S.B.N. Leasing and Finance Limited (“SBN”, “we”, “us”, “our”) respects your privacy. This Privacy Policy explains what personal data the CashOne mobile application (the “App”) collects, how we use it, and the choices available to you.
This policy is published in compliance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
This policy applies to the CashOne App for Android. By installing and using the App, you agree to the practices described here. If you do not agree, please do not use the App.
The App collects the following categories of data, which are linked to your account:
| Category | Data Collected | Purpose |
|---|---|---|
| Contact Info | Phone number | App Functionality — creating your account, one-time password (OTP) verification at login, service notifications by SMS, and — where you have opted in — repayment reminders and recovery-related communications by WhatsApp. |
| Identifiers | User ID | App Functionality — a unique identifier assigned by our server to operate your account. |
| Identifiers | Device identifiers (Google Advertising ID (GAID), Android ID and other unique device identifiers), device model, operating system version, app version, IP address, and mobile network information | App Functionality, Analytics and Attribution — securing your account, preventing fraud and abuse, ensuring app compatibility, and attributing app installs (see Section 8, Tracking and Advertising). |
| SMS | Content, sender and timestamps of the financial messages described in Section 5, SMS and Financial Message Data | App Functionality — credit assessment and fraud prevention, with your permission. See Section 5. |
| Sensitive Info | Face data (facial images captured during the liveness check) | App Functionality — identity verification (KYC) and fraud prevention. See Section 6, Face Data. |
| Photos or Videos | Photographs of your PAN card, Aadhaar card and other KYC documents, and your liveness check image | App Functionality — completing the mandatory KYC (know-your-customer) process required for lending under applicable Indian law. |
| Financial Info | PAN, monthly income, bank account details | App Functionality — assessing your loan application and disbursing the loan. |
| Payment Info | Bank account / card details used for repayment, and e-mandate (ENACH) authorisation data | App Functionality — collecting loan repayments. Payment processing is performed by a PCI-DSS compliant payment service provider (see Section 12). |
| Location | Coarse location, collected only while you use the App | App Functionality — location is collected during the loan application as part of our regulatory anti-fraud and credit-assessment obligations. |
| Contacts | One emergency contact that you select yourself (name and phone number only) | App Functionality — collecting a loan reference contact as part of the loan application. The App does not request access to your address book; you pick the contact in the system contact picker, and only the single contact you choose is returned to the App. |
| Contact Info | Name, email address, postal address | App Functionality — completing your KYC profile and communicating with you about your loan. |
| Usage Data | Product interaction (screens viewed, buttons tapped, feature usage, timestamps) | App Functionality and Analytics — understanding how the App is used so we can improve it, and measuring the performance of our own advertising (see Section 8). |
| Customer Support | Feedback and support tickets you submit, including text and any attachments you choose to provide | App Functionality — handling your questions and complaints. |
SMS messages we send are transactional only: account verification codes and essential service notifications related to your account and your loan. We do not use your phone number for advertising or marketing communications.
This section describes in detail how the App handles SMS data. It supplements, and should be read together with, the rest of this policy.
With your permission, the App uses keyword-based filtering to collect only financial transaction-related messages, including:
The App collects the SMS content related to financial transactions, sender information, and transaction timestamps. We do not collect personal messages, contact names, or non-financial SMS content.
Access is requested through the Android SMS permission dialog before any message is read. You may decline this permission; however, without it we cannot analyse your financial messages, which may affect your loan eligibility assessment and approval outcome.
We use SMS data only for these purposes. SMS data is processed internally by our risk management systems and is never used for advertising, marketing, profiling, or any purpose unrelated to credit assessment and fraud prevention.
We do not sell your SMS data and we do not share it with any third party for advertising, marketing or tracking. SMS data is transmitted over an encrypted connection to our own servers and is processed only by our internal risk management systems, or by our cloud hosting service provider acting solely as our processor under a written contract. We disclose SMS data to third parties only where disclosure is required by applicable law, court order, or a direction from a government authority or regulator.
SMS data is stored on servers located in India. It is encrypted in transit (HTTPS/TLS) and at rest, and access is restricted to authorized personnel on a need-to-know basis for the purposes described in this section. SMS data is stored separately from your advertising identifiers and is never linked to any third-party advertising data.
SMS data is retained for credit-assessment documentation in line with our regulatory record-keeping obligations, including RBI requirements (minimum 8 years for audit purposes). When you delete your account (see Section 18, Your Privacy Choices), your SMS data is deleted from our production systems, except for records we are required to retain by applicable law or RBI regulation, which are retained only for the mandated period and then securely deleted.
You may revoke the SMS permission at any time in Android Settings → Apps → CashOne → Permissions. After revocation, the App can no longer read messages in future assessments. You may also exercise your rights of access, correction and erasure by contacting our Grievance Officer (Section 17).
This section describes in detail how the App handles face data. It supplements, and should be read together with, the rest of this policy.
During the identity-verification (KYC) step of the loan application, the App uses the front camera of your device to capture a facial image (a single best-quality still frame extracted from the live camera stream while you perform the on-screen liveness actions). This image is used to perform a “liveness check” that confirms you are a real, physically present person and that you match the identity document you submitted. The App does not record or upload any video of you.
During capture, the App uses on-device liveness detection technology provided by its KYC software development kit (SDK) to detect your face in the live camera stream on your device, in real time, for the purpose of guiding you to position your face correctly and confirming liveness. This on-device face detection is performed locally and is not stored on the device; only the final single still frame described in Section 6.1 is uploaded to our servers. No biometric template or mathematical face-print is created or retained by us.
We use face data only for these purposes. We do not use face data for advertising, marketing, profiling, or any purpose unrelated to identity verification and fraud prevention.
We do not sell your face data and we do not share it with any third party for advertising, marketing or tracking. Face images are uploaded over an encrypted connection only to our own servers, where they are stored by our cloud hosting service provider acting solely as our processor under a written contract. We disclose face data to third parties only where disclosure is required by applicable law, court order, or a direction from a government authority or regulator.
Face images are stored on servers located in India. They are encrypted in transit (HTTPS/TLS) and at rest, and access is restricted to authorized personnel on a need-to-know basis for the purposes described in this section. Face data is stored separately from your advertising identifiers and is never linked to any third-party advertising data.
We retain face images only for as long as necessary for the purposes set out above:
Camera access is requested with a clear purpose explanation and is used only when you are on the liveness-check or document-capture screens. You may decline or revoke camera permission at any time in Android Settings → Apps → CashOne → Permissions; without camera access we cannot complete KYC and therefore cannot issue a loan. You may also exercise your rights of access, correction and erasure by contacting our Grievance Officer (Section 17).
The App requests the following Android permissions, each shown in the standard Android permission dialog:
| Permission | When | Why |
|---|---|---|
| Camera | KYC liveness check and document photo capture | Capturing your facial image for the liveness check and photographs of your PAN/Aadhaar card for KYC. See Section 6. |
| SMS | Loan application | Reading the financial messages described in Section 5 for credit assessment and fraud prevention. You may deny, but this may affect your loan eligibility assessment and approval outcome. |
| Location (while using the App) | Loan application | Collecting your location as part of our regulatory anti-fraud and credit-assessment obligations. |
| Phone | Loan application | Reading the device’s phone state (such as device and network identifiers) to secure your account and prevent fraud and abuse. |
The App does not request contacts, call logs, microphone, or photo library permissions beyond the above. You can change any permission at any time in Android Settings → Apps → CashOne → Permissions.
CashOne uses the Adjust attribution SDK to measure the performance of our own marketing campaigns (for example, which advertisement led you to install the App), to attribute app installs, and to help detect and prevent fraud.
We use the data described in Section 4 solely to:
We do not use your data for third-party advertising or cross-app tracking beyond the attribution described in Section 8, and we do not sell or rent your personal data to anyone.
We retain your personal data only as long as necessary to provide the App’s services, or as required under applicable law and RBI (Reserve Bank of India) regulatory requirements. Records connected to a loan (including KYC records, related face data and SMS data) are retained for at least eight (8) years from account closure or loan completion, as mandated by RBI and PMLA requirements, or longer if required by law. When you delete your account (see Your Privacy Choices), we delete your account data from our production systems, except for records we are required to retain by law, which are kept only for the mandated period and then securely deleted or anonymized.
We share personal data only with:
We do not disclose your data to advertisers, advertising networks, or data brokers.
We protect your data using reasonable security practices and procedures as required by the IT Act, 2000 and the IT Rules, 2011, including:
Subject to applicable law (including the DPDP Act, 2023), you have the right to:
To exercise any of these rights, contact our Grievance Officer (Section 17). We will respond within the timelines prescribed by applicable law.
The App is intended for adults aged 18 years and above and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us personal data, please contact us so we can delete it.
We may update this policy from time to time. The “Last Updated” date above shows the current version. Material changes will be communicated within the App or on this page.
Under the IT Act, 2000, the IT Rules, 2011, and the DPDP Act, 2023, our Grievance Officer is:
Ms. Deepshikha Sharma
Email: info@sbnnbfc.com
Phone: +91 92178 47725
Working hours: Mon–Fri 10:00–20:00, Sat 10:00–18:00 (IST)
If your grievance is not resolved satisfactorily, you may escalate to the Data Protection Board of India (for data protection matters) or the RBI Integrated Ombudsman (for lending-related matters), as applicable.
You are in control of your data at any time, directly from your device: