Privacy notice

Version of 20 October 2026

About VeriList

VeriList is a digital solution developed by Adaa Foundation for Studies and Research for humanitarian and development organisations. It strengthens the quality of beneficiary registration and gives project teams evidence for their decisions: where to focus field inspection, what to monitor, and how to evaluate a beneficiary list at any stage of a project. It does this by checking lists for possible duplicates, household links, ID problems and data gaps, in Arabic and English. VeriList is in its pilot phase.

This notice explains how we handle the lists your organisation uploads, your account details, and the details you send when you request access.

Who is responsible

Your organisation decides what to upload and remains responsible for its beneficiary lists. Adaa Foundation operates VeriList and processes your lists only to run the checks you request. A data processing agreement is available on request.

Your beneficiary lists

Each check runs on your list alone. We do not share your lists, sell them, use them for any other purpose, or compare them with other organisations' lists.
Only people with an account in your organisation can see your lists and results.
Platform administrators manage accounts. They cannot open records or result files.
Result files can only be downloaded through a logged download.
Only counts, never records, are kept for platform statistics.
Please upload only the columns the check needs: names, ID, phone, location and household details. Do not upload health, protection or vulnerability information.

How your lists are analysed

VeriList uses its own rule-based algorithms, developed by Adaa Foundation in Python. They read your file's structure, standardise names and locations, and find possible duplicates and household links.
These checks run only on VeriList's own processing service. They do not use artificial intelligence.
The rules are fixed and documented. Results are reproducible, and every flag shows its evidence.
Your lists are never sent to AI services and never used to train any model.
VeriList never removes or edits a record. Your team makes every decision.

How we protect your data

All connections are encrypted. Stored lists and result files are encrypted with AES-256.
Lists are processed in memory and are not kept on the processing service.
Stored files can be reached only by VeriList's processing service and by Adaa Foundation's technical administrators, for maintenance only.
Result downloads and list deletions are recorded in a permanent audit log. Application logs never record list content.
If a security incident affects your data, we will inform your organisation within 72 hours of becoming aware of it.

How long we keep data

Uploaded lists and result files: until you delete them. Deleting a list removes its files at once, and files are not kept in backups. Basic records about the list, such as its name, dates and counts, may remain in database backups for up to 30 days.
Account details: while the account is active.
Access requests: 12 months after the decision, then deleted.
Pending requests with no decision: 12 months after they were sent, then deleted.

Your access request and account

What we collect: your full name, work email, organisation name and type, country, job title, how you expect to use VeriList, and any note you add. We also record the language of the form, the version of this notice you confirmed, and the date of your request. The form asks nothing about the people your organisation serves.
Why: only to review your request, contact you about it and, if it is approved, create your account and send you an invitation.
Who can see it: VeriList platform administrators only. We do not sell your details or use them for marketing.

Services we use

Supabase (database and file storage), Railway (processing of uploaded lists), Vercel (websites), Resend (emails) and Cloudflare Turnstile (form protection).

Changes to this notice

We will publish any change here with a new version date, and inform account holders of important changes by email.

Contact

To see, correct or delete your details, or to ask about this notice, write to support@verilist.org.

Back to VeriList home