Noupia Privacy Policy

1. Who We Are and How to Contact Us

The company responsible for processing personal information under this policy is Noupia Limited Company, a company registered in Wyoming, United States, under registration number 2023-001214990, trading as Noupia (“Noupia,” “we,” “us,” or “our”).

• Registered address: 1309 Coffeen Avenue STE 8486, Sheridan, WY 82801, USA.
• Registration number: 2023-001214990.
• Privacy contact: [email protected] — please use the subject “Privacy Request.”
• Website: https://noupia.com

Where a different Noupia entity is responsible for a particular service, we identify that entity in the relevant service agreement or privacy notice and explain its role.

Banks, card issuers, mobile money operators, payment institutions, and other financial partners may process information independently to provide their services and meet their own legal obligations. Their privacy notices apply to that independent processing. We identify the relevant provider during onboarding or when you access the applicable service.

2. Personal Information We Collect

The information we collect depends on the services you use, the information you provide, and applicable legal requirements. We do not collect every category below from every user.

2.1 Account and Contact Information

• Name, email address, telephone number, and residential address.
• Date of birth, nationality, and country of residence.
• Account identifiers, preferences, and account status.
• Authentication information, such as password hashes, verification records, and login or account recovery events.
• Business details, ownership information, and information about authorised representatives where you use a business account.

2.2 Identity and Compliance Information

Where required for identity verification, fraud prevention, or financial compliance, we may collect identification documents, document numbers, photographs, proof of address, occupation, source of funds, source of wealth, and information relevant to sanctions or politically exposed person screening.

If a particular verification process involves a selfie, video, liveness check, or facial comparison, we explain that process before collection. Where biometric information is processed, the applicable notice identifies the provider, purpose, retention arrangements, and available rights, and we obtain explicit consent where legally required.

2.3 Financial and Transaction Information

• Bank account, mobile money account, card, or other payment instrument information needed for a transaction.
• Transaction amounts, currencies, dates, fees, references, statuses, and counterparties.
• Card funding, payment, withdrawal, refund, reversal, dispute, and chargeback records.
• Account balances, statements, receipts, and settlement records.
• Information about beneficiaries, senders, merchants, or recipients that you provide when using a service.

Payment information may be collected directly by a payment provider or card issuer. The information available to Noupia depends on that integration and may include payment tokens, masked card details, and transaction confirmations. Never send your PIN, password, card security code, or one-time authentication code to customer support.

2.4 Technical and Usage Information

• IP address, browser type, operating system, device model, application version, language, and time zone.
• Session identifiers, authentication events, security logs, and device or application identifiers used for service operation.
• Pages visited, features used, interaction events, error reports, and diagnostic information.
• Approximate location inferred from your IP address.
• Notification tokens where you enable push notifications.

Technical information may be linked to your account where necessary for security, troubleshooting, or service operation.

2.5 Communications and Information You Submit

We collect information you provide through support requests, emails, forms, feedback, complaints, surveys, and uploaded attachments. If a call or other communication will be recorded, we provide notice and obtain consent where required.

2.6 Information from Other Sources

We may receive information from identity providers you choose to use, financial partners, transaction counterparties, identity verification providers, fraud prevention services, public registers, sanctions databases, and authorities acting within their legal powers.

If you provide another person’s information, you must have a lawful reason to do so and inform them about the relevant processing where required.

3. Sign in with Google and Google User Data

3.1 Information Accessed

If you choose Sign in with Google, Noupia requests basic identity permissions using the openid, email, and profile scopes. Depending on the information available from Google, we receive your Google account identifier, name, email address, email verification status, and profile picture.

Google authenticates you directly. Noupia does not receive your Google password. Basic Google sign-in does not give us access to your Gmail messages, Google Drive files, contacts, calendar, or other unrelated Google account content.

3.2 How We Use and Store Google Information

We use Google identity information to authenticate you, create or link your Noupia account, display your account profile, and protect account access. Signing in with Google does not replace identity checks required for financial services.

We store the Google account identifier and relevant profile information in your Noupia account records. Authentication tokens, where retained, are restricted to systems that need them and kept only for the period necessary for their authentication purpose.

Google identity information is disclosed only as necessary to providers supporting account authentication, hosting, and security, or where disclosure is legally required. Any broader sharing described elsewhere in this policy remains subject to the restrictions in this section.

3.3 Restrictions on Google Data Use

Noupia follows the Google API Services User Data Policy , including its Limited Use requirements where applicable.

We do not sell Google user data, use it for personalised advertising, transfer it to data brokers, or use it to assess creditworthiness or make lending decisions. We do not use Google user data to train general-purpose artificial intelligence or machine learning models.

For data subject to Google’s Limited Use requirements, transfers are limited to providing or improving appropriate, prominently disclosed user-facing features with user consent; necessary security purposes; compliance with applicable law; or a merger, acquisition, or sale of assets after obtaining explicit prior user consent.

Human access to data subject to those requirements is permitted only with your affirmative agreement to access specific data, where necessary for security or legal compliance, or for aggregated internal operations as permitted by Google’s requirements and applicable law.

3.4 Additional Permissions

If we introduce a feature that requires additional Google permissions, we will identify the specific data requested, explain the feature and its data handling, update relevant notices, and request authorisation before accessing it.

3.5 Revoking Access and Deleting Data

You can review or revoke Noupia’s Google connection through your Google Account connections settings . Revocation stops future access through that authorisation. It does not automatically delete your Noupia account, erase information already lawfully retained, or cancel completed transactions.

You may request deletion of Google-derived profile information or your Noupia account using Section 10. If Google is your only sign-in method, arrange an alternative method through Noupia support before disconnecting it if you wish to keep using your account.

4. Why We Use Personal Information

• Account administration: Create accounts, authenticate users, manage preferences, and provide account recovery.
• Service delivery: Process authorised transactions, provide card-related services, reconcile balances, and issue confirmations.
• Identity and compliance: Verify identity, assess eligibility, perform required screening, keep records, and fulfil lawful reporting duties.
• Security and fraud prevention: Detect suspicious activity, protect accounts, investigate abuse, and prevent unauthorised transactions.
• Support and dispute resolution: Answer questions, investigate complaints, and handle refunds, reversals, and chargebacks.
• Service improvement: Diagnose errors, assess performance, and improve features using information appropriate to those purposes.
• Communications: Send security alerts, transaction notifications, operational updates, and legally required notices.
• Marketing: Send promotional communications where permitted by law and in accordance with your choices.
• Legal administration: Maintain accounting records, respond to lawful requests, and establish, exercise, or defend legal claims.

Where applicable law requires a legal basis for processing, we rely on the basis appropriate to the particular activity: performing our contract with you, meeting a legal obligation, your consent, or legitimate interests where that basis is legally available and does not override your rights. Sensitive information is processed only where an additional lawful condition, authorisation, or consent is satisfied.

Providing information needed for identity checks or transaction processing may be a legal or contractual requirement. If you do not provide it, we may be unable to open an account or provide the requested service. Optional information and permissions are identified when requested.

5. When We Share Personal Information

We disclose information only where there is an appropriate purpose and legal basis, and limit disclosure to information relevant to that purpose.

• Financial and payment partners: Banks, card issuers, card networks, mobile money operators, payment processors, settlement providers, and other institutions involved in your requested service.
• Verification and security providers: Providers supporting identity checks, compliance screening, fraud detection, and account protection.
• Technology and operational providers: Hosting, infrastructure, communications, customer support, diagnostics, and other providers working on our behalf.
• Transaction counterparties: Information necessary for a sender, recipient, merchant, or other counterparty to complete or recognise a transaction.
• Professional advisers: Auditors, accountants, insurers, and legal advisers where necessary and subject to appropriate confidentiality duties.
• Authorities and legally authorised recipients: Where required by law, a valid legal process, regulatory obligation, or a lawful request from a competent authority.
• Business transactions: Where necessary for a proposed or completed restructuring, financing, merger, or asset transfer, subject to lawful safeguards and any additional consent requirements.
• Recipients you authorise: Where you direct us to share information or provide valid consent.

Providers processing information on our behalf are subject to appropriate contractual restrictions and security duties. Providers acting as independent controllers are responsible for their own processing under applicable law.

We do not sell personal information. We do not provide identity documents, financial account information, or transaction histories to advertising networks for targeted advertising.

6. Device Permissions

Where a feature requires device access, we explain the purpose and request the relevant permission. Depending on the feature, this may include:

• Camera: Capturing a verification document, a verification image, or other content you choose to submit.
• Photos or files: Selecting documents, receipts, or support attachments.
• Notifications: Receiving transaction updates, security alerts, or optional communications.
• Biometric authentication: Where supported, asking your device to confirm an authentication result. Device-managed fingerprint or facial templates remain controlled by your device operating system and are not provided to Noupia.

Any additional access, including precise location, contacts, SMS, or microphone access, requires a specific feature explanation and applicable permission before collection. A device permission does not authorise unrelated processing. You can manage permissions in your device settings; disabling a permission may prevent the related feature from working.

7. Cookies, Analytics, and Marketing Choices

Our websites and applications may use cookies, local storage, and similar technologies to maintain sessions, secure account access, remember preferences, and support service operation. Where analytics or other optional tracking technologies are used, we explain their purposes and obtain consent before activation where required by law.

You can manage cookies through your browser and through any cookie controls provided on our website. Blocking essential storage may affect sign-in or other functionality. Withdrawing optional consent does not affect processing lawfully performed before withdrawal.

You may opt out of promotional emails using the unsubscribe link or by contacting us. You can manage push notifications through your device settings. Necessary transaction, security, and legal communications may continue while relevant to your account or our obligations.

8. International Processing and Transfers

Noupia and its providers may process information outside your country of residence, including in countries where infrastructure, support teams, or financial partners operate. Privacy laws in those countries may differ from those in your country.

Where cross-border transfer restrictions apply, we use legally recognised safeguards and obtain required authorisations before transferring information. Depending on the applicable law, these may include approved contractual protections, adequacy mechanisms, or another lawful transfer basis.

You can contact us to ask about the locations and safeguards relevant to your information and request a copy or description of applicable safeguards, subject to lawful confidentiality restrictions.

9. How Long We Keep Information

We retain personal information for the period necessary for its stated purpose and applicable legal obligations. Retention depends on the record type, service, jurisdiction, and whether a dispute or investigation is ongoing.

• Account information: While your account remains active, followed by deletion, anonymisation, or restricted retention where justified.
• Identity, compliance, and transaction records: For the period required by applicable anti-money laundering, accounting, tax, and financial-services rules. Where a ten-year retention requirement applies, relevant records are kept for ten years from the legally prescribed starting point, which may be account closure, the end of the business relationship, or the transaction date.
• Support and dispute records: For the period needed to resolve the matter and meet related legal or evidential requirements.
• Security and diagnostic logs: For a period proportionate to security, investigation, and troubleshooting needs.
• Marketing records: Until you withdraw consent or object, or until the information is no longer needed. We may keep a minimal suppression record to respect your opt-out.
• Google profile information and tokens: Only while needed for the disclosed account or authentication purpose, subject to deletion requests and any applicable lawful retention requirement.

A longer period may be necessary for a legal hold, active dispute, fraud investigation, or binding legal requirement. Information retained after account closure is restricted to the purpose that justifies retention.

Deleted information may remain temporarily in protected backups until the applicable backup rotation completes. Such copies are not used for ordinary business activity. If a backup is restored, applicable deletion instructions are reapplied.

10. Account Closure and Data Deletion

You can request deletion of your Noupia account and associated personal information by visiting: https://m.noupia.app/delete . You can access this page through a web browser without installing the Noupia application.

Alternatively, email [email protected] with the subject “Noupia Account Deletion Request.” Include the email address or telephone number associated with your account. Do not include your password, PIN, complete card details, or one-time authentication codes.

We may require you to authenticate or provide limited additional information through a secure process to verify that the request is authorised.

After verifying your request, we close your account and delete or irreversibly anonymise associated personal information that we no longer need. We aim to complete this within 30 days, subject to any shorter applicable legal deadline. If a lawful extension or additional action is necessary, we explain the reason and expected timeframe.

Account deletion does not reverse completed transactions or extinguish outstanding obligations. We explain any necessary steps concerning remaining funds, pending transactions, or disputes. These matters do not justify retaining unrelated personal information.

Certain identity, compliance, transaction, accounting, and dispute records may need to be retained to meet legal obligations, prevent fraud, or establish, exercise, or defend legal claims. Applicable retention periods are described in Section 9.

Where information must remain after account deletion, we restrict its use to the purpose justifying retention and delete or anonymise it when that justification expires. We explain the categories retained, the reason, and the applicable retention period unless legally prohibited. Deactivation or suspension alone is not treated as deletion.

Uninstalling the application or disconnecting Google sign-in does not itself delete your Noupia account. Banks, card issuers, payment providers, and other independent financial partners may retain their own records under their legal obligations and privacy notices.

11. Your Privacy Rights

Depending on the laws applicable to you, including Cameroon’s personal data protection legislation and other applicable privacy laws, you may have the right to:

• Receive information about how your data is processed.
• Request access to your information and a copy of it.
• Correct inaccurate or incomplete information.
• Request deletion where the legal conditions are met.
• Request restriction of certain processing.
• Object to processing, including direct marketing.
• Receive certain information in a portable format or request its transfer where applicable.
• Withdraw consent without affecting the lawfulness of processing carried out before withdrawal.
• Exercise applicable rights concerning decisions based solely on automated processing.
• Complain to a competent data protection authority or seek another remedy available under applicable law.

Contact us using Section 1 to exercise your rights. We verify requests proportionately and respond within applicable statutory deadlines. Requests are generally free. Any permitted fee or refusal will be explained and applied only where the law allows it.

Rights are subject to lawful exceptions, including obligations to retain financial records and restrictions protecting other people’s rights. We will explain any limitation unless prohibited by law. We do not penalise you for exercising your privacy rights.

12. Automated Checks and Review

We and relevant service providers may use automated checks to identify suspicious activity, assess transaction risk, verify information, or enforce security controls. These checks may flag an account or transaction for review or temporarily restrict an activity.

Where a decision is based solely on automated processing and produces legal or similarly significant effects, we provide the additional information and safeguards required by applicable law, including access to human review and a means to challenge the decision where applicable. Contact support if you believe an account or transaction has been restricted incorrectly.

13. Information Security

We apply technical and organisational safeguards appropriate to the sensitivity of the information and the risks involved. These include access restrictions, secure transmission, authentication controls, monitoring, and procedures for responding to security incidents.

Access is limited to authorised people and providers with a legitimate operational need and appropriate confidentiality obligations. No system can guarantee absolute security. Protect your credentials and notify us promptly if you suspect unauthorised access.

If a personal data breach occurs, we investigate, take appropriate remedial steps, and notify affected people and competent authorities where required by law.

14. Children and Age Eligibility

Noupia’s financial services are intended for adults aged 18 or above, unless a specific service expressly permits younger users under a lawful, separately documented arrangement. Our services are not directed at children.

If we discover that a child has provided information without an appropriate legal basis, we take steps to restrict the account and delete the information, subject to any mandatory retention obligations. Please contact us if you believe a child has created an account improperly.

15. Third-Party Websites and Services

Our services may contain links to third-party websites or allow you to interact with external providers. Their privacy notices govern information they collect independently. Review those notices before providing information. Noupia remains responsible for processing within its own control and for providers acting on its behalf as required by applicable law.

16. Changes to This Policy

We may update this policy to reflect changes in our services, processing practices, or legal requirements. We publish the revised policy here and update the date above. For material changes, we provide additional notice through an appropriate channel.

Where a change requires fresh consent, including a new use of Google user data requiring authorisation, we obtain that consent before beginning the new processing.

17. Questions and Complaints

For privacy questions, requests, or complaints, contact [email protected] with the subject “Privacy Request.” Describe your concern and provide a safe way for us to contact you.

You may also write to: Noupia Limited Company, Privacy Requests, 1309 Coffeen Avenue STE 8486, Sheridan, WY 82801, USA.

We will investigate and respond within the period required by applicable law. You may also contact the competent data protection authority without first making a complaint to us.