Privacy Policy

1.Who is responsible for your data

Finsyal is the personal information controller for the data described here, and is accountable for how it is handled.

For anything in this policy — access, correction, deletion, withdrawal of consent, a question or a complaint — write to privacy@finsyal.ph. Requests are answered within the timeframes set by the Data Privacy Act and its implementing rules, and we will tell you what we did and why.

2.What we collect

We collect only what a given feature needs. Most of the site can be used without giving us anything at all — browsing comparisons, using calculators and reading reviews require no account.

• Account: your email address, the name you choose to display, and your password. Passwords are never stored in readable form — only a salted scrypt hash, which cannot be reversed back into your password.
• Record of your consent: when you tick the agreement box at sign-up, we store the date and time and which version of these documents you were shown. We keep this because the law requires us to be able to show that consent was actually given, and it lets you see exactly what you agreed to.
• Reviews: the rating, title and text you write, together with the display name or initials shown next to it. Reviews are public by design.
• Provider enquiries: if you ask a provider to contact you, the name, email address and message you enter in that form.
• Error reports and feedback: the message you send and which page it came from.
• Article likes: either your account email or a random identifier stored in your browser, so that a like can be toggled back off and counted once.
• Outbound clicks: when you follow a link to a provider, we record the product or provider name, the destination website's hostname, and the time. We do not record who clicked — there is no visitor identifier, IP address or full URL in that record.
• Technical data: your IP address is used transiently to rate-limit forms and block automated abuse. It is not stored alongside your account or your reviews.

3.Why we are allowed to use it

For accounts, reviews and provider enquiries, our basis is your consent and the performance of the service you asked for. For security measures such as rate limiting and anti-bot checks, our basis is our legitimate interest in keeping the site usable and free of abuse, balanced against your rights.

You can withdraw consent at any time by deleting your account or asking us to (see 'Your rights' below). Withdrawing consent does not affect processing that already took place.

4.Cookies and similar storage

We do not use advertising or cross-site tracking cookies, and we do not run a cookie consent banner because nothing we set requires consent beyond what the service needs to work.

• fb-session — signs you in. Secure, HTTP-only, and unreadable by scripts. Expires after 30 days.
• fb-user — holds only the display name shown in the header, so the page can render it without a round trip.
• fb-admin — staff only, set when an administrator signs into the admin panel.
• Browser storage (localStorage) — a random identifier for article likes, plus your own saved comparisons and recently viewed products. This stays in your browser; we cannot read it from our servers.

5.Analytics

We use Vercel Web Analytics to understand how many people visit, which pages they read, and roughly where they come from. It is cookieless: it sets no identifier, does not follow you between sites, and reports only aggregated figures. We cannot use it to identify you.

We also count clicks out to providers, as described above. Those counts are anonymous and tell us which products are useful, not who was looking.

6.Who we share it with

We do not sell personal information, and we do not share it for advertising. It reaches other parties only in these cases:

• Providers you contact: if you submit an enquiry form asking a bank, lender or provider to reach you, we send that provider your name, email address and message so they can reply to you directly. From that point the provider handles your data under its own privacy policy.
• Hosting and infrastructure: Vercel (website hosting and analytics), Neon (database), Resend (sending verification, password-reset and enquiry emails), and — where enabled — Cloudflare Turnstile for bot checks and Upstash for rate limiting. Each processes data only on our instructions.
• Legal obligations: where we are required to disclose information by law, a court, or a regulator.

7.Where your data is stored

Our database and servers are hosted outside the Philippines, primarily in Singapore, and our email and hosting providers operate internationally. This means your personal information is transferred across borders. We use providers that apply recognised security standards and contractual protections, and we remain accountable for your data under the Data Privacy Act regardless of where it is processed.

8.How long we keep it

• Account data: until you delete your account or ask us to delete it.
• Reviews: published reviews stay up while your account exists, because other readers rely on them; ask us and we will remove or anonymise yours.
• Enquiries: the copy we send is not retained by us after delivery; the provider keeps its own copy.
• Error reports and feedback: up to 24 months.
• Outbound click counts: retained indefinitely in aggregate, as they contain no personal information.

9.How we protect it

Traffic is encrypted in transit. Passwords are salted and hashed with scrypt and never stored or logged in readable form. Session cookies are HTTP-only and signed. Access to the admin panel is password-protected and its pages are excluded from search engines. Forms are rate-limited and, where configured, protected by a bot check.

No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will notify the National Privacy Commission and the people affected within 72 hours of becoming aware of it, as the law requires.

10.Your rights

Under the Data Privacy Act you have the right to:

• be informed about how your data is processed;
• access the personal information we hold about you;
• have inaccurate or outdated information corrected;
• object to processing, including withdrawing consent;
• have your data erased or blocked where the law allows;
• obtain a copy of your data in a portable electronic format;
• be indemnified for damage caused by inaccurate, unlawfully obtained or unauthorised use of your data.

11.How to exercise them

Write to privacy@finsyal.ph from the email address on your account and tell us what you want done. We may ask you to confirm your identity before acting on a request that affects an account.

If you believe we have handled your data improperly, you may also complain to the National Privacy Commission (privacy.gov.ph).

12.Children

Finsyal is meant for adults comparing financial products and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us data, write to us and we will delete it.

13.Changes to this policy

If we change what we collect or who we share it with, we will update this page and the date at the top. Material changes will be announced on the site.