Privacy Notice

aprubado.ph is operated by Virix Labs. Full legal entity details are at the bottom of this notice under “Operating entity”.

Aprubado is a loan-matching and comparison service — it is not a lender. We connect you with SEC-licensed partner lenders who make all credit decisions, disburse funds, and handle repayment and collection. Aprubado does not lend money, does not decide who gets a loan, does not set the price of any loan, does not disburse funds, and does not collect debt. We also do not charge borrowers for using this service.

For the data you provide to Aprubado (browsing this site, filling in the matching form, marketing analytics), Virix Labs is the Personal Information Controller (PIC). When we match you with a partner lender and, with your consent, share your application data with that lender, the partner lender becomes an independent Personal Information Controller of the data it receives, and its own privacy notice governs its further processing.

In plain English: until you press Apply Now, the data is with us. When you press Apply Now, your data is shared with the matched SEC-licensed partner lender(s), who then control the processing of your application on their side.

We collect only what is necessary to match you with a suitable partner lender and forward your application. Specifically:

• Identity data: full name, date of birth, gender, government-issued ID type and number.
• Contact data: mobile phone number, email address.
• Financial data: requested loan amount, term, employment information, monthly income, GCash or bank account number for disbursement by the matched lender.
• Application metadata: session identifiers, IP address, browser/device fingerprint, UTM source/medium/campaign, Meta Click ID (fbclid), referrer, timestamps, application progress events.
• Marketing identifiers: Meta Pixel cookies and equivalent identifiers used for advertising attribution via the Meta Conversions API (CAPI) under hashed-identifier matching.

We do not read your contact list, photo gallery, SMS messages (beyond a one-time OTP if you opt into 2FA), or any data not listed above. NPC Circular 2022-02 prohibits such collection; we comply.

• To match you with one or more suitable SEC-licensed partner lenders and pass your application to them for credit scoring and loan-issuance decisioning.
• To verify your identity and reduce fraud.
• To communicate with you about your application status and which partner lender you have been matched with.
• To measure advertising effectiveness and attribute conversions to the campaigns that drove them — via Meta Pixel and CAPI.
• To comply with regulatory record-keeping under R.A. 10173 and applicable NPC and SEC frameworks.

• Consent (DPA sec. 3(b)) — for collection of your identity, contact and financial data, and sharing it with matched SEC-licensed partner lenders for credit decisioning. You give consent by ticking the agreement checkbox on the matching form.
• Contractual necessity (DPA sec. 12(b)) — for processing required to provide the matching service you requested.
• Legal obligation (DPA sec. 12(c)) — for record-keeping under R.A. 10173 and applicable regulatory reporting.
• Legitimate interest (DPA sec. 12(f)) — for fraud prevention and marketing analytics, balanced against your rights.

You may withdraw consent at any time by emailing dpo@virixlabs.com. Withdrawal does not affect processing that has already taken place or processing under another legal basis. Once your data has been shared with a matched partner lender, you must also contact that lender directly to exercise rights over the data it holds.

• SEC-licensed partner lenders — the lenders we match you with. With your consent, we pass your application to one or more partner lenders via secure API. Each partner lender is an independent controller, and its own privacy notice governs further processing on its side. We share your data only with lenders you have been matched with — never indiscriminately.
• Meta Platforms, Inc. — hashed identifiers (SHA-256 of email/phone), event metadata, and the Meta Click ID are transmitted via the Conversions API for advertising attribution. We do not transmit unhashed identity data to Meta.
• Hosting and infrastructure providers — Vercel Inc. (web hosting), Contabo GmbH (proxy and server infrastructure), and storage providers as Personal Information Processors strictly under contract.
• Authorities — when legally compelled (court order, NPC investigation, SEC inquiry, BIR audit, AMLC request).

We do not sell your personal data and we do not share it with marketing partners other than the attribution platforms named above. We do not share it with debt collectors — collection of any loan is performed solely by the partner lender that granted it, under that lender's own privacy notice and the applicable SEC unfair-collection rules.

Some of our processors are located outside the Philippines (Vercel in the US, Contabo in Germany, Meta in the US and Ireland). For each such transfer we rely on contractual safeguards (Standard Contractual Clauses or equivalent) and the receiving party's commitments to protect the data at a level comparable to the DPA. You may request a copy of the relevant safeguards from our DPO.

• Application data shared with partner lenders: retained by each partner lender under its own schedule (life of the loan plus the legally required period).
• Application metadata held by Virix: 24 months from submission, unless earlier deletion is requested and no legal obligation requires retention.
• Meta Pixel / CAPI hashed identifiers: retained by Meta under their own policy.
• Logs and security data: 12 months.

Under sections 16–18 of the DPA, you have the right to: be informed, access, correct, erase or block, object, port your data, claim damages, and file a complaint with the National Privacy Commission at privacy.gov.ph.

To exercise any of these rights over data held by Aprubado, email dpo@virixlabs.com. We respond within 15 calendar days. For rights regarding data already shared with a matched partner lender, contact that lender directly using the DPO details in its own privacy notice.

We implement organisational, physical, and technical safeguards proportionate to the sensitivity of the data: TLS in transit, encrypted storage, access logging, least-privilege admin access, secrets management, regular vulnerability review, and a documented breach-response procedure. In the event of a personal data breach likely to result in serious harm, we will notify the NPC and affected data subjects within 72 hours per NPC Circular 16-03.

aprubado.ph uses first-party session storage and the Meta Pixel for advertising attribution and product analytics. You may opt out of advertising cookies by adjusting your browser settings or by emailing the DPO to request exclusion from CAPI-based attribution for your hashed identifiers.

Loans offered by our partner lenders are available only to Filipino citizens aged 21 and above. We do not knowingly collect data from anyone under 18. If you believe we have collected data from a minor, please contact the DPO and we will delete it.

We may amend this notice to reflect changes in law, regulation, or our practices. Material changes will be highlighted on this page. The “last updated” date at the top always reflects the current version.

• Virix Labs Data Protection Officer: dpo@virixlabs.com
• Matched partner lender (for data already shared with a lender): refer to the DPO contact in that lender's own privacy notice.
• National Privacy Commission: privacy.gov.ph · complaints@privacy.gov.ph