Nufaa privacy policy
Last updated: 20 October 2026. This notice covers Nufaa’s website, Android app, accounts, orders and support service. Manual purchases arranged with Nufaa staff can be recorded for rewards.
Who is responsible
Nufaa Technologies Limited, registered in England and Wales, company number 17405430. Registered office: 21 New Street, Bloxwich, WS3 2HX, United Kingdom. We are the controller of the personal information described here. Contact support@nufaa.com about your data.
Information we use and why
We use your name, email address, country, optional phone number, password hash and verification status to create and manage your account, verify your email and recover access. This is necessary to provide the account service you request under our terms.
If you save recipients, we store the details you provide, such as their name, phone or meter number. Only add details you are authorised to use. We use support messages and relevant account records to answer your requests and resolve problems.
We process session identifiers, browser information, security events and hashed identifiers used to limit repeated requests. Our legitimate interests are keeping accounts secure, preventing abuse and maintaining a reliable service. Hosting providers also process network information such as IP addresses to deliver and protect the website.
Orders and payments
When you place an order on our website, we keep the order details you enter (recipient name, phone number and, for Cash Power, the meter number), the service value, price and payment records. For a Wave payment we keep the Wave number you pay from and the transaction reference; for a bank transfer we keep the bank transaction reference. Finance staff use these to match payments. To fulfil an order through Uquid, we send it the recipient mobile number (and, for Cash Power, the meter number), the selected network or service, and the service value. Uquid returns the delivery status and, for Cash Power, may return the token shown on your order page. Nufaa staff may review or complete delivery when automatic fulfilment needs attention. We keep order and payment records for as long as needed to answer payment questions and to meet accounting and tax record-keeping obligations. We do not receive or store your bank or Wave login or card details.
Payment receipts and manual rewards
You may upload a payment receipt for a manual purchase. Image receipts can be read on your device using a free reader served by Nufaa; receipt images are not sent to an external AI or OCR provider. The image and suggested reading are then submitted privately to Nufaa for staff review. PDF receipts and failed readings require manual review. We store the receipt privately with your account and use its payment amount, date, reference and relevant customer or recipient details to review the purchase and calculate a proposed 1% dalasi reward. Authorised finance staff check received funds and completed delivery before crediting rewards. Uploading alone does not verify payment or credit your balance. Only upload details needed for this review; hide unrelated financial information. Receipt files and purchase records are retained while needed to resolve payment queries, prevent duplicate claims and meet applicable record-keeping obligations. Contact us to request correction or deletion; staff assess any necessary retention.
Our lawful bases
We process account details, support requests and manual purchase or reward records to provide the services you request (performance of a contract). We use security logs and receipt checks for our legitimate interests in protecting accounts, preventing fraud and duplicate claims, and resolving disputes. Where applicable law requires us to retain accounting records or respond to lawful requests, we rely on a legal obligation. We do not rely on registration as consent to marketing.
Who receives information
We use Cloudflare for website hosting and database connections, Neon for the account database, and Resend for verification and recovery emails. Wave processes Wave payments. Uquid receives recipient and service details needed to deliver eligible airtime and Cash Power orders. Our company support mailbox is hosted by Zoho. Authorised Nufaa staff can access information needed to provide support and operate the service. We may disclose information where required by law.
The production account database is configured in London. Our hosting, email and support providers operate internationally, so some processing may take place outside the UK. Contact us for details of the applicable locations and transfer arrangements.
Payments may be confirmed by Finance or by an enabled payment notification flow. Orders may be fulfilled by Uquid or authorised Nufaa staff. Registering does not subscribe you to marketing emails.
Android app and device access
The current Android app collects the account and support information you enter. It does not access your contacts, precise location, camera, microphone or photo library, and does not include advertising or analytics SDKs. Receipt uploads and on-device receipt reading are currently website features; they are not part of the native Android app. When you follow an external link, the destination website processes information under its own privacy notice.
Cookies and browser storage
The Android app keeps its session in memory. Closing its process signs you out locally. It does not save your password or verification codes on the device.
We use the essential nufaa_session cookie to keep you signed in. It is secure, inaccessible to page scripts and lasts up to seven days. Signing out clears the session. The website may use session storage to track an order attempt. Purchases made from the Android app open in the external browser; the app does not transfer its in-memory session, so you may need to sign in to the website separately. Nufaa does not use advertising cookies or third-party analytics tracking in the current website or Android app.
How long we keep information
Account and saved-recipient information is kept while needed to provide your account. You can remove saved recipients in your account and request account and data deletion on our website, in the Android app under My profile, or by email. For closure requests we assess whether any information must remain to resolve an open support issue, investigate abuse or meet a legal obligation; we explain any necessary retention rather than keeping the entire account indefinitely.
Verification and recovery codes expire after ten minutes. Successful use consumes the code; expired code records and expired sessions are removed by daily cleanup. Sessions expire after seven days. Support and security records are retained according to whether a request or investigation remains open and whether they are needed to establish or defend a legal claim. Provider delivery logs and backups have their own retention settings; contact us for details.
Security
We use HTTPS to protect information in transit, store password hashes rather than readable passwords, and restrict receipt and customer-record access to the relevant customer and authorised staff. Never put your password or email verification code in a support message or receipt.
Your rights
You can ask for access, correction, deletion, restriction or a portable copy of your information where the relevant right applies. We may need to verify your identity before acting. You can object to processing based on our legitimate interests. Send requests to support@nufaa.com.
You can complain to the Information Commissioner’s Office. You do not need to contact us first.
Account details marked as required are needed to provide an account; without them we cannot register you. We do not use automated decision-making that has legal or similarly significant effects. We will update this policy if how we use information changes and provide notice of material changes through the service where appropriate.