Draft for review. This document is a working draft prepared for review by a
licensed Florida attorney and has not yet been finalized. It is provided for transparency and
does not constitute legal advice.
Privacy Policy
Last updated: July 6, 2026 • Draft pending Florida attorney review
1. What We Collect
- Account data: name, email, phone, and login credentials (passwords are stored only as bcrypt hashes).
- Profile data you provide: date of birth, address, credit goals, and documents you choose to upload (such as credit reports and identification).
- Sensitive identifiers: where a Social Security number's last four digits are used in a document workflow, they are encrypted at rest.
- Usage and security data: logins, IP addresses, and actions recorded in an append-only audit log.
2. How We Use It
- To operate the Service: your dashboard, document vault, messages, appointments, and progress tracking.
- To provide AI-assisted educational reviews of documents you submit. AI output is logged for transparency and shown only to you and your authorized team.
- For security, fraud prevention, and legal compliance.
We do not sell your personal information. We do not use your information for
third-party advertising.
3. Who Can See Your Information
- Your data is scoped to your account and the company you work with. Other companies on the platform cannot see it.
- Staff access is role-restricted and logged.
- Service providers (hosting, email delivery, AI processing) receive only what is needed to provide their function.
- We disclose information if required by law, subpoena, or to protect against fraud or abuse.
4. AI Processing
When you submit a credit report for review, its text is processed by an AI model to produce an
educational summary. AI output is labeled, logged, and never acted on without your review. See the
AI Use Disclosure for details.
5. Your Choices and Rights
- Access & correction: view and update your profile in the portal at any time.
- Deactivation: disable your login from Account & Privacy; your provider can reactivate you later if you ask.
- Deletion: permanently remove your personal information from Account & Privacy. This erases your documents, messages, history, and identity fields. Anonymized financial records and the security audit trail are retained as required for legal compliance and no longer identify you.
6. Retention
We keep personal information while your account is active or as needed to provide the Service. When you
use self-service deletion, personal content is removed immediately and identity fields are anonymized.
Records we must keep (audit logs, financial records) are retained in anonymized form for the periods
required by applicable law.
7. Security
We use encryption in transit (HTTPS) and for sensitive identifiers at rest, hashed passwords,
role-based access control, tenant isolation, rate limiting, CSRF protection, security headers, and an
append-only audit log. No system is perfectly secure; we will notify affected individuals of a data breach
as required by the Florida Information Protection Act (Fla. Stat. § 501.171) and other applicable law.
8. Children
The Service is not directed to anyone under 18, and we do not knowingly collect information from them.
9. Changes; Contact
We will post updates here with a new "Last updated" date; material changes will require renewed
acceptance. Questions or privacy requests: hello@creditos.app.