Your Privacy Matters

§Overview

This is a plain-language summary of our privacy practices. The sections that follow contain the full legal text.

Who we are

Loanova is a mobile lending platform operated by Leaflending Inc., a company registered with the Philippine Securities and Exchange Commission as a Lending Company under RA 9474.

What we stand for

We only gather information that is genuinely necessary to offer you a loan, meet our legal obligations, and keep the platform secure. We take nothing without your permission. We do not make money from your data — we never sell, rent, or trade it. We do not comb through your contacts or call history. We do not reach out to your family, friends, or employer about your loan.

Why we need data from you

The information you share lets us confirm your identity (as Philippine law requires), evaluate whether a loan is right for your circumstances, report to the Credit Information Corporation as mandated, and protect your account from fraud.

Your choices

You can ask to see the data we hold, have mistakes corrected, request deletion (we may need to keep some records to comply with the law), object to certain types of processing, and pull back any consent you have given. On Android, you can also manage each individual App permission through your device Settings at any time.

How to contact us

For questions about your privacy, write to our DPO at dpo@leaflendinginc.com.

01Introduction and Corporate Information

This Privacy Policy (the "Policy") sets out how Leaflending Inc. ("we", "us", "our", or "the Company"), the operator of the mobile application "Loanova" (the "App" or the "Platform"), handles your personal information — from collection through to deletion.

This Policy is issued under the Data Privacy Act of 2012 (RA 10173) and its Implementing Rules and Regulations, relevant NPC issuances, the Lending Company Regulation Act (RA 9474), the Truth in Lending Act (RA 3765), the Credit Information System Act (RA 9510), the Anti-Money Laundering Act (RA 9160 as amended), the Financial Products and Services Consumer Protection Act (RA 11765), applicable SEC Memorandum Circulars (including MC 2019-14, 2019-18, 2021-10, 2023-05), and the Google Play Developer Program Policies. Using the Loanova App means you have read and accepted this Policy.

1.1 Company Information

• Legal name: Leaflending Inc.
• Brand / App: Loanova
• SEC Company Registration No.: 2024120181312-01
• SEC Certificate of Authority No.: L-24-0801-50
• Type of regulated entity: Lending Company (RA 9474)
• Registered office: 8G, SALCEDO ONE CENTRE (FORMERLY BUILDER'S CENTER) 170 SALCEDO ST. LEGASPI VILLAGE SAN LORENZO, CITY OF MAKATI, FOURTH DISTRICT, NATIONAL CAPITAL REGION (NCR), 1223
• DPO email: dpo@leaflendinginc.com
• Customer Service email: loanova@leaflendinginc.com

Loanova is registered as an Online Lending Platform per SEC Memorandum Circular No. 10, Series of 2021.

1.2 Scope of This Policy

This Policy applies exclusively to data gathered through our Platform. It does not cover external websites or services. If anything in this Policy raises a concern, please write to our DPO at dpo@leaflendinginc.com.

02What We Do NOT Collect or Access

To be completely clear, the Loanova Android App does not access, collect, store, process, or transmit the following:

2.1 Your Contacts Stay Private

We never touch your phone's contact list or address book. The App does not request the READ_CONTACTS permission. We do not keep or use any list of your reference persons, relatives, friends, or other contacts — for any reason.

2.2 Personal Messages Are Off-Limits

We never access, read, or copy your personal SMS, MMS, or messages from messaging apps (Messenger, WhatsApp, Viber, Telegram, etc.). The only SMS access the App requests is limited to financial institution alerts — details in Section 3.1.

2.3 Your Call History Is Not Touched

We never access, read, or copy your call logs, call history, or call durations. The App does not request the READ_CALL_LOG permission.

2.4 We Only Talk to You About Your Loan

We will never contact your family, friends, employer, colleagues, neighbors, or anyone else to collect a debt. All communication about your loan is between you and us.

2.5 Photo Access Is Limited to Your Selection

When you upload an image (like your government ID), the App uses the Android system file picker. You select a single image; we never browse your full photo library or file storage.

2.6 Clipboard and Browsing Data Are Not Read

We never read your clipboard contents or your browsing history from other apps or websites.

2.7 No Cross-App Tracking

The App does not track your activity across other applications. Any device identifiers the platform provides stay within Loanova and do not enable other apps to follow you.

These commitments reflect our internal policy, applicable SEC regulations, NPC issuances, and Google Play Developer Program Policies.

03Personal Information We Collect

3.1 Categories of Information

We collect only what is necessary to provide the Service, comply with applicable law, and protect against fraud:

• Identity data: full name, date of birth, gender, nationality, educational attainment, number of dependents, marital status.
• Contact data: mobile number, email address, residential address.
• Socio-economic data: self-reported income, employment status, employer details, housing status.
• Loan application data: loan amount requested, purpose of loan, and your prior loan history with us.
• Sensitive Personal Information under DPA §3(l): government-issued identification (PhilID, UMID, Driver's License, Passport, SSS, PRC, etc., including image and ID number) and biometric data (selfie image and any biometric template derived from selfie liveness verification, stored in one-way hashed form). Marital status is also classified as Sensitive Personal Information.
• Financial data: bank or e-wallet account number and account name; credit data retrieved from the Credit Information Corporation (CIC) under RA 9510; and your loan and repayment history with the Company.
• Financial SMS data: the App may request permission to read SMS messages received on your device, but only structured financial SMS notifications (such as bank alerts, transaction receipts, and e-wallet confirmations) sent by recognized financial institutions identified by their sender codes or names. The App filters this process to extract only transaction-related data (amounts, dates, and sender identity); personal or non-financial messages are never read. This data is used solely for automated verification of loan disbursements and repayments, and for fraud prevention. The App does not read, collect, or process any SMS messages from personal contacts, messaging apps (such as Messenger, WhatsApp, Viber, or Telegram), or any source other than recognized financial institutions. This permission is requested separately and you may decline it without affecting your ability to apply for a loan (though it may limit certain fraud-prevention features).
• Device integrity signals: the App may request permission to analyze limited device-level security signals for fraud prevention and security verification. This involves point-in-time integrity checks for device-level indicators associated with security risks — such as applications linked to device security risks, unauthorized remote access or device control tools, or indicators of device compromise. The App does not upload or retain a complete inventory of installed applications. The App does not access app contents, user activity, or private app data. The App does not build cross-application behavioral profiles. The App does not use special Android package visibility permissions. This permission is requested separately and you may decline it without affecting your ability to apply for a loan. Declining optional permissions will not affect your loan eligibility in any way.
• Location data: approximate location only, such as country, city, or regional-level information, derived from IP address or coarse-level system location services, while the App is in use. We do not continuously track or collect your precise geographic location (GPS coordinates). Location information may be obtained through your device's operating system location services or third-party providers such as Google Location Services. We use this information for determining your country or region; complying with applicable Philippine laws and regulations; fraud prevention and risk management; and improving product functionality and user experience. You may disable location permissions at any time through your device settings. Certain features may become unavailable if location access is disabled.
• Device and technical data: device model, brand, OS version, screen size, storage and memory; system state such as battery, uptime, language, and detection of simulators, rooted devices, and VPN/proxy use; network type; Android advertising ID (which you can reset or delete through your device's settings) and other platform-provided device identifiers that are local to the App and do not enable cross-application tracking; platform-provided fraud-prevention and application-integrity tokens (such as Google Play Integrity API responses); the IP address received by our server; and in-session behavioral signals used for fraud detection (form completion timing, keyboard type, automated-input detection). Where attribution measurement is used in connection with marketing activities, we rely on privacy-preserving frameworks provided or permitted by the Android operating system and Google Play services.
• Usage data: in-app actions, screens viewed, taps, application flow steps completed, timestamps, and application performance and stability metrics (including crash logs and ANR — Application Not Responding — reports).

3.2 Android Permissions

The App requests the following Android permissions. Each permission is requested at runtime with a clear explanation of why it is needed, and you may grant or deny each individually:

3.3 Where Information Comes From

We primarily collect personal information directly from you. Where the law permits — and where required, with your consent or another valid legal ground — we may also receive information from:

• the Credit Information Corporation (CIC) and other accredited credit bureaus, credit reporting agencies, and credit reference agencies;
• identity verification, biometric liveness, and document-authentication providers;
• fraud-prevention databases, anti-money-laundering screening providers, and sanctions / politically-exposed-persons watchlist providers;
• banks, e-wallet providers, and other financial institutions from which you have authorized us to obtain account or transaction information;
• government agencies and authorities acting within their lawful functions; and
• any other source that you have specifically authorized, or from which the receipt of information is otherwise expressly permitted by Philippine law.

Information received from these sources is processed only for the purposes described in Section 4 and subject to the same protections that apply to information you provide directly.

3.4 Legal Bases for Processing

We process your data under these legal bases: performance of our loan contract with you; legal obligations under AMLA, RA 9474, RA 9510, RA 11765, and SEC rules; your explicit consent for Sensitive Personal Information and for marketing communications; and our legitimate interest in fraud prevention, security, and responsible lending.

Sensitive Personal Information is processed based on your explicit consent given separately at the relevant point in the application flow, together with the legal obligations referred to above.

04How We Use Your Information

We process your personal information for the following purposes:

• Identity Verification (KYC): to verify your identity in compliance with AMLA and SEC Customer Due Diligence requirements. This helps prevent identity theft and ensures that the person applying for a loan is who they claim to be.
• Credit Assessment: to evaluate your loan application using your credit report from CIC and other authorized credit bureaus, as required for responsible lending under Philippine law. We do not use device contacts, personal SMS, or call logs in our credit evaluation.
• Transaction Verification: where you have granted SMS permission, to automatically verify loan disbursement receipts and repayment confirmations by reading SMS messages sent by financial institutions. This permission is optional; declining it does not affect your loan application.
• Loan Disbursement and Servicing: to disburse approved loans, generate repayment schedules, process repayments, and manage your account.
• Debt Collection from You Directly: in accordance with SEC MC 2019-18, MC 2023-05, and other applicable regulations; we contact only you, the borrower.
• Fraud Prevention and Information Security: to prevent identity theft, account takeover, money laundering, and other unlawful activity. This includes analyzing device integrity signals (where permitted) and financial SMS data (where permitted) to verify transaction authenticity and detect security risks. Device-level signals are used solely for security verification, not for credit decisions.
• Regulatory Compliance: including reporting to the SEC, CIC, AMLC, BIR, NPC, and any other competent authority pursuant to law.
• Customer Support and Complaint Handling: including via our Financial Consumer Protection Assistance Mechanism ("FCPAM") under SEC MC 2023-05.
• Service Improvement: analyzing aggregated, de-identified usage data to improve App functionality, stability, and security.
• Marketing Communications: only where you have given separate, freely revocable opt-in consent (Section 9.2).

4.1 Automated Decision-Making

Your loan application is evaluated, in whole or in part, by automated credit-scoring models. You have the right to request human review of any decision based solely on automated processing, to obtain meaningful information about the logic involved, and to contest the decision. To exercise these rights, contact our DPO.

4.2 What We Do NOT Do

• We do not sell your personal information to any third party for any purpose. Your data is treated as strictly confidential and is used solely for the delivery of our financial products and services.
• We do not contact your contacts, friends, family members, or employer for debt collection (see Section 2.4).
• We do not access, collect, or use device contacts, personal SMS messages, or call logs.
• For device integrity signals and financial SMS, where you grant access, we use this data only for the specific purposes stated in Sections 3.1 and 4. We do not share raw device signal data or SMS content with any third party not bound by a Data Processing Agreement consistent with NPC rules.

05Disclosure of Your Information

We share your personal information only with the following recipients, and only to the extent necessary:

• The Credit Information Corporation (CIC): for mandatory credit data submission and query (RA 9510).
• Regulators and authorities: the SEC, AMLC, BIR, NPC, and other authorities, regulators, courts, tribunals, or law-enforcement agencies — for regulatory reporting, audits, investigations, suspicious-transaction reporting, tax reporting, and any other disclosure required by law or valid legal process.
• Payment providers: banks, e-wallets, and payment service providers — for loan disbursement and repayment.
• Third-party processors: those described in Section 5.1, each engaged under a written Data Processing Agreement consistent with NPC rules.
• Collection agents: authorized collection agents and external counsel acting strictly within fair-collection rules under SEC MC 2019-18 and MC 2023-05, contacting only you, the borrower.
• Successor entities: assignees or transferees in connection with a merger, acquisition, asset transfer, loan-portfolio transfer, securitization, or assignment.

We do not disclose your personal information to any third party for any purpose other than those described in this Section.

5.1 Categories of Third-Party Processors

Each processor is bound by a written Data Processing Agreement consistent with NPC rules and processes personal data solely on our documented instructions. Categories include:

• Cloud hosting and database infrastructure (which may be located within or outside the Philippines; where personal information is transferred outside the Philippines, the destination jurisdiction provides an adequate level of data protection or the transfer is governed by binding contractual safeguards consistent with DPA §21 and NPC rules).
• Identity verification and biometric liveness checking.
• Application stability and performance diagnostics.
• Push notification, SMS, email, and messaging-platform delivery.
• Customer support and complaint-handling tooling.
• Privacy-preserving ad-attribution measurement (no user-level tracking).

A current list of the specific processors engaged for each category is maintained by our Data Protection Officer and is available upon request to dpo@leaflendinginc.com, in line with your right to be informed under DPA §16(a).

06Retention of Personal Data

We retain your personal information, registration, and transaction records (which may be stored with third-party data-storage providers) for the period necessary to fulfill the purposes outlined in this Policy, or up to ten (10) years in adherence with the requirements of the National Privacy Commission and other applicable laws, including but not limited to:

• the Anti-Money Laundering Act of 2001 (RA 9160, as amended) — at least five (5) years after the end of our relationship with you;
• the Civil Code and applicable tax laws — at least ten (10) years from settlement of contractual and transaction records;
• the Credit Information System Act (RA 9510) — for credit data submitted to the CIC; and
• SEC MC 2023-05 — at least five (5) years for complaint records.

We may also retain your personal information for the establishment, exercise, or defense of legal claims, or for legitimate business purposes consistent with standards followed by the applicable industry.

When retention is no longer allowed or required, your personal information will be destroyed in irretrievable and unusable form, in a manner that prevents further processing, unauthorized access, or disclosure. We reserve the right to take necessary actions where removal would hamper our fulfillment of legal obligations.

We will suspend, withdraw, or order the blocking, removal, or destruction of your personal information if we become aware or reasonably suspect that it is incomplete, outdated, false, unlawfully obtained, or used for unauthorized purposes; is no longer necessary; or once you withdraw consent or object to the processing and there is no other legal ground or overriding legitimate interest.

07Data Security and Breach Notification

7.1 Security Measures

We have implemented comprehensive organizational, physical, and technical security measures designed to protect your personal information from accidental or unlawful destruction, loss, alteration, or unauthorized disclosure and access. These measures include:

• Encryption: All sensitive data is encrypted during transmission using TLS 1.2 or higher protocols and stored using AES-256 financial-grade encryption standards.
• Access Control: We enforce the principle of "least privilege," ensuring that access to your data is restricted to authorized employees and partners who require it to perform their specific duties. All access is monitored and logged for auditing purposes. Multi-factor authentication is required for personnel accessing personal data.
• Infrastructure Protection: Our Platform is hosted on secure servers protected by advanced firewalls and intrusion detection systems, with regular vulnerability scans, security stress tests, and Privacy Impact Assessments conducted to ensure system integrity.
• Staff Training: All our employees and personnel undergo mandatory privacy and security training to maintain these security standards and handle your data with the utmost care and confidentiality.
• Processor Agreements: All third-party processors are bound by written Data Processing Agreements consistent with NPC rules.
• Android Keystore: Sensitive data stored on the device is protected using the Android Keystore system, which provides hardware-backed encryption where supported by the device.

7.2 Breach Notification

In the event of a Personal Data Breach likely to cause serious harm, we will notify the National Privacy Commission and the affected data subjects within seventy-two (72) hours of becoming aware of the breach, in accordance with NPC Circular 16-03.

08Your Rights as a Data Subject

8.1 Your Rights under the Data Privacy Act of 2012

Under the Data Privacy Act, you have the following rights, exercisable free of charge:

• Right to be Informed: to be informed whether personal information about you is being or has been processed, and of the purposes, recipients, retention period, and other particulars of such processing, before your data is entered into our processing systems or at the next practical opportunity.
• Right to Access: to request reasonable access to and a copy of the personal information we hold about you, the sources of that information, the recipients to whom it has been disclosed, and the manner in which it has been processed.
• Right to Rectification: to dispute and have corrected any inaccuracy or error in your personal information, and to have us notify any recipients of the inaccurate information of the correction.
• Right to Erasure or Blocking: to suspend, withdraw, or order the blocking, removal, or destruction of your personal information from our systems, subject to our continuing legal and contractual obligations (such as AMLA-mandated retention or an ongoing loan).
• Right to Object: to object to the processing of your personal information, including processing for direct marketing, automated processing, or profiling.
• Right to Data Portability: where processing is by electronic means and based on your consent or contract, to obtain a copy of your personal information in a structured, commonly used, and machine-readable format.
• Right to Damages: to be indemnified for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal information.
• Right to File a Complaint: to file a complaint with our Data Protection Officer or directly with the National Privacy Commission.

8.2 Your Rights under the Credit Information System Act (RA 9510)

In addition to your rights under the Data Privacy Act, you have the following rights with respect to the credit data we submit to or query from the Credit Information Corporation (CIC):

• Right to ready and immediate access to your credit information, subject to any prescribed fee.
• Right to dispute erroneous, incomplete, or misleading credit information.
• Right to a simplified dispute resolution process to fast-track the settlement of disputed credit information.
• Right to be notified of any correction or removal of erroneous, incomplete, or misleading information within five (5) working days from verification, conclusion of investigation, or deletion.
• Right to indemnity in case of unjustified denial of the rights set forth above.
• Right to be notified by us of our obligation, as a Submitting Entity, to submit and disclose your basic credit data to the CIC.
• Right to know the cause of refusal of an application for credit facilities or services, where credit data was used as the basis for refusal.

For CIC matters, you may also refer to the CIC website at https://www.creditinfo.gov.ph.

8.3 Exercising Your Rights

Submit your request to our DPO at dpo@leaflendinginc.com. We will acknowledge within two (2) Business Days and respond substantively within fifteen (15) calendar days, extendable by an additional fifteen (15) days for complex requests with prior notice. Where your request would conflict with a legal obligation (such as AMLA-mandated retention) or our legitimate interest in collecting an outstanding loan, we will explain the basis for any limitation and process the parts of your request we can fulfill.

8.4 Withdrawal of Consent

Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal. Withdrawal will not prevent us from continuing to process your data on other lawful bases (such as contract performance or legal obligation). This means that if you have an outstanding loan, we may continue to process your data as necessary to service that loan and comply with legal requirements, even if you withdraw certain consents.

8.5 Managing App Permissions

On Android, you can manage or revoke individual App permissions at any time through your device's Settings → Apps → Loanova → Permissions. Revoking a permission will prevent the App from accessing the associated data going forward but does not affect data already collected under that permission. Revoking permissions that are optional (SMS, Device Integrity Signals, Location) will not prevent you from using the App or applying for loans. Declining optional permissions will not affect your loan eligibility in any way.

8.6 Account Deletion

You may delete your account at any time through the App: from the Mine tab, tap the Settings icon to enter the Settings page, then tap Delete Account. You may also request deletion by emailing dpo@leaflendinginc.com. If you have any outstanding loan balance — including unpaid principal, accrued interest, fees, or penalties — you must settle all obligations before account deletion can be processed. Once all obligations are cleared, account credentials and non-mandatory data are deleted promptly. Data we are legally required to retain (Section 6) is held in encrypted, access-restricted form for the prescribed period and then securely destroyed.

09Communications

9.1 Channels

Where you provide your mobile number and email, you consent to our communicating with you through SMS, voice call, email, push notification, and in-app notification, for purposes including OTP verification, repayment reminders, account-status updates, service notifications, customer-service responses, and lawful debt-collection communications under SEC MC 2019-18 and MC 2023-05 (made between 6:00 a.m. and 10:00 p.m. Philippine Standard Time).

Messages from us will be sent only from authorized Loanova accounts and will identify the sender. Where messaging delivery is operated by a third-party provider on our behalf, the provider acts only under our written instructions and on accounts we control.

9.2 Marketing

We will send you marketing communications only if you have given prior, free, specific, informed, and separate opt-in consent (a stand-alone opt-in, not bundled with the loan application). You may opt out at any time.

9.3 Opting Out

You may opt out of marketing communications at any time by replying "STOP" to the relevant message, adjusting communication preferences in the App, or contacting our DPO. Opting out does not affect communications required to service your loan or comply with the law.

10Contact and Complaints

For any privacy inquiry, request to exercise your rights, or complaint, contact our Data Protection Officer at dpo@leaflendinginc.com. We acknowledge complaints within two (2) Business Days and resolve them within thirty (30) calendar days under our FCPAM (SEC MC 2023-05).

You may also escalate complaints to the Securities and Exchange Commission or the National Privacy Commission. Current contact details for these regulators are published on their respective official websites.

11Google Play Data Safety Section

This Policy is consistent with the Data Safety section displayed on the Loanova Google Play listing. The categories of data declared on the Google Play Data Safety section correspond to the categories described in Sections 2 and 3. Data collection and sharing practices declared in Google Play comply with Google Play Developer Program Policies and this Privacy Policy.

12Changes to this Policy

We may update this Policy from time to time. When we do, we update the Version and Last Revised date at the top. For material changes, we notify you in advance through the App, by email, or by SMS. For changes that require renewed consent under the DPA, we obtain that consent before the change takes effect (continued use of the App alone does not constitute consent to material changes). Prior versions are available from our DPO upon request.

We encourage you to review this Policy periodically to stay informed about how we are protecting your information.

13Governing Law

This Policy is governed by the laws of the Republic of the Philippines. Any dispute is subject to the exclusive jurisdiction of the competent courts of Makati City, Metro Manila, without prejudice to your right to file a complaint with the National Privacy Commission or the Securities and Exchange Commission.

§Acknowledgment and Consent

By using the Loanova App, you acknowledge that you have read this Privacy Policy in its entirety, understood it, and consent to the collection and processing of your personal information as described herein. You certify that all information you provide is true and accurate, and you agree to notify us of any changes.

Your consent is freely given. You may withdraw your consent in accordance with Section 8.4; withdrawal does not retroactively affect the lawfulness of prior processing, and we may continue to process your data on other lawful bases (such as contract performance or legal obligations) as necessary — for example, while you have an outstanding loan.

To ensure that your consent is fully informed, the "I Agree" button in the App becomes active only after you have scrolled through this Policy in full.