GCash
Privacy Notice
GCash takes your privacy very seriously. We protect your personal data and use it in a fair, lawful, and secure way. We follow the Data Privacy Act of the Philippines, other laws that apply to our services, and relevant industry standards.
This Privacy Notice tells you how the relevant Mynt Group companies collect, use, share, keep, delete, and protect your personal data when you use the GCash App and GCash Services. It also explains how you can control what happens to your information.
GCash is your everyday financial and lifestyle super app. The GCash App gives you access to a wide range of services all in one place. You can manage your core e-wallet needs with us, like sending money, receiving money, paying your bills, and shopping online. You can also use financial tools to borrow cash, invest, and manage stocks and bonds, where available.
For your lifestyle needs, the app offers features such as paying for your commute, ordering food, applying for jobs, requesting copies of your birth certificate and other official documents, donating to charities, planting trees, earning rewards, joining promos, discovering curated brands, and seeing offers tailored to your interests.
The services in the GCash App are provided or supported by different companies within the Mynt Group. These include Mynt, Inc. (“Mynt”, formerly Globe Fintech Innovations, Inc.), G-Xchange, Inc. (“GXI”), Fuse Financing Inc. (“Fuse”), Ryse, Inc. (“Ryse”), BlockG Virtual Assets, Inc. (“BlockG”), Electronic Commerce Philippines Inc. (“ECPay”), and other Mynt-affiliated companies named in this Privacy Notice or in the service-specific terms.
Depending on the services you choose, you may also deal with partners outside the Mynt Group, such as billers, merchants, financial institutions, remittance partners, product providers, advertisers, or other business partners. These partners are not part of the Mynt Group unless we clearly say otherwise.
To learn more about the various services available in the GCash App, please visit our GCash Services page.
When this Privacy Notice says “we,” “us,” or “our,” we mean the specific Mynt Group company responsible for the service, feature, product, or use of personal data being described. In some cases, two or more Mynt Group companies may be responsible for the same data use.
The relevant Mynt Group company may collect and use personal data for its own service or purpose. This means it may act as a personal information controller for that data use. A personal information controller decides why and how personal data is used.
Depending on the data, purpose, and service, Mynt Group companies may act as independent personal information controllers or as joint personal information controllers. They may do this to provide, support, secure, provide service-related personalization for, check eligibility or suitability for, or comply with legal rules for their services.
To learn more, please visit our individual Privacy Notices.
Some services may be offered by partners outside the Mynt Group. For these services, we may share, send, or port your data to that partner only when the law allows it. We may also do this when it is needed for the service you choose, when it is covered by the relevant terms or privacy notice, or when you give your instruction or consent.
Partners outside the Mynt Group may have their own terms and privacy notices. These may explain how they collect, use, keep, and protect your personal data for their own services.
This section explains the main types of personal data we collect and why we use them. Depending on the service, this data may be used by the relevant Mynt Group company responsible for that service or purpose.
We keep your personal data for at least five (5) years after the last transaction you made using your GCash account or after you close your account. We will keep this information for as long as we are required by anti-money laundering requirements, for compliance with Banko Sentral ng Pilipinas regulations, and for other legal obligations.
Different Mynt Group companies may keep personal data for different periods, depending on the service, legal rule, or business need involved. Service-specific terms or notices may give more details.
We only have access to your current contact list and current location while you allow your device to share this information with us. Some records created from your prior use of these features may be kept for the periods explained in this Privacy Notice, where needed for legal, security, fraud prevention, service, or dispute-related purposes.
If your information is relevant to an investigation, legal case, complaint, claim, or court order, we may keep the information for up to ten (10) years after the matter is completed or resolved, or for as long as the law or a court order requires.
If you create or use a GCash Account or any GCash Service, we may collect, use, and share different types of personal data. We keep and use your data only for the purposes explained in this Privacy Notice, our terms, service-specific terms and notices, or as required by law.
- Direct interactions: We collect information when you create a GCash Account, use or apply for a GCash Service, contact us for assistance, join promos or events, apply to become a merchant or business partner, or give us your personal data directly.
- Through our app and website: We collect information when you use the GCash App, our website, or GCash Services such as GStocks PH, Global Stocks, GFunds, GSave, GCrypto, or other services available in the app.
- Through various channels: We collect information through online forms, app pages, consent screens, data porting screens, and other channels managed by us, the relevant Mynt Group company, partners and affiliates, or our service providers. For example, when you buy a product from a partner website and select GCash as your payment method, we collect information needed to process the payment.
- From Mynt Group companies and partners: Relevant Mynt Group companies may collect or use certain data through the GCash App depending on the particular service you avail or feature you use. We may also receive data from partners outside the Mynt Group, such as your employer, bank, biller, merchant, or product provider, when allowed by law, needed for the service you choose, or based on your instruction or consent.
- From our social media platforms: We collect information when you interact with us on our official social media pages or join our contests, promos, or activities.
- By granting permissions on your mobile devices: We collect information when you allow the GCash App to access certain device features, such as biometrics, location, contacts, camera, or other app permissions. You can manage these permissions in your device settings.
- From other third parties: We may receive your personal data when you ask another company to transact with us, share data with us, or send or port your data to us. Porting means sending a copy of your data from one company to another based on your request or instruction.
We work with Mynt Group companies, service providers, partners outside the Mynt Group, financial institutions, and government agencies to provide GCash Services. We allow them to receive or use your personal data only when allowed by law, needed for a service, explained in the relevant terms or notice, or based on your instruction or consent where needed.
We securely delete, destroy, anonymize, or make your personal data unreadable when we no longer need it, or when no longer required or allowed by law to keep it. We use security measures that are standard in our industry.
For physical records, we destroy them by shredding. For electronic records, such as files stored on devices, drives, or other electronic media, we use secure deletion or wiping tools so the data cannot be read or used without authorization.
Philippine privacy and data protection laws allow cross-border transfers when proper safeguards are in place. We may store or process your personal data through cloud service providers, service providers, Mynt Group companies, or partners whose systems or centers may be located outside of the Philippines.
We may also share or disclose your personal data to authorized partners outside of the Philippines when allowed by law, needed for the service you choose, covered by the relevant terms or notice, or based on your instruction or consent.
While we do not publish the exact location of our systems or data centers for security reasons, as a data subject, you may request more information on where we transfer your data. Please see the “How can you exercise your data privacy rights?” section of this Privacy Notice.
When we transfer or process data outside the Philippines, we use safeguards such as contracts, access controls, security measures, and confidentiality requirements to help keep your personal data protected.
As part of the GCash super app experience, we may show you content, offers, rewards, ads, promos, and recommendations that may be relevant to you. For example, we may recommend, show, suppress, or prioritize GCash Services, offers, rewards, or features based on your account, service use, eligibility, or preferences.
We may also show or support GCash-related offers, promos, rewards, and ads outside the GCash App, such as merchant promos where GCash may be used as a payment method. These activities help you discover or return to GCash Services and partner offers. We do these only when allowed by law and, where required, based on your choices or consent.
We may use Mynt Group service providers and authorized advertising partners to help personalize content, show GCash-related offers, and measure or improve our campaigns. They may process personal data only for disclosed purposes, under contracts, safeguards, and the Data Privacy Act.
- Data Collection and Profiling: We collect and analyze data limited to what is needed for these activities, such as your account details, demographic data, transaction indicators, app activity, preference signals, contextual data, inferred or derived data, and advertising identifiers. We use this to understand your interests, suggest relevant services, improve your app experience, and help make sure content is suitable and age-appropriate. Where sensitive personal information is used for marketing, we will ask for your specific consent unless another lawful basis under the Data Privacy Act clearly applies.
- Targeted Ads: Instead of displaying identical content to everyone, we use your profile or segment to deliver ads, offers, and promos that may match your interests, location, service use, or preferences. This helps keep your in-app experience relevant and helps filter out unavailable or unsuitable content. Where allowed by law and based on your settings or consent, when required, we may also show or support GCash-related ads on approved channels outside the GCash App, such as social media platforms, search engines, or other digital service.
- Collaboration: To deliver, measure, and improve our marketing campaigns, we may work with advertising companies, ad technology platforms, media agencies, partner brands, social media platforms, search engines, and other digital platforms. Where allowed by law and based on your choices or consent, we may share data limited to what is needed for these activities, such as advertising identifiers and hashed contact details. Our partners are required by contract to protect your data, keep it confidential, and comply with applicable data protection laws.
- Manage what you receive: You can manage the channels where you receive promos, exclusive offers, and limited deals. For example, you may turn off promo messages through email or SMS. You can also use Privacy Choices or the relevant app settings to manage marketing communications, partner offers, and available sharing choices. For ads outside the GCash App, you can use your phone settings to control how your advertising ID is used or to limit personalized ads, depending on your device. Essential non-marketing messages, such as security alerts, service notices, transaction updates, and legal or account-related messages, are not covered by these marketing settings and may still be sent to you.
We may use automated processing or decision-support tools. This means we may use computer systems, rules, models, or similar tools to help us review data, detect risks, check eligibility or suitability, improve services, personalize your experience, or protect your account.
These tools may use personal data such as:
- information you give us when you sign up, such as KYC and basic profile information;
- information from your use of the GCash App and GCash Services, such as transaction indicators, app usage, account limits, repayment behavior, and service-use patterns;
- information we receive from authorities, partners, or other allowed sources, such as fraud, crime prevention, or security information; and
- inferred or derived information, such as risk flags, eligibility flags, preference indicators, or customer segments.
We may use these tools to assess whether you may be eligible or suitable for certain GCash Services, such as loans, credit, investments, promos, rewards, or other financial and lifestyle services. We may also use them to prevent fraud, protect users, comply with legal rules, and improve GCash.
Relevant Mynt Group companies may use these insights for their own services or purposes. Partners outside the Mynt Group may receive data or insights only when allowed by law, needed for the service you choose, covered by the relevant terms or notice, or based on your instruction or consent.
Where automated processing is the sole basis for a decision that may significantly affect you, we will provide the notice, rights, and safeguards required by law.
The relevant Mynt Group companies may use artificial intelligence or machine learning, also called AI/ML, to help improve and protect the GCash App and GCash Services.
We may use AI/ML for the following purposes:
- Protection and security: We may use AI/ML to detect scams, unauthorized access, suspicious activity, fraud, and money laundering risks. These tools help us protect users, block harmful activity, and comply with legal and regulatory rules. Because this processing is needed for safety and compliance, it cannot be turned off.
- Efficiency and experience: We may use AI/ML tools, such as automated assistants, to answer questions faster, improve customer support, and reduce errors. We will tell you when you are directly interacting with an AI system, where required or appropriate.
- Eligibility, suitability, and transaction patterns: We may use AI/ML to help understand transaction patterns, service use, and risk or eligibility signals. This helps us check whether certain GCash Services may be relevant, suitable, or available to you.
- Model training and improvement: We may use data to train, test, and improve our AI/ML models. This may include transaction indicators, app activity, service-use patterns, feedback, preferences, and other data explained in this Privacy Notice. Where possible, we use aggregated, de-identified, minimized, or synthetic data. We also review our models to help keep them accurate, secure, and fair, and to reduce errors or unfair bias.
Some AI/ML uses are needed to keep the GCash App safe, secure, and compliant with law. These cannot be turned off. Other uses, such as marketing, ads, or personalization, may depend on your choices or consent where required.
We design and review our AI/ML use to support transparency, security, fairness, accountability, and privacy. Where practical, we use safeguards such as access controls, testing, monitoring, human review, and privacy-enhancing techniques. These may include using aggregated, de-identified, minimized, or synthetic data to reduce privacy risk.
We use human review where required or appropriate. You may use our privacy settings or Privacy Choices feature in the GCash App to manage certain privacy and marketing choices.
Your trust and privacy are important to us. We use safeguards to help keep your personal data safe when it is collected, used, shared, stored, or sent.
There can be risks when you create a profile or use a digital platform. Someone may try to take control of your account (account takeover), trick you into giving away your personal data (social engineering), or access your phone without your permission (hacking). We use security measures to help protect your data from loss, misuse, unauthorized access, or other harmful activity.
These security measures include:
- Restricting access: Only authorized people, systems, or companies may access your personal data when they need it for an allowed purpose.
- Encryption: We use encryption to help protect your personal data when it is stored or sent. Encryption turns information into a secret code that can only be read by someone with the right key.
- Multi-factor authentication (MFA): We use MFA in the GCash App. This means you may need more than one step before you can access your account or use certain features. For example, you may need to use a one-time password or OTP, enter your Mobile PIN or MPIN, or complete a selfie scan. We may also use biometric login where available.
We also check how data moves into and out of our systems to help keep it protected. We use organizational, physical, and technical security measures aligned with recognized industry standards.
When service providers or partners outside the Mynt Group process personal data for a GCash Service, we require them to protect your data and follow our privacy and security requirements. Relevant Mynt Group companies must also follow the security and privacy rules that apply to their services and data use.
You also play an important role in keeping your account safe. Never share your MPIN or OTP. Tell us right away if you think your account, password, MPIN, or OTP has been compromised. For more information on protecting your GCash Account, visit our Help Center.
We may also use privacy-enhancing technologies or PETs. These are tools that help us improve our services while reducing the use of real personal data. For example, we may use synthetic data. Synthetic data is sample data made by computer systems. It can show patterns similar to real customer data, but it does not contain actual personal data. This helps us test systems, study trends, and build new features with less privacy risk. We use PETs where practical and appropriate. Not all data processing can be done this way, but we use these tools when they help protect your privacy and keep your data safe.
You have rights under the law. These rights may be subject to legal limits. For example, we may need to keep some data to follow the law, prevent fraud, protect users, or resolve disputes. Your rights include:
- Right to be informed: You can be told how we collect, use, share, keep, and protect your personal data.
- Right to access: You can ask for a copy of the personal data we have about you.
- Right to rectify: You can ask us to correct mistakes or errors in your personal data.
- Right to object: You can object to certain uses of your personal data, such as processing based on consent or legitimate interest, when allowed by law.
- Right to withdraw consent: If we rely on your consent to process your personal data, you can withdraw your consent. This will not affect processing done before you withdrew consent, or processing we must continue under law or for a service you requested.
- Right to erasure or blocking: You can ask us to delete, block, or stop using your personal data when allowed by law.
- Right to data portability: You can ask for a copy of your personal data in an electronic format. You may also ask us to port or send your data to another company when allowed by law.
- Right to file a complaint: You can file a complaint with the National Privacy Commission if you believe your privacy rights were violated.
- Right to damages: You may claim compensation if your privacy rights were violated and you suffered damage.
For more information about your privacy rights, you can visit the National Privacy Commission’s website to look at resources about the Rights of Data Subjects.
We will handle your requests to access, rectify, delete, block, object to, or port your personal data, unless legal reasons prevent us from doing so.
Before acting on your request, we may ask you to verify your identity. This helps us make sure we are dealing with the right person and protects your account from unauthorized requests.
If your request relates to a service handled by a specific Mynt Group company, we may coordinate with that company or direct your request to the proper channel.
To learn more about managing your personal data, you may use the Privacy Choices feature in the GCash App, speak with Gigi, visit our Help Center, or call us at 2882 through Customer Care.
We use a layered approach. This means we give you privacy information in different ways, depending on what you are doing in the GCash App.
GCash Terms and Conditions explain the main rules for using the GCash App. They also explain why we may use personal data needed to provide GCash Services.
The Privacy Notice gives more details. It explains who handles your personal information, what data we collect, why we use it, how we share it, how long we keep it, and how we protect it. It also explains your rights and choices.
We may also give you Privacy at a Glance. This gives you a short summary of our privacy practices.
For some services, we may show you service terms, consent screens, data porting screens, or just-in-time notices. These appear when you use, apply for, or choose a specific service. They give more details about the personal data needed for that service, who will receive it, why it will be used, and what choices you have.
Not all data use is based on consent. Some data use is needed to provide a service, follow the law, prevent fraud, or protect your account. When consent is needed, we will ask for it. When you give an instruction, such as a data porting request, we will process your personal data based on that instruction and the rules that apply.
We update this Privacy Notice from time to time. We do this to keep you informed about how we protect and use your personal data, and to reflect changes in our services, privacy practices, security measures, or legal requirements.
We recommend that you visit this page regularly to stay informed of any updates.
Effective Date: June 15, 2026
