Privacy notice

Who is responsible for your data

Iskolarly operates this platform and is the personal information controller for the data described here, under the Data Privacy Act of 2012 (Republic Act 10173). Questions about this notice, or any request under it, can be sent to the address on our contact page.

What we collect

We collect what a scholarship application needs and nothing we have no use for. Some of it is sensitive personal information under the Act, and it is handled accordingly.

• Account details — your name, email address, and the credential you sign in with. Passwords are stored only as a scrypt hash; passkeys and two-factor secrets never leave our servers in readable form.
• Profile details — your school, course, year level, and the city or municipality you live in, so we can tell you which scholarships you qualify for.
• Sensitive details — your birthdate and your household income bracket, where a sponsor requires them to assess eligibility.
• Documents you upload — transcripts, certificates, and anything else a scholarship asks for.
• What you do here — the scholarships you view, save and react to, and the applications you start and submit.

Why we collect it

To match you to scholarships you are actually eligible for, to let you apply without re-entering the same information for every sponsor, and to let you and the sponsor follow an application through to a decision.

Eligibility is decided by rules a sponsor configures, not by a model that scores you. When we do not hold a piece of information a rule needs, the result is "unknown" — never "not eligible". An incomplete profile must never read as a rejection.

Who sees it

A sponsor sees your profile and your documents when you submit an application to them, and not before. That is a separate consent, taken on the application form itself, for that application — it is not a setting you switch on once.

Public pages never carry your birthdate, your household income, your documents, your application answers, or a sponsor’s notes about you. Where the product shows social proof — how many students saved a scholarship, for instance — it is a count, never a list of names.

A public scholar page exists only if you create one, and being listed to employers is a further switch that is off until you turn it on. Neither happens because you applied for something.

Advertising and measurement

We run ads on Google and Meta (Facebook and Instagram) to reach students and sponsors, and we measure which of those ads worked. We want to be straightforward about this: that measurement runs for everyone who visits, and we do not ask permission first. Under the Data Privacy Act we rely on our legitimate interest in knowing whether the money we spend reaching students actually reaches them. If you would rather not be included, the last paragraph here says how.

Two things happen. Your browser loads measurement code from Google Analytics and from Meta’s advertising pixel, which set their own cookies and tell those companies that a visit and a signup occurred. Separately, when you join the waitlist or register an organization, our server tells Meta that a signup happened — this is how a signup is still counted when your browser blocks the first part, which most browsers now do.

What our server sends is deliberately narrow: your email address as an irreversible SHA-256 hash, never the address itself; the advertising click identifier from the link you arrived through, if there was one; and your IP address and browser user agent. That is all. Your name, birthdate, household income, documents and application answers are never sent to an advertising platform, and nothing about a specific scholarship you looked at or applied to is either.

Google and Meta are independent controllers of what they receive and use it under their own privacy policies, which we do not control. Neither ever receives your documents or your application content.

Separately from all of this, we keep our own record of what you view and save on the platform. That is first-party — it stays on our servers, sets no advertising cookie, is never sold or shared, and is what produces the aggregate counts you see on a scholarship.

To opt out: your browser’s settings can block third-party cookies or all cookies for this site, and any tracker-blocking extension will stop both of the above. Google publishes a browser add-on that opts you out of Google Analytics everywhere, and both Google and Meta let you turn off ad personalisation in your account settings on their side. We would also simply remove you if you write to us — see our contact page.

How your documents are stored

Uploaded documents live in a private bucket that is not readable from the internet. Every time one is opened, the link is generated fresh, expires within minutes, and the access is logged — you can see that log on your own documents.

What you can ask us to do

Under the Data Privacy Act you may ask to see the personal information we hold about you, to correct it, to receive a copy of it in a portable form, to object to how it is processed, and to have it erased.

These requests are handled by hand at the moment — write to us from the address on your account and a person will action it. There is no button in your settings that does this yet, and we would rather say so than imply one exists. We will confirm what we have done, and we aim to complete a request within the fifteen days the Act allows.

Erasure has one limit worth stating plainly. An application you already submitted is a record the sponsor relied on to make a decision, and an award is a record of that decision, so those are de-identified rather than deleted outright — your name and contact details are removed, and what remains cannot be traced back to you. Everything else, including your uploaded documents, is deleted.

How long we keep it

For as long as your account exists, and after that only the de-identified records described above. To close your account, write to us and we will do it — as above, this is a manual step today rather than a setting.

Complaints

If you think we have mishandled your personal information, please write to us first — most of it we can fix quickly. You also have the right to complain to the National Privacy Commission, whether or not you raise it with us.