Privacy Policy

Draft pending legal review. This policy is structured against the build plan outline and the internal data-handling rules. An attorney must review and finalise it — including the state-specific disclosures — before the first live credit report is imported.

1. What we collect

• Account information: name, email address, and authentication identifiers.
• Identity information needed to match you to your credit file, which may include date of birth and Social Security number.
• Credit report contents: tradelines, balances, statuses, inquiries, and public records.
• Documents you upload, and the dispute selections and letters you create.
• Consent records for any permissioned import: what you authorised, when, and from where.
• Ordinary service logs and product usage events.

2. How we use it

Only to operate the service: to import and read your report, identify potentially disputable items, generate the letters you ask for, track your disputes, provide support, and meet legal and audit obligations. We do not sell your personal information, and we do not use your credit data for advertising.

3. How it is stored and secured

• Encrypted in transit (TLS) and at rest (managed keys).
• Account numbers are masked in our data model.
• Every record is scoped to your account; access is least-privilege and audited.
• Multi-factor authentication is available on your account and recommended.
• Document contents processed by an external model provider are redacted of direct identifiers first; unredacted documents are processed only within our own infrastructure.

4. Who else is involved

We use a small number of processors to run the service: an identity provider for login, a payment processor for subscriptions, a cloud host for compute and storage, a consumer-permissioned data provider for report imports, and an email provider for notifications. Each receives only what it needs for that function.

5. How long we keep it

We keep your account and dispute history for as long as your account is open, and afterwards only as long as required for legal, audit, and dispute-resolution purposes. Imported report data is retained in line with the data provider's terms. Audit records of disputes and consents are retained separately because we are obliged to be able to show what was sent.

6. Your rights

You may request access to your data, correction of it, or its deletion. Write to support@credit680.com and we will verify your identity before acting. You can withdraw consent for a permissioned import at any time, which stops future pulls.

7. State-specific disclosures

Residents of California and other states with comprehensive privacy statutes have additional rights, including rights relating to sale and sharing of personal information. The specific disclosures required by each state will appear here once finalised. We do not sell personal information.

8. Contact

Privacy requests and questions: support@credit680.com. See also our consumer disclosures.