Legal · RA 10173

Privacy Policy

We collect only what we need to make TUPAD work. Your data is yours — private by default, shared only when you choose.

Effective: June 7, 2026 Last updated: June 7, 2026 Governed by RA 10173
Plain language summary: TUPAD is a loan documentation tool. We collect identity information to verify who you are, and loan information to generate your agreements. We do not sell your data. We do not hold or move your money. Your trust score is private by default and shared only when you choose to present it.

01 Who We Are

TUPAD is a private loan documentation tool operated in the Philippines. We are committed to full compliance with the Data Privacy Act of 2012 (RA 10173) and are currently completing our registration with the National Privacy Commission (NPC) as a Personal Information Controller (PIC).

TUPAD is not a bank, lender, financing company, Online Lending Platform, or payment processor. We do not hold, move, or guarantee funds of any kind. All financial transactions happen directly between users via GCash, Maya, cash, or bank transfer.

Registered Data Privacy Officer: privacy@tupad.app

02 What We Collect

We collect the minimum information needed to operate the service. Here is exactly what we collect and why:

Data category What specifically Why we collect it
Account information Email address, phone number, password (hashed) To create and secure your account
Identity / KYC Full legal name, government ID type and number, ID photo, selfie for liveness check To verify your identity before agreements are signed — required by RA 10173 for documentation services
Loan agreement data Loan amount, purpose, due date, interest rate, repayment method, counterparty name and contact To generate and store your loan agreements
Payment proof Images or screenshots uploaded as proof of payment (GCash, Maya, bank transfer, cash) To timestamp and store fulfillment records for both parties
Network / connections Contacts you invite, phone numbers of people you transact with To build your lending circle and enable mutual confirmation
Device and usage Device type, OS version, app usage patterns, crash logs To maintain and improve the app
Email (website only) Email address submitted via the early access form on tupad.app To notify you when the app is available — one email, nothing else
KYC is triggered by your first transaction, not at signup. You can create an account and explore the app before providing identity documents. KYC is only required when you initiate or confirm a loan agreement.

03 How We Use Your Data

  • To generate loan agreements — your name, the counterparty's name, and the agreed terms are used to create the signed document both parties receive
  • To verify identity — KYC data is reviewed to confirm you are who you say you are before any agreement is signed
  • To store fulfillment records — payment proof uploads are timestamped and stored so both parties have a permanent record
  • To calculate your trust score — your loan and repayment history on TUPAD is used to generate a private trust score that reflects your behavior as a lender and borrower
  • To operate and improve the service — usage data and crash logs help us fix bugs and improve the experience
  • To communicate with you — we send transactional notifications (agreement confirmations, repayment reminders) and, only if you opted in, product updates

We do not use your data for advertising, third-party profiling, or any purpose not listed above.

04 What We Don't Do

These are absolute. Not "usually" or "as a policy" — we do not do these things.
  • We do not sell your data — to anyone, ever, for any price
  • We do not share your KYC documents — your government ID and selfie are used only for internal identity verification and are never shared with counterparties or third parties
  • We do not show your trust score to others without your consent — your score is private by default; you choose when and to whom to present it
  • We do not make credit decisions — TUPAD does not approve, decline, or recommend anyone for a loan; we document agreements between parties who have already decided to transact
  • We do not hold or move money — all payments happen directly between users; TUPAD never touches funds
  • We do not share your data with advertisers — TUPAD has no advertising business model

05 Sharing Your Data

We share data only in the following circumstances:

  • With your counterparty, as part of a loan agreement — when you record a loan, the other party sees your name, contact number, and the agreed terms. They do not see your government ID or trust score unless you choose to share it.
  • With service providers who operate TUPAD — we use Supabase for database and authentication, and similar infrastructure providers. These providers process data only on our behalf under strict data processing agreements and may not use your data for their own purposes.
  • When required by Philippine law — we will comply with valid court orders, NPC directives, or lawful government requests. We will notify you if legally permitted to do so.
  • In the event of a merger or acquisition — if TUPAD is acquired, user data would transfer to the acquirer under the same privacy obligations. We will notify you before any such transfer.

We will never sell, rent, or share your data with third parties for marketing, advertising, or any commercial purpose not described above.

06 Storage & Security

Your data is stored on secured cloud infrastructure with the following protections:

  • Encryption in transit — all data transferred between your device and our servers uses TLS encryption
  • Encryption at rest — stored data is encrypted at the database level
  • Row-level security — our database is configured so that each user can only access their own records; no user can read another user's data
  • Access controls — only authorized TUPAD personnel with a legitimate operational need can access user data
  • KYC document handling — identity documents are stored in a separate, access-controlled environment and reviewed only during the KYC approval process

We retain your data for as long as your account is active. If you close your account, we will delete your personal data within 30 days, except where retention is required by Philippine law.

07 Your Trust Score

Your trust score is generated from your loan and repayment activity on TUPAD. It reflects your behavior as a lender and borrower within your lending circle.

  • Private by default — your score is not visible to other users unless you choose to present it
  • Not a credit score — your trust score is an informational record of your TUPAD activity; it is not a creditworthiness determination and is not reported to credit bureaus
  • Formula not disclosed — the calculation method is proprietary and is not shared publicly to prevent gaming
  • Yours to keep — your score history belongs to you; you can request a copy of your score data at any time
  • Future portability — in Phase 4, TUPAD may offer an opt-in API that lets you share your score with rural banks, cooperatives, or microfinance institutions. This will always be opt-in only and will never happen without your explicit consent

08 Your Rights Under RA 10173

As a data subject under the Data Privacy Act of 2012, you have the following rights:

Right to be informed
You have the right to know what data we collect and how we use it — which is what this document is for.
Right to access
You can request a copy of all personal data we hold about you at any time. Email privacy@tupad.app.
Right to correction
You can request corrections to any inaccurate personal information we hold about you.
Right to erasure
You can request deletion of your personal data. We will comply within 30 days, except where retention is required by law.
Right to data portability
You can request your data in a structured, commonly used format so you can transfer it to another service.
Right to object
You can object to certain processing of your data — for example, you can opt out of non-transactional communications at any time.
Right to lodge a complaint
If you believe we have violated your rights, you may file a complaint with the National Privacy Commission at privacy.gov.ph.
Right to damages
You are entitled to compensation for damages caused by inaccurate, incomplete, or unauthorized use of your personal data.

To exercise any of these rights, contact our Data Privacy Officer at privacy@tupad.app. We will respond within 15 business days.

09 Children

TUPAD is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has created an account or submitted data through TUPAD, please contact us at privacy@tupad.app and we will delete the data promptly.

10 Changes to This Policy

We may update this Privacy Policy as the product evolves. When we make material changes, we will notify you via:

  • An in-app notification on your next login
  • An email to the address on your account
  • An updated "Last updated" date at the top of this page

Continued use of TUPAD after a policy update constitutes acceptance of the revised terms. If you disagree with a change, you may close your account and request deletion of your data.

11 Contact Us

For any questions, requests, or concerns about your privacy or this policy, contact our Data Privacy Officer:

TUPAD is committed to full compliance with the Data Privacy Act of 2012 (RA 10173). Our NPC registration as a Personal Information Controller and Personal Information Processor is currently in progress.