Privacy notice

Noyo is the trading name of Noyo Finance Ltd, incorporated in Mauritius, registration number C22186760, with its registered address at 37 Sir William Newton St, Port Louis, 11328, Mauritius.

Customer support: support@noyofinance.com. Privacy contact: privacy@noyofinance.com. These details identify the responsible organization; card providers are separate businesses. Availability depends on the permissions and product rules applicable in your country.

Noyo Finance Ltd is responsible for the personal information used to administer your Noyo account, application and loan. Send privacy questions and requests to privacy@noyofinance.com. Card providers operate their own accounts and may act as independent controllers under their own privacy notices.

Depending on the service and country, this can include your name, email, telephone, date of birth, residential address, tax identifier, employment information, monthly income, expenses, loan purpose and responses to eligibility questions. We also use the provider account identifier you choose, payment instructions, support messages and records of your choices.

Do not send card PINs, passwords, recovery phrases or unnecessary sensitive documents through support messages.

Didit provides document and face verification. Depending on the configured check, it processes identity-document images, extracted identity details and face images or video. Noyo receives verification results, compares the name and date of birth with the application and may access verification evidence for an authorized manual review. Read the verification notices before submitting evidence: didit.me/terms/.

Only submit documents through the verification flow, not by ordinary email or AI chat. Any additional credit-reference or screening enquiry is explained before it is used where required.

Technical service records may include timestamps, IP address, device and browser information, security events and error records where required to operate and protect the service. These records are distinct from optional website analytics.

Google Analytics is the only optional measurement service covered by the current cookie settings. It is subject to your analytics choice. We do not use this choice to authorize Google Ads, Meta Pixel or server-side advertising integrations.

Application and account information is used to take steps at your request before a contract and to perform an agreed loan. Records required by applicable lending, identity, financial-crime, tax or accounting rules are processed to meet the relevant legal obligations: the lending, identity, accounting and financial-crime requirements applicable to the service.

Where local law permits, proportionate fraud prevention, security and dispute handling may rely on legitimate interests, balanced against your rights. Optional analytics relies on consent. Different countries may use different legal grounds; we will identify the applicable ground rather than treating consent as a blanket authorization.

Information needed to assess affordability, verify identity or administer a contract may be necessary to proceed. If required information is missing, inaccurate or cannot be verified, an application or payment may not progress. We will explain additional requests in context.

Refusing optional analytics does not reduce your eligibility or change your loan terms. Cookie choices, direct-marketing choices, identity checks and payment authorizations serve different purposes and must not be bundled together.

Information about income, expenses, identity and eligibility is used to assess the application. Automated processing can contribute to prequalification and the final assessment. An initial estimate is not a guarantee of an offer. You can ask support@noyofinance.com to correct inaccurate information or request a review and an explanation of the decision, subject to applicable rights. The AI support chat does not make credit decisions.

Service providers include Didit for identity verification, Resend for sending and receiving email, OpenAI for AI support, Cloudflare for bot protection, hosting and database providers, and Google Analytics when optional analytics is enabled. Access by staff is limited to service and review needs. The selected card provider receives information needed for account confirmation and payment processing. Selecting a card does not authorize sharing the full application with all partners.

Provider information: didit.me/terms/,resend.com/legal/privacy-policy,openai.com/policies/privacy-policy/,www.cloudflare.com/turnstile-privacy-policy/. Ask privacy@noyofinance.com about recipients and processing arrangements relevant to your account.

When enabled with your consent, Google Analytics measures public website navigation using pseudonymous identifiers and technical usage information. Our measurement integration does not intentionally send application contents, names, email addresses, phone numbers, tax IDs, identity documents or provider account IDs. Public page URLs are sent without query strings or fragments.

Analytics consent is not consent to advertising. The Cookie Policy describes storage, withdrawal and the service provider.

Our providers may process information outside Mauritius or your country of residence. Processing locations and contractual arrangements depend on the service and provider. Where applicable, transfers require an appropriate legal basis and safeguards. Contact privacy@noyofinance.com for information about the recipients, destinations and safeguards relevant to your data.

Account, application, verification, contract and payment records are retained according to the purpose, account or loan lifecycle and applicable recordkeeping obligations. Support messages, attachments and complaints are kept while needed to resolve and document the matter. Security records support abuse prevention and incident investigation. Legal disputes or preservation obligations can delay deletion of relevant records.

AI support conversations are stored in Noyo’s application database for support and quality review. Messages sent to a provider remain subject to that provider’s processing terms. Cookie choices expire after 180 days and the chat security cookie after 24 hours. Ask privacy@noyofinance.com for the retention criteria applying to a specific record or to request deletion. Closing an account does not automatically erase records that must be retained.

Depending on the law that applies, you may request access, correction, deletion, restriction, portability, information about sharing, or object to particular processing. You may withdraw consent for optional processing without affecting its lawfulness before withdrawal. Rights can have exceptions, including necessary statutory retention.

Send requests to privacy@noyofinance.com. We may ask for proportionate identity evidence to protect you from unauthorized disclosure. Response deadlines and extension rules follow applicable law: the deadline required by the applicable data-protection law; we explain any permitted extension. You can also complain to the competent data-protection authority in your jurisdiction; privacy@noyofinance.com can help identify the appropriate contact.

Where EU or UK data-protection law applies, relevant rights include withdrawing consent, objecting to certain processing and requesting safeguards for qualifying automated decisions. Under Brazil’s LGPD, applicable rights include confirmation, access, correction, information about sharing, withdrawal of consent and review of qualifying automated decisions.

South African, Malaysian, Thai, Vietnamese, Cambodian, Indian and other local requirements must be addressed in the relevant local notice: the local disclosures provided for an available product before acceptance. These references do not mean Noyo is authorized to lend in every jurisdiction.

Access controls, proportionate verification and secure handling must protect personal information throughout its lifecycle. No online system can promise absolute security. Report a suspected data incident to abuse@noyofinance.com. Do not include unnecessary confidential documents in the first report.

The service is intended for adults who meet local eligibility rules. If you believe a child provided information, contact the privacy team. Material changes to this notice will be communicated as required. Effective date: 2026-09-29.

When you use the AI chat, your message and a limited recent conversation history are sent to OpenAI to generate a Noyo support response. The chat does not receive your application record or identity documents automatically. Do not enter identity documents, tax identifiers, passwords, card credentials or verification codes. Answers can be inaccurate; check your individual agreement and contact support for account-specific questions.

Noyo stores chat questions, replies, timestamps, language and response status on its servers for support and quality review. Authorized administrators can read these conversations. When you are signed in, a conversation may be associated with your account. Records are kept while needed to resolve and document support matters; contact privacy@noyofinance.com about access or deletion. API requests use store:false; provider processing remains subject to its terms.

Resend handles transactional email and correspondence sent to support@noyofinance.com, abuse@noyofinance.com and privacy@noyofinance.com. Email addresses, message content, attachments, delivery events and correspondence references may be stored to send, receive, route and respond to messages. Staff access the mail client to handle requests. Do not send identity documents or unnecessary sensitive information by ordinary email.

We record relevant IP addresses and browser/device information for account security and service administration. Approximate country is derived using a locally stored MaxMind GeoLite2 database; it is not proof of residence and does not require sending each lookup to MaxMind.

Chat request counters and a signed session cookie help limit automated traffic. When activity exceeds the chat threshold, a short waiting period and Cloudflare Turnstile verification may be required. Cloudflare receives technical signals needed to perform the check. This protection is separate from optional Google Analytics. Information: www.cloudflare.com/turnstile-privacy-policy/.

Noyo Finance Ltd administers personal-data processing from Mauritius. This identifies Noyo’s administration and does not mean every service provider stores or processes data exclusively in Mauritius. The provider and international-transfer disclosures in this notice apply.

Noyo assesses income automatically using application information and permitted checks. We do not ask you to upload payslips, income certificates or bank statements as proof of income. Enter accurate monthly income and expenses in USD. Identity verification is a separate requirement.