection, uses, disclosures and meaningful consequences and obtain the consent required for them, including express consent for sensitive information where required. The GDPR legal bases above do not replace Canadian consent requirements.

4. Who receives information

Access is limited by role and task. Relevant information may be received by staff working on verification, cases, billing, support or security, and providers supporting the service:

• Cloudflare for website delivery, protection, Turnstile checks, country-only language defaults and private R2 file storage; MongoDB Atlas for database hosting; our application-hosting provider; and Resend for transactional email. Website fonts are hosted by Afnihi. Optional browser analytics and advertising scripts are not enabled.
• Persona if an identity check is offered through its hosted flow. Persona receives the information entered there; Afnihi receives a check reference and outcome and authorized verification staff may review the inquiry in Persona. Our normal file-deletion schedule does not describe Persona's separate retention.
• proxycheck.io for connection checks on account access and forms. We send your IP address to help identify VPNs, proxies and Tor connections, without sending your name, email, case details or uploaded files. These checks can restrict access automatically; contact support@afnihi.com if a detection looks wrong. Public information remains accessible. We keep short-lived classifications under keyed identifiers; the provider handles IP information under its privacy notice. Disabling its optional detection-log tagging does not eliminate all provider processing or retention.
• Platforms, search engines, hosts, registrars or other appropriate recipients when necessary to carry out the authorized request. A notice may disclose your name, authority, contact details and supporting information. Recipients may forward notices to the uploader or other affected parties, or retain or publish them under their own rules.
• Payment or escrow providers you choose, and professional advisers or public authorities where necessary for an applicable legal obligation, a dispute or protection against abuse.

Customer correspondence is held in your account. Internal Discord alerts contain only event types, internal references, times and protected console links, without customer messages or files. Use the website's upload flow for requested documents. We do not sell personal information or use case material for advertising or training AI models.

Relevant provider notices include Cloudflare, its Turnstile privacy addendum, MongoDB, Resend, Persona and Discord.

5. Retention, security and international processing

Identity files are scheduled for deletion 120 days after verification or case closure, whichever makes them eligible first. Evidence and supporting files are scheduled for deletion 120 days after case closure. Unsubmitted drafts expire after seven days. The Data Handling & Retention page explains the triggers, remaining records and backup limits.

We use access controls, private storage, encrypted file contents, encrypted network connections, staff authentication and access records. No system or transmission can be guaranteed secure. Authorized notices sent to third parties are subject to those recipients' controls.

Providers and notice recipients may process information in countries other than yours. Where applicable law requires a transfer safeguard, it must be in place before that transfer, such as an adequacy decision or appropriate contractual safeguards. Contact us for information about the safeguards relevant to your case.

Information processed outside Canada may be accessible to foreign courts, law enforcement or other authorities under their laws. We remain accountable for information outsourced to providers and must use appropriate contractual or other safeguards; we do not promise Canadian-only storage.

6. Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability, withdrawal of consent or objection to certain processing. You may also complain to the data-protection authority responsible for your location. These rights can have exceptions, including necessary legal or financial records and the rights of other people.

Email the contact below with your request and the email address or case reference associated with it. We may verify identity proportionately. Do not attach an identity document unless we request it through a suitable secure channel. We respond within applicable legal deadlines; for GDPR requests this is normally one month, with any permitted extension explained to you.

Our Privacy Contact, reached at the email below, handles privacy questions, access requests and complaints. Where PIPEDA applies, access requests normally receive a substantive response within 30 calendar days, subject to lawful extensions. You may also contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy commissioner.

Adults or authorized guardians must arrange cases involving a child. We do not invite children to submit identity documents or intimate material directly. If information about a child or another person was submitted without authority, contact us promptly.

7. Changes

We update the effective date when this policy changes and provide additional notice where required for a material change. A new policy does not by itself authorize a new use that requires your consent.