Privacy notice

Last updated 29 July 2026 · Version 1.0

This notice explains what personal data NovaSkot collects when you use the eligibility assessment and document upload, why we collect it, who we share it with, how long we keep it, and the rights you have under the Data Privacy Act of 2012 (Republic Act No. 10173).

1. Who is responsible for your data

The Personal Information Controller is FoundersGroup LLC, a limited liability company registered in Delaware, United States under file number 1312313141, with registered address at 10001 Lewes Road, Wilmington, DE 19709, United States.

This service is offered to residents of the Philippines. Although we are established abroad, we process your personal data in accordance with the Data Privacy Act of 2012, which applies to the processing of personal information about Philippine residents.

Our Data Protection Officer can be reached at skio@support.co or +1 412 313 1314. Contact the DPO about anything in this notice, including requests to access or delete your data.

2. What we collect

From the eligibility assessment:

• Identity and contact details — your name, email address, mobile number, and the city and province where you live.
• Work and income information — the kind of work you do, how long you have earned from foreign clients, income ranges, how consistent your income is, how many clients pay you, and the platforms you are paid through.
• Financing needs — the amount and type of financing you are interested in, your timing, and what you would use it for.
• Borrowing history and financial profile — past applications and outcomes, existing monthly repayments, whether you have overdue balances, your BIR and DTI/SEC registration status, tax filing, and which banks you use.

If you continue to income verification, we also collect:

• Documents you upload — bank statements, payment-platform records, and optionally client contracts or invoices. These contain transaction dates, amounts, payer names, and account details.
• Context you give us — which accounts receive contractor income, the names that pay you, and any deposits you tell us are unrelated to work.

We also record your browser's user-agent string and a one-way hash of your IP address. The hash is used only to limit how many submissions can come from one connection; we do not store the IP address itself.

If you reached us from an advertisement or another website, we record the campaign information contained in the link you followed — such as the campaign name and the identifier the advertising platform adds — along with the address of the site that referred you. This tells us which adverts bring people to the assessment. It is not used to build a profile of you, and it is not combined with information from other sites.

3. Why we collect it

• To assess whether your contractor income may qualify you for financing.
• To verify recurring income, measure its stability, and identify payment sources from the documents you upload.
• To prepare a contractor income summary for your review.
• To contact you about your assessment, including asking for clarification.
• To understand, in aggregate, how contractors paid by foreign clients are served by existing lenders. Research outputs never identify you.
• To protect the service from automated abuse.

We do not use your data for automated decision-making that produces legal effects, and we do not sell it.

4. Our legal basis

We rely on your consent under Section 12(a) of the Data Privacy Act, given when you tick the confirmations before submitting each step. You may withdraw consent at any time by contacting our DPO; withdrawal does not affect processing already carried out, and it may mean we can no longer assess your eligibility.

Where we protect the service from abuse, we also rely on our legitimate interests under Section 12(f).

5. Who we share it with

Lending partners. We share your information with a lender only when you separately authorise it in writing, for that specific lender. Submitting the forms on this site does not authorise any sharing.

Service providers acting as our Personal Information Processors, under contract and only on our instructions:

• Supabase — database and encrypted file storage, hosted on the west coast of the United States.
• Cloudflare — serving this website, and the human-verification check that protects the forms from automated abuse.

Meta (Facebook), for advertising measurement. When you complete the assessment or upload documents, we tell Meta that a conversion happened so we can measure which of our adverts work. Alongside that we send your email address, mobile number, name and city in a scrambled (hashed) form, which Meta uses to recognise whether you are one of the people who saw the advert. We do not send your income, your financing needs, your answers, or any document you upload — and we never send your email address or number in a readable form. Meta is an independent controller of what it receives, and processes it in the United States under its own terms.

If you would rather this did not happen, a browser-level tracker blocker or an ad blocker will stop the part that runs in your browser. To object to the rest, contact our Data Protection Officer using the details in section 1 and we will exclude you.

We may also disclose data where required by law, by a court, or by a regulator.

Transfers outside the Philippines. Your data is stored and processed in the United States, not in the Philippines, and our organisation is established there. We remain accountable for your data under the Data Privacy Act wherever it is processed, and we require contractual safeguards from every processor we use.

6. How long we keep it

• Eligibility answers — 24 months from submission.
• Uploaded documents — 12 months from upload, or sooner on request.
• Abuse-prevention hashes — 24 hours.
• Incomplete uploads — deleted after 7 days.

After the retention period we delete the records and the stored files. Anonymised, aggregated statistics that cannot identify you may be kept indefinitely.

7. How we protect it

Data is sent over an encrypted connection and stored encrypted at rest. Uploaded documents sit in a private store that is not reachable by public link; access requires a credential held only by our systems. Access is limited to staff who need it for the purposes above. Your browser is never given permission to read other people's submissions.

No system is perfectly secure. If a breach occurs that puts you at real risk of serious harm, we will notify you and the National Privacy Commission as required by law.

8. Your rights

Under the Data Privacy Act you have the right to:

• Be informed that your data is being processed, and why.
• Access the data we hold about you.
• Object to processing, including withdrawing consent.
• Rectify data that is inaccurate or out of date.
• Erasure or blocking — have your data removed or its processing suspended.
• Data portability — receive your data in a structured, commonly used electronic format.
• Damages — be compensated for harm caused by inaccurate, unlawfully obtained, or unauthorised use of your data.
• Lodge a complaint with the National Privacy Commission.

To exercise any of these, email our DPO at skio@support.co. We will respond within 15 calendar days. We may ask you to confirm your identity first, so that nobody else can obtain your financial records.

If you are not satisfied with our response, you may complain to the National Privacy Commission at privacy.gov.ph.

9. Cookies and local storage

We use the Meta (Facebook) advertising pixel to measure our advertising. It sets cookies in your browser and tells Meta when you visit this site and when you complete the assessment or upload documents. We do not use any other analytics or advertising cookies. While you are filling in the forms, your answers are held in your browser's session storage so that a refresh does not lose your progress; this is cleared when you submit and when you close the tab.

If you press Save My Answers on the document upload page, a copy of those answers is also kept in your browser's local storage so that you can close the tab and return to it. That copy stays on your device only — it is never sent to us — and it is deleted automatically after 7 days, when you submit the form, or as soon as you press Delete saved answers. Your uploaded files are never saved in your browser. Because this copy outlives the tab, please use it only on a device that is yours.

The human-verification check sets its own cookie, which is necessary for the service to work.

10. Children

This service is for adults. We do not knowingly collect data from anyone under 18. If you believe a minor has submitted information, contact our DPO and we will delete it.

11. Changes to this notice

If we change how we handle your data we will update this page and its version number. Where the change is significant we will contact you using the details you gave us.