Privacy Policy

Aprubado (aprubado.ph) is a free, independent loan-matching platform — an aggregator — and is not, in any sense, a lender.

To restate the point plainly: we match and compare loans; we do not lend. We introduce you to SEC-licensed partner lenders, and it is those lenders who assess creditworthiness, release funds, and manage repayment and recovery. Aprubado advances no money, chooses no borrower, prices no loan, disburses nothing, and collects no debt. Nor do we ever ask borrowers to pay for using the Platform.

In respect of the data you hand to Aprubado — as you browse the site, complete the matching questionnaire, or generate marketing analytics — Aprubado acts as the Personal Information Controller (PIC). The moment we introduce you to a partner lender and, with your consent, forward your application data to it, that partner lender takes on the role of an independent Personal Information Controller over the data it receives, and its own privacy notice then governs whatever it does with that data thereafter.

Put simply: for as long as you have not tapped Apply Now, the data sits with us. Once you tap Apply Now, your data travels to the matched SEC-licensed partner lender(s), who from that point control how your application is processed on their end.

We limit ourselves to what is genuinely needed to pair you with a fitting partner lender and pass along your application. In detail:

• Identity details: your full name, date of birth, gender, and the type and number of your government-issued ID.
• Contact details: your mobile number and email address.
• Financial details: the loan amount and term you want, your employment information, your monthly income, and the GCash or bank account number the matched lender will use for disbursement.
• Application metadata: session identifiers, IP address, browser and device fingerprint, UTM source/medium/campaign, the Meta Click ID (fbclid), the referring page, timestamps, and events marking how far you get through the application.
• Advertising identifiers: Meta Pixel cookies and comparable identifiers used for ad attribution through the Meta Conversions API (CAPI) on a hashed-identifier basis.

What we do not touch: your contact list, your photo gallery, your SMS messages (aside from a single OTP if you choose to switch on 2FA), or anything beyond the categories above. NPC Circular 2022-02 forbids harvesting that kind of data, and we abide by it.

• To pair you with one or more suitable SEC-licensed partner lenders and forward your application to them for credit scoring and lending decisions.
• To confirm who you are and to cut down on fraud.
• To keep you informed about where your application stands and which partner lender you have been paired with.
• To gauge how well our advertising performs and to credit conversions back to the campaigns that produced them, via the Meta Pixel and CAPI.
• To meet our record-keeping duties under R.A. 10173 and the relevant NPC and SEC frameworks.
• To run the optional Pruba rewards programme: if you take part, your first name and the initial of your surname may appear on an in-app leaderboard visible to other signed-in participants. You can hide yourself from the leaderboard at any time with the «Huwag akong ipakita» control inside the game, and rewards are never a condition of, and have no effect on, any lending decision.

• Consent (DPA sec. 3(b)) — underpinning the collection of your identity, contact, and financial data and its onward sharing with matched SEC-licensed partner lenders for credit decisioning. You grant that consent by ticking the agreement box on the matching form.
• Contractual necessity (DPA sec. 12(b)) — for the processing without which we could not deliver the matching service you asked for.
• Legal obligation (DPA sec. 12(c)) — for record-keeping mandated by R.A. 10173 and any applicable regulatory reporting.
• Legitimate interest (DPA sec. 12(f)) — for guarding against fraud and for marketing analytics, weighed against your rights.

You are free to withdraw consent whenever you wish, by writing to general@virixlabs.com. A withdrawal has no retroactive effect on processing already carried out or on processing that rests on a different lawful basis. And once your data has passed to a matched partner lender, you will also need to approach that lender directly to exercise your rights over the data it holds.

• SEC-licensed partner lenders — the lenders we introduce you to. With your consent, we forward your application over a secure API to one or more of them. Each such lender is an independent controller, and its own privacy notice governs any further processing on its side. We disclose your data only to lenders you have actually been matched with — never scattered indiscriminately.
• Meta Platforms, Inc. — hashed identifiers (SHA-256 of your email and phone), event metadata, and the Meta Click ID are sent through the Conversions API for advertising attribution. We never transmit your identity data to Meta in unhashed form.
• Hosting and infrastructure suppliers — Vercel Inc. (web hosting), Contabo GmbH (proxy and server infrastructure), and storage providers, all acting as Personal Information Processors and bound strictly by contract.
• Public authorities — where the law compels us (a court order, an NPC investigation, an SEC inquiry, a BIR audit, or an AMLC request).

We never sell your personal data, and we do not hand it to marketing partners beyond the attribution platforms named just above. Neither do we pass it to debt collectors — recovery on any loan is handled solely by the partner lender that granted it, under that lender's own privacy notice and the applicable SEC rules on unfair collection.

A number of our processors sit outside the Philippines (Vercel in the United States, Contabo in Germany, Meta in the United States and Ireland). For each of those transfers we lean on contractual safeguards — Standard Contractual Clauses or their equivalent — and on the recipient's undertaking to protect the data to a standard comparable with the DPA. On request, our DPO can provide you with a copy of the relevant safeguards.

• Application data forwarded to partner lenders: kept by each partner lender on its own schedule (the life of the loan plus whatever period the law requires).
• Application metadata held by Aprubado: 24 months from the date of submission, unless you ask for earlier deletion and no legal duty compels us to retain it.
• Meta Pixel / CAPI hashed identifiers: held by Meta under its own policy.
• Logs and security records: 12 months.

Sections 16–18 of the DPA give you the right to be informed, to access, to have data corrected, to have it erased or blocked, to object, to data portability, to claim damages, and to lodge a complaint with the National Privacy Commission at privacy.gov.ph.

To act on any of these rights over data that Aprubado holds, email general@virixlabs.com; we reply inside 15 calendar days. For rights over data that has already moved to a matched partner lender, please contact that lender directly, using the DPO details set out in its own privacy notice.

We apply organisational, physical, and technical measures scaled to how sensitive the data is: encryption in transit (TLS), encryption at rest, access logging, least-privilege administrative access, disciplined secrets management, routine vulnerability review, and a written breach-response plan. Should a personal data breach occur that is likely to cause serious harm, we will inform the NPC and the affected data subjects within 72 hours, as NPC Circular 16-03 requires.

aprubado.ph relies on first-party session storage together with the Meta Pixel for advertising attribution and product analytics. You can opt out of advertising cookies by changing your browser settings, or by emailing the DPO to have your hashed identifiers excluded from CAPI-based attribution.

The loans offered by our partner lenders are open only to Filipino citizens aged 21 and above. We do not knowingly gather data from anyone under 18. If you have reason to think we have collected a minor's data, tell the DPO and we will delete it.

We may update this policy to keep pace with changes in the law, in regulation, or in our own practices. Where a change is significant, we will flag it on this page. The “version dated” line at the top always identifies the edition currently in force.

• Aprubado Data Protection Officer: general@virixlabs.com
• A matched partner lender (for data already forwarded to it): see the DPO contact given in that lender's own privacy notice.
• National Privacy Commission: privacy.gov.ph · complaints@privacy.gov.ph