Data retention

The document exists to confirm identity once. The moment a reviewer confirms it, the photograph has done its job and becomes pure risk — so we delete it there and then, not later. What we keep is the record that verification happened, which is what your verified status actually rests on, and that lasts as long as your account. An automatic check also runs daily to catch anything the immediate deletion missed.

Same rule as approval: once a reviewer has decided, the photograph has done its job and we delete it. What you need from us is the reason, and you get that — on your screen and by notification. If you want to try again, submit a new photo any time; it goes into the queue as a fresh application and does not depend on the old one. If you think we got it wrong, write to support@imbizohub.com.

We review ID submissions within 3 business days. If we have not looked at yours within two weeks, we delete the document anyway and tell you to submit again. A photograph nobody has looked at carries risk for no benefit at all, and our failure to work the queue is not a reason to hold on to your ID.

This is the one category where financial and tax regulation sets the requirement rather than data protection law. Zimbabwe's statutory financial record retention period is three to five years; we keep to the longer end.

Balances genuine value in resolving disputes against indefinite accumulation of potentially sensitive conversation. Removed immediately if both participants delete their accounts.

Tied to the life of whatever the photograph documents — whichever of the two comes later.

If either party deletes their account the name is removed while the score and any written text remain. Deleting reviews outright would undermine the trust other people rely on, but the personal identifier should still go.

Tokens go stale on their own as people change or reinstall apps. This formalises clearing out the dead ones.

Name, phone, email, location and profile photo. Deletion is requested from inside the app; the account is anonymised immediately and fully purged within thirty days.

A deliberate decision rather than an oversight. City-level pickup and drop-off points are not sensitive in the way the categories above are, and removing the transaction rows would break legitimate uses that continue — a seller's own history, and the ability to resolve a dispute on a completed job. The genuinely sensitive part of these records, the photographs, is covered above. This is the treatment order history receives on most marketplaces.