Privacy notice

Last updated 19 August 2026 · Version 1.1

This notice explains what personal data Tovi collects when you use the eligibility assessment, document upload, or connected financial account features, why we collect it, who we share it with, how long we keep it, and the rights you have under the Data Privacy Act of 2012 (Republic Act No. 10173).

1. Who is responsible for your data

The Personal Information Controller is GenesisX Group LLC, a limited liability company registered in Delaware, United States, with registered address at 10001 Lewes Road, Wilmington, DE 19709, United States.

This service is offered to residents of the Philippines. Although we are established abroad, we process your personal data in accordance with the Data Privacy Act of 2012, which applies to the processing of personal information about Philippine residents.

Our Data Protection Officer can be reached at max@genesisglobal.group or +1 412 313 1314. Contact the DPO about anything in this notice, including requests to access or delete your data.

2. What we collect

From the eligibility assessment:

• Identity and contact details — your name, email address, mobile number, and the city and province where you live.
• Work and income information — the kind of work you do, how long you have earned from foreign clients, income ranges, how consistent your income is, how many clients pay you, and the platforms you are paid through.
• Financing needs — the amount and type of financing you are interested in, your timing, and what you would use it for.
• Borrowing history and financial profile — past applications and outcomes and anything you tell us about them in your own words, existing monthly repayments, whether you have overdue balances, and your BIR and DTI/SEC registration status.

If you continue to income verification, we may also collect:

• Documents you upload — bank statements covering the accounts where you receive contractor payments. These may contain transaction dates, amounts, payer names, balances, and account details.
• Context you give us — which accounts receive contractor income, the names that pay you, and any deposits you tell us are unrelated to work.
• Connected financial account information — if you choose to connect a financial account using Plaid, we may receive financial information made available through that connection. Depending on the account, financial institution, Plaid services used, and permissions you provide, this may include financial institution and account information, account balances, transaction history and transaction details, income and deposit information, account ownership information, and other financial information you authorize to be shared with Tovi.

Plaid

Tovi uses Plaid Inc. ("Plaid") to allow you to connect eligible financial accounts to Tovi.

When you choose to connect an account through Plaid, Plaid facilitates the connection between Tovi and your financial institution. Plaid may collect and process information directly from you and your financial institution in accordance with Plaid's own privacy practices.

Tovi receives only the financial information made available to us through the Plaid products we use and the permissions associated with your connection.

Tovi does not receive or store your online banking username or password through Plaid.

We also record your browser's user-agent string and a one-way hash of your IP address. The hash is used only to limit how many submissions can come from one connection; we do not store the IP address itself.

If you reached us from an advertisement or another website, we record the campaign information contained in the link you followed, such as the campaign name and the identifier the advertising platform adds, along with the address of the site that referred you. This tells us which adverts bring people to the assessment. It is not used to build a profile of you, and it is not combined with information from other sites.

What we never ask for

Tovi will never ask you to send us your online banking password or login, ATM or card PIN, one-time password, or account-recovery code.

When you connect an account using Plaid, Plaid or your financial institution may require authentication as part of the connection process. Those authentication steps occur through Plaid or your financial institution rather than through Tovi.

Nobody from Tovi will ask you to send banking credentials to us directly.

Please do not send financial documents by ordinary email or messaging apps. Use the secure upload or account connection features provided through Tovi.

3. Why we collect it

We use your personal and financial information:

• To assess whether your contractor income may qualify you for financing.
• To verify recurring income, measure its stability, and identify payment sources.
• To analyze financial account activity that you choose to share with us.
• To understand your income and cash flow as part of an eligibility or risk assessment.
• To verify account ownership where necessary.
• To prepare a contractor income summary for your review.
• To detect inconsistencies, fraud, or unauthorized activity.
• To contact you about your assessment, including asking for clarification.
• To understand, in aggregate, how contractors paid by foreign clients are served by existing lenders. Research outputs never identify you.
• To protect the service from automated abuse.

Connecting a financial account through Plaid is voluntary. If you choose to connect an account, we use the information received through that connection for the purposes described in this notice and presented to you when you connect the account.

We do not sell your personal data.

We do not use your data for automated decision-making that produces legal effects without human involvement.

4. Our legal basis

We rely on your consent under Section 12(a) of the Data Privacy Act, given when you tick the confirmations before submitting each step.

Where you choose to connect a financial account through Plaid, we also obtain your authorization before initiating the account connection and accessing financial information made available through that connection.

You may choose not to connect a financial account through Plaid.

You may withdraw consent at any time by contacting our DPO. Withdrawal does not affect processing already carried out and may mean we can no longer assess your eligibility or provide services that require financial account information.

Where we protect the service from abuse, we also rely on our legitimate interests under Section 12(f).

5. Who we share it with

Lending partners

We share your information with a lender only when you separately authorize it in writing for that specific lender. Submitting the forms on this site or connecting a financial account does not by itself authorize Tovi to send your information to a lender.

Plaid

We use Plaid Inc. to provide financial account connectivity.

When you choose to use Plaid, information necessary to establish and maintain the connection may be transmitted between you, Plaid, your financial institution, and Tovi.

Plaid processes information in accordance with its applicable privacy policy and other terms presented during the Plaid connection process.

We use information received through Plaid only for the purposes described in this notice and subject to the permissions associated with your connection.

Service providers

We use service providers acting as our Personal Information Processors, under contract and only as necessary to provide their services:

• Supabase — database and encrypted file storage, hosted on the west coast of the United States.
• Cloudflare — serving this website and providing the human-verification check that protects the forms from automated abuse.

Meta (Facebook), for advertising measurement

When you complete the assessment or upload documents, we tell Meta that a conversion happened so we can measure which of our adverts work.

Alongside that we send your email address, mobile number, name and city in a scrambled (hashed) form, which Meta uses to recognise whether you are one of the people who saw the advert.

We do not send Meta your income, financial account transactions, Plaid data, financing needs, assessment answers, or any document you upload, and we never send your email address or number in a readable form for this purpose.

Meta is an independent controller of what it receives and processes that information under its own terms.

If you would rather this did not happen, a browser-level tracker blocker or an ad blocker will stop the part that runs in your browser. To object to the rest, contact our Data Protection Officer using the details in Section 1 and we will exclude you.

We may also disclose data where required by law, by a court, or by a regulator.

Transfers outside the Philippines

Tovi's systems store and process personal data in the United States, not in the Philippines, and our organisation is established there.

Some third-party providers, including Plaid, may process information in other locations as described in their own applicable privacy policies and contractual arrangements.

We remain accountable for personal data under our control under the Data Privacy Act wherever it is processed and use appropriate contractual and security safeguards with processors we engage.

6. How long we keep it

Unless a different retention period is required by law or necessary for an ongoing transaction or dispute:

• Eligibility answers — 24 months from submission.
• Uploaded documents — 12 months from upload, or sooner on request.
• Financial information received through a Plaid connection — up to 12 months from collection, or sooner when it is no longer required for the purposes described in this notice or upon a valid deletion request.
• Abuse-prevention hashes — 24 hours.
• Incomplete uploads — deleted after 7 days.

If you disconnect a financial account, Tovi will stop requesting new information through that connection once the disconnection takes effect. Information already received by Tovi may remain subject to the retention periods above unless you request deletion or we are legally required to retain it.

Plaid may separately retain information it processes in accordance with its own privacy policy and applicable legal obligations.

After the applicable retention period, Tovi deletes, anonymizes, or securely disposes of the information in accordance with our Data Retention and Disposal Policy, unless continued retention is required by law or reasonably necessary for fraud prevention, security, dispute resolution, or the establishment, exercise, or defense of legal claims.

Deletion from active systems may not immediately remove information from encrypted backup systems where individual records cannot reasonably be removed. Information remaining in backups remains protected, is not used for ordinary processing, and is deleted according to the applicable backup lifecycle. Anonymized, aggregated statistics that cannot reasonably identify you may be retained indefinitely.

7. How we protect it

Data is sent over an encrypted connection and stored encrypted at rest.

Uploaded documents sit in a private store that is not reachable by public link. Access requires credentials held by authorized systems and personnel.

Access to systems that store or process sensitive consumer information is restricted to authorized personnel who need it for the purposes described in this notice. We use access controls and multi-factor authentication for critical administrative systems where supported and appropriate.

Your browser is never given permission to read other people's submissions.

Tovi does not receive your online banking password through Plaid. Authentication with your financial institution occurs through the Plaid and financial institution connection process.

No system is perfectly secure. If a breach occurs that puts you at real risk of serious harm, we will notify you and the National Privacy Commission as required by applicable law.

8. Your rights

Under the Data Privacy Act you have the right to:

• Be informed that your data is being processed, and why.
• Access the data we hold about you.
• Object to processing, including withdrawing consent.
• Rectify data that is inaccurate or out of date.
• Erasure or blocking — have your data removed or its processing suspended.
• Data portability — receive your data in a structured, commonly used electronic format.
• Damages — be compensated for harm caused by inaccurate, unlawfully obtained, or unauthorised use of your data.
• Lodge a complaint with the National Privacy Commission.

To exercise any of these, email our DPO at max@genesisglobal.group. We will respond within 15 calendar days.

We may ask you to confirm your identity first so that nobody else can obtain your financial records.

If you are not satisfied with our response, you may complain to the National Privacy Commission.

9. Cookies and local storage

We use the Meta (Facebook) advertising pixel to measure our advertising. It sets cookies in your browser and tells Meta when you visit this site and when you complete the assessment or upload documents.

We do not use any other analytics or advertising cookies.

While you are filling in the forms, your answers are held in your browser’s session storage so that a refresh does not lose your progress. This is cleared when you submit and when you close the tab.

If you press Save My Answers on the document upload page, a copy of those answers is also kept in your browser’s local storage so that you can close the tab and return to it.

That copy stays on your device only. It is never sent to us and is deleted automatically after 7 days, when you submit the form, or as soon as you press Delete saved answers.

Your uploaded files are never saved in your browser. Because this copy outlives the tab, please use it only on a device that is yours.

The human-verification check sets its own cookie, which is necessary for the service to work.

When you choose to connect an account, Plaid Link may use cookies, local storage, or similar technologies necessary to provide, secure, and operate the financial account connection. Plaid's processing is also governed by its applicable privacy policy.

10. Children

This service is for adults. We do not knowingly collect data from anyone under 18.

If you believe a minor has submitted information, contact our DPO and we will delete it.

11. Changes to this notice

If we change how we handle your data, we will update this page and its version number.

Where the change is significant, we will contact you using the details you gave us where appropriate.