Nuur Mobile is a device financing (Buy Now Pay Later) application
operated by Telesom, designed for the Somali market. This privacy
policy explains how we collect, use, and protect your personal
information when you use the Nuur Mobile mobile application.
Data Collection
Account and Identity Data
Purpose: Account creation, identity verification
(KYC), and credit scoring
Collected: Full name, phone number, national ID
details, date of birth
Storage: Encrypted and stored on secure servers
Sharing: Identity verification and credit assessment
are carried out using Telesom's own subscriber records. We do not share
this data with credit bureaus. It is disclosed to regulators or other
authorised parties only where the law requires it
Authentication Data
Purpose: Secure login and session management
Collected: Phone number and one-time SMS
verification codes
Storage: Credentials are hashed; sessions use
short-lived tokens
Sharing: Never shared with third parties
Financial and Transaction Data
Purpose: Device financing origination, repayment
tracking, and credit scoring
Collected: Financing applications, repayment
history, mobile money transactions initiated through the app
(Hormuud EVC Plus, Zaad, Sahal)
Storage: Stored on secure servers with encryption in
transit and at rest
Sharing: Shared with mobile money providers and our
payment gateway only to the extent required to execute transactions
you initiate
Device and Photo Access (Optional)
Purpose: Upload identity documents and profile
photos during onboarding and KYC
Collected: Only photos you explicitly select or
capture for upload
Storage: Encrypted at rest; retained for the
duration required for KYC and regulatory recordkeeping
Usage: Used solely for identity verification and
account security
Notifications
Purpose: Send repayment reminders, transaction
confirmations, and account alerts
Collected: Push notification tokens
(Expo/Firebase) and phone number for SMS
Sharing: Shared with notification delivery
providers (Expo, SMS gateways) solely to deliver messages
What We Do Not Collect
To be explicit about the boundaries of the permissions the app requests:
We do not collect your location. The app requests no
location permission.
We do not access your contacts or your call history.
We do not read your SMS messages. Verification codes
are filled using Android's SMS Retriever service, which passes the app a
single matching message and nothing else, or you can type the code in
yourself. The app holds no SMS permission.
We do not browse your photo library. The app opens the
camera or picker only when you choose to attach a document, and receives
only the image you select.
We do not sell your personal data, or use it for
advertising or profiling unrelated to the financing service.
Data Security
All network traffic uses HTTPS/TLS encryption
Token-based authentication with short session lifetimes
Sensitive fields encrypted at rest
Regular security reviews and patching
Sensitive data is never logged in production builds
Data Retention
We retain personal and financial data for as long as your account is
active and for the period required by applicable financial and
anti-money-laundering regulations. You may request deletion of data
that is not subject to mandatory retention.
User Rights
Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of data not subject to regulatory retention
(see Data Deletion Requests below)
Withdraw consent for optional data processing
Request a copy of your data (portability)
Data Deletion Requests
You can request deletion of your personal data at any time by emailing
info@nuurmobile.com from the
email address or phone number registered on your account, with
"Data Deletion Request" in the subject line.
What is deleted: the personal and financial data we
hold about you, as described under Data Collection above — except
data we are required to keep under applicable financial and
anti-money-laundering regulations (see Data Retention above), such as
records tied to an active or past financing agreement. Where full
deletion is not possible, that data is kept only for as long as the
regulation requires and is not used for anything else.
How long it takes: we complete deletion requests within
30 days of receiving them. If we need longer — for example
where we must first verify your identity — we will tell you within that
period and explain why.
Third-Party Services
Nuur Mobile relies on the following categories of third-party
providers, each bound by contractual data-protection obligations:
Mobile money operators (Hormuud, Zaad, Sahal) — payment processing
SMS providers (Africa's Talking) — OTP and
notifications
Cloud hosting and managed database providers — secure storage
Children's Privacy
Nuur Mobile is not intended for use by anyone under 18 years of age.
We do not knowingly collect personal data from minors.
Changes to This Policy
We may update this policy from time to time. Material changes will be
communicated in-app or via email. The "Last Updated" date above
reflects the most recent revision.
Contact
For privacy-related questions or to exercise your rights, contact: