Privacy Policy
Last updated 14 September 2026
This Privacy Policy explains how Virvly Ltd (Virvly, we, us or our) collects and uses personal data through virvly.com, our web and mobile applications, and related services (the Platform).
The Platform enables photographers to upload photographs and enables photographed people, or a parent or legal guardian acting for a child, to locate, view and purchase photographs through a facial-matching search.
1. Who We Are
Virvly Ltd is a company registered in Nigeria under company number 8887413, with its registered address at Plot 1184, Extension Layout, Gwagwalada, Abuja, FCT, Nigeria.
Privacy enquiries and rights requests: privacy-policy@virvly.com
Data Protection Officer: dpo@virvly.com
Our principal data-protection framework is the Nigeria Data Protection Act 2023 (NDPA), together with the Nigeria Data Protection Act General Application and Implementation Directive 2025 and other applicable instruments issued by the Nigeria Data Protection Commission (NDPC). Other laws may apply where we offer services in another jurisdiction.
2. Our Role And Photographer Responsibilities
A photographer is responsible for deciding whom to photograph, the circumstances in which photographs are taken and which photographs are uploaded.
Before photographs are uploaded to a facial-matching gallery, the photographer must provide any required notice, obtain any permission or consent required for the photographs and associated facial processing, and respect lawful objections or removal requests. This includes obtaining consent from a parent or legal guardian where a child is photographed and the law requires it.
Virvly acts as a controller when it determines why and how personal data is used to operate the Platform, including for customer searches, facial matching, purchases, photographer accounts, payments and payouts, security, support and service analytics. Where Virvly stores or otherwise handles photographs solely on a photographer's documented instructions, Virvly may act as that photographer's processor.
If you ask us about a photograph controlled by a photographer, we may refer the request to them and will assist with the request where the law requires. We may also hide or remove content where necessary to protect individuals, comply with law or enforce our terms.
3. Personal Data We Collect
| Whose data | What we may collect |
|---|---|
| Customers and photographed people | Access code or link; email address or phone number used for a purchase, notification or support request; selfie or liveness video and facial-matching data used to retrieve photographs; where the retained “Find my photos & notify me” option is chosen, a retained facial template associated with the contact details and internal guest or session identifier used to provide the service; records of likely photo matches; purchase and download records; communications. |
| Photographers | Name, contact details, business and profile information, account credentials, verification status, payout information, pricing, sales and payout records, portfolio links, communications and uploaded photographs. |
| Photographs and metadata | Uploaded images and information associated with them, which may include date, time, camera information and location data. |
| Payment and verification | Payment status, transaction reference and limited payment details supplied by our payment provider. Identity, bank or verification information may be processed by a payment or verification provider and shared with us only as needed to confirm verification and make payouts. |
| Device and service use | IP address, device and browser information, approximate location derived from IP, access times, pages or functions used, diagnostic data, security events and cookie information. |
| Other people in photographs | A photograph may contain people who do not use Virvly. When a photographer publishes a listing, faces detected in uploaded photographs may be indexed for facial matching, and the resulting gallery face templates are retained for the active life of the listing (see Sections 5 and 8). |
4. How And Why We Use Personal Data
| Purpose | Legal basis |
|---|---|
| Provide the Platform, fulfil purchases, deliver photographs and make payouts | Performance of a contract or steps requested before entering one |
| Operate facial-matching search | Explicit consent from the adult submitting the selfie or liveness video (or from a parent or legal guardian for a child's selfie or liveness video). For other faces in a gallery: the lawful basis and sensitive-data condition established by the responsible photographer |
| Verify photographers and prevent fraud | Legal obligation where a specific obligation applies; otherwise our legitimate interests in protecting users and the Platform |
| Protect user sessions and photographer accounts, investigate misuse and maintain security | Our legitimate interests and, where applicable, legal obligation |
| Provide support and respond to requests | Performance of a contract, consent or our legitimate interests, depending on the request |
| Maintain transaction, tax and compliance records | Legal obligation and our legitimate interests in establishing and defending legal claims |
| Measure and improve the Platform | Our legitimate interests, using aggregated or de-identified information where reasonably possible; consent where required for non-essential cookies |
| Send marketing | Consent. You may opt out at any time |
5. Facial Matching
How matching works
Facial matching is the required method for retrieving photographs from a gallery. This prevents open browsing of photographs and limits each search to likely matches for the submitted face. An adult may submit their own current selfie or liveness video. A parent or legal guardian may submit a current selfie or liveness video of a child for whom they have legal authority, subject to the safeguards in Section 10.
Virvly uses a third-party facial-matching service to compare a submitted selfie or liveness video with faces detected in the relevant gallery. There are two search options. If you choose a one-time search, your selfie or liveness video is used only for that search and is not retained after the search completes. If you choose the “Find my photos & notify me” option, Virvly retains the facial template needed to identify likely matches in photographs added to that listing later. For this retained-search option, the submitted selfie or liveness video may be stored and the facial template is associated with the contact details and internal guest or session identifier used to provide the service until it is deleted in accordance with Section 8 or you request deletion. Virvly does not create a client account for this purpose and does not use a retained facial template to search unrelated galleries without the permissions required by law.
When a photographer publishes a listing, faces detected in uploaded photographs are indexed for facial matching. Those gallery face templates are retained for the active life of the listing so that one-time and retained searches can be matched against the gallery, and are removed in accordance with the listing and deletion rules described in Section 8. This processing may include faces of people who have not themselves used Virvly.
Only the person whose selfie or liveness video is submitted, or their parent or legal guardian where the person is a child, may initiate the search and receive the resulting matches. Other users are not permitted to search for that person's photographs, and photographers do not receive the person's selfie or liveness video, facial metrics or personal details. Facial matching can produce incorrect or incomplete results. A result is a search aid, not proof of identity. Please report an image that shows another person or an incorrect match to privacy-policy@virvly.com.
Consent and limits
Before submitting a selfie or liveness video, you will be asked for specific, affirmative consent to use it for the requested search. If the selfie or liveness video is of a child, the parent or legal guardian must give the confirmations described in Section 10. If you decline consent, you cannot use Virvly to search for, view or purchase photographs from the gallery. Withdrawing consent does not affect processing completed lawfully before withdrawal.
We do not use selfie or liveness videos or facial-matching data to:
- search without the permissions required by law;
- advertise to you or create marketing profiles;
- conduct surveillance or make decisions producing legal or similarly significant effects;
- sell or license facial templates; or
- train facial-recognition models unless we first provide a separate notice and obtain any consent required by law.
Retention and safeguards
We retain a record that consent was requested and given. Where you choose the retained “Find my photos & notify me” option, we also retain the facial template required to provide that service until it is deleted under Section 8 or you request deletion.
6. Sharing Personal Data
We do not sell personal data. We may share limited personal data with:
- photographers, where necessary to address a request concerning their photographs or resolve a related dispute;
- providers of hosting, storage, payments, payouts, identity verification, facial matching, communications, analytics, error monitoring and customer support;
- professional advisers, insurers, auditors and potential investors or purchasers subject to appropriate confidentiality obligations; and
- courts, regulators, law-enforcement agencies or other persons where disclosure is required by law or reasonably necessary to protect rights, safety or the Platform.
A photographer may receive transaction-level information needed to administer earnings and payouts, such as sale and payout amounts, but does not receive the buyer's selfie or liveness video, facial data or contact details.
7. International Transfers
Virvly and some service providers may process personal data outside Nigeria. Before transferring personal data, we use a transfer mechanism permitted by the NDPA, such as a determination that the recipient is subject to an adequate level of protection, contractual clauses or another safeguard recognised by law. Where no approved safeguard is available, we rely only on an applicable statutory condition and take any additional measures required by law. You may contact us for information about the safeguards relevant to your data.
Where the EU GDPR or UK GDPR applies because Virvly offers services to, or monitors the behaviour of, people in the EEA or UK, those individuals may also exercise the rights available under the applicable law and complain to their local supervisory authority.
8. How Long We Retain Personal Data
| Data | Retention approach |
|---|---|
| Submitted selfie or liveness video and search-generated facial data | For a one-time search, the selfie or liveness video and search-generated facial data are processed for that search and are not retained after it completes. If you choose “Find my photos & notify me”, the selfie or liveness video and/or facial template needed to provide that retained matching service are stored and associated with the contact details and internal guest or session identifier used to provide the service until the retained search is deleted, the relevant listing ends and applicable deletion processing is completed, or you request deletion. This does not create a client account. |
| Photographs | For the gallery period set by the photographer. Listing periods may be up to 30 days. If a photograph is purchased, it may be retained for an additional delivery period measured from the purchase date, currently up to 30 days. Actual retention may therefore extend beyond the listing period and may change where an authorised retention setting is adjusted, or where longer retention is required by law or a dispute. |
| Purchase, payout, tax and accounting records | For the period required by applicable tax, accounting, anti-fraud and financial laws, ordinarily up to six years after the relevant transaction or relationship. |
| Photographer account and verification records | For the account relationship and afterwards for the period required for legal, fraud-prevention, payment and dispute-resolution purposes. Verification providers may apply their own lawful retention periods. |
| Technical and security logs | Ordinarily up to 12 months, unless a longer period is needed to investigate an incident or comply with law. |
| Support communications | Ordinarily up to 12 months after the matter is closed, unless a longer period is needed for a dispute or legal obligation. |
| Gallery face templates | Created when photographs are published to a listing and retained for the active life of the listing so facial matching can operate. They are removed as part of the applicable listing/deletion process, subject to any lawful retention required for security, disputes or legal obligations. |
We may keep data for longer where reasonably necessary to comply with the law, resolve a dispute or establish or defend legal claims. Deleted data may remain in access-restricted backups until those backups are securely overwritten under our backup schedule and will not be restored to active use except for disaster recovery or security purposes.
9. Your Rights
Subject to the conditions and exceptions in applicable law, you may ask us to:
- confirm whether we process your personal data and provide access to it;
- correct inaccurate or incomplete personal data;
- delete eligible personal data, subject to legal grounds for retention;
- restrict particular processing;
- provide eligible data in a structured, commonly used and machine-readable format;
- stop direct marketing;
- object to processing based on our legitimate interests; or
- withdraw consent for future processing.
You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to statutory exceptions. Virvly's photo matching filters likely results and is not used to make such a decision about you.
Send requests to privacy-policy@virvly.com. The in-app “Delete my face data” function is designed to remove a retained facial template and initiate deletion with the facial-matching provider; it does not necessarily remove every other record associated with your use of the Platform, such as transaction, consent, audit or photo-match records. If you want us to consider deletion of other personal data, or to exercise portability or another privacy right, contact us at the address above and we will handle the request manually where necessary. Please provide enough information for us to locate the relevant data. We may request proportionate identity verification. We will respond without undue delay and ordinarily within one month. Where the law permits an extension because of the complexity or number of requests, we will tell you.
You may complain to the Nigeria Data Protection Commission through ndpc.gov.ng.
10. Children
Photographer accounts and purchases are for adults aged 18 or over. Photographs available through Virvly may nevertheless include children. A photographer may take and upload photographs of a child only after providing any required notice and obtaining the consent or other legal authority required for the taking, uploading and intended use of the photographs, including associated facial matching.
A parent or legal guardian may submit a child's selfie or liveness video solely to locate photographs of that child. The adult must affirm that they are the child's parent or legal guardian, have authority to act for the child and consent to the facial processing on the child's behalf. Virvly may request additional, proportionate evidence of that authority where the circumstances or risk warrant it. A person must not submit a selfie or liveness video of a child for whom they do not have legal authority. Virvly may refuse or stop a search where authority cannot be established or misuse is suspected.
A parent or legal guardian may ask us to remove a child's photograph by contacting privacy-policy@virvly.com. We may request proportionate evidence of identity and parental or guardian authority before acting.
11. Cookies And Marketing
We may use essential cookies and similar technologies for sessions, security and core Platform functions. We may use analytics or other non-essential cookies only where permitted and, where required, after obtaining consent through our cookie controls.
We send marketing by email, SMS, WhatsApp or push notification only where permitted by law and, where required, after you opt in through a separate choice. You may opt out at any time using the method in the message or by contacting us. Opting out does not stop service messages such as receipts, payout notices or security alerts.
12. Security And Personal Data Breaches
We use administrative, technical and physical measures designed for the nature and sensitivity of the data. Personal data is encrypted in transit. Facial matching takes place within access-controlled, firewalled environments. We also use access controls, logging, monitoring, staff confidentiality requirements and controls over service providers. No system can be guaranteed completely secure.
Where a personal data breach is likely to result in a risk to individuals, we will notify the NDPC within the period required by the NDPA. Where the breach is likely to result in a high risk, we will also communicate it to affected individuals without undue delay, unless an exception under the law applies.
13. Changes And Contact
We may update this Policy to reflect changes to the Platform, our practices or the law. We will provide appropriate notice of a material change and obtain fresh consent where a new processing activity requires it.
Virvly Privacy Desk
Questions, requests or complaints: privacy-policy@virvly.com
You can also use our contact page to submit an enquiry.