The research team reviewed eight mobile loan apps common in Kenya and found that every one of them requested access to contacts, SMS, location, and storage permissions, without transparently explaining the purpose of the data in their privacy policies.