Privacy Policy of CatchKash

1. Introduction

CatchKash is owned and managed by CREDEBIT LENDING INVESTOR CORPORATION (SEC Registration Number: CS201903142, Certificate of Authority No. 2897). At CatchKash (“Company,” “we,” “our,” or “us”), protecting your personal data is a priority. This Privacy Policy describes how we gather, process, and safeguard your information when you use our Android mobile lending application and related services, in accordance with the Philippine Data Privacy Act (RA 10173), Google Play policies, and other applicable standards.

2. Types of Information We Collect

A. Information You Provide Directly
During your application and account registration, you may share the following details:

• Full legal name, date of birth, and gender
• Government-issued identification details
• Contact details such as phone number, email, and residential address
• Employment status, income range, and educational history
• Religious affiliation (optional, if provided)
• Emergency contact details (name, phone, relationship)
• Bank or e-wallet account information for loan disbursement and repayment

We use this data for:

• Verifying your identity and checking against third-party databases
• Assessing loan eligibility and creditworthiness
• Detecting and preventing fraud and high-risk activities
• Delivering relevant service updates and offers
• Handling user concerns, complaints, or inquiries
• Improving user experience and tailoring our services
• Meeting our legal and compliance obligations

B. Information From External Sources
With your consent, we may obtain supplemental information from credit bureaus, identity verification providers, or similar services. This helps confirm your profile, evaluate repayment capacity, and minimize fraudulent applications. All transfers are conducted over secure HTTPS protocols. We do not disclose your personal data to third parties without your authorization.

3. Data Security and Storage

All data transmitted through CatchKash is encrypted using 128-bit SSL and stored securely on our servers via protected HTTPS connections: https://qutro.catchkash.com/. We employ periodic audits, role-based access control, and strict monitoring to prevent unauthorized access.

4. Permissions and Access

• Camera – Required only for capturing ID photos and live selfies during KYC verification. No existing images or videos are accessed.
• Contacts (Emergency contacts only) – You may nominate up to five contacts to support loan verification and risk evaluation. Only the selected entries are collected; the full contact list is never uploaded.
• Notifications (POST_NOTIFICATIONS) – Used to deliver alerts, payment reminders, and account updates. You can control notification settings within your device.
• Installed Apps Metadata – With consent, CatchKash may collect non-sensitive metadata (e.g., app names, package IDs) to assess borrowing eligibility and provide more suitable loan recommendations.
• Location (GPS and network-based) – Used to confirm identity, prevent fraudulent login attempts, and enhance account security.
• Network & Device Information –
  • ACCESS_WIFI_STATE: Evaluates Wi-Fi environment to detect unusual access.
  • ACCESS_NETWORK_STATE: Reviews network type and connection stability.
  • Advertising ID (AD_ID): May be used for tracking marketing effectiveness, and you may opt out via your device settings.

5. Why We Use Your Data

The information we collect serves the following purposes:

• Processing loan applications and disbursements
• Verifying applicant identity and creditworthiness
• Detecting fraud and ensuring system integrity
• Complying with laws (e.g., anti-money laundering regulations)
• Sending product updates and promotional offers (optional)
• Improving overall service quality and reliability

6. Safeguarding Your Data

We apply multiple layers of protection including:

• Encryption of all transmissions
• Access controls restricted to authorized staff
• Continuous monitoring of system integrity
• Regular internal reviews and compliance checks

7. Your Privacy Rights

In line with the Philippine Data Privacy Act, you may exercise the following rights:

• To be informed about how your personal information is collected and processed
• To access and request a copy of your data
• To request correction of inaccurate or outdated records
• To object to or restrict processing under certain conditions
• To request deletion of your account and data, unless retention is legally required
• To file complaints with the National Privacy Commission if your rights are violated

8. Retention and Account Deletion

When you request account deletion, your personal records will be erased from our active systems, except for data we are legally required to retain (e.g., for audit or compliance).

• Irreversibility: Once removed, your account and related records cannot be restored.
• Legal Retention: Only minimal information is preserved to comply with statutory obligations.