Privacy Policy

Credit Impact, Inc., a Delaware corporation ("Credit Impact", "we", "us")

Notice address: 601 N Federal Hwy, Ste 301 #129, Hallandale Beach, FL 33009, United States

Privacy contact: privacy@creditimpact.co

This policy covers both our public website and the authenticated Credit Impact platform used by credit-repair agencies. It replaces the earlier website-only notice. The effective date of this version is shown with it.

1. The two very different roles we play

Credit Impact is a business-to-business platform. Almost all of the sensitive information we hold is information an Agency gives us about its own client — a consumer with whom we have no relationship.

We are therefore not "only a processor", and we do not claim to be. Where we act as a processor, the Agency's own privacy notice governs the consumer relationship, and our commitments to the Agency are in the Data Processing Addendum.

Consumers do not have accounts with us. There is no consumer login, no consumer app, and we never email or text a consumer. The one place a consumer sees our work directly is a physical dispute letter, which is written and signed in the consumer's own name. Consumers should read the Consumer Data Notice, which is written for them.

2. Information we process

2.1 About an Agency's clients (we are a processor)

• Identity and contact: name, mailing name, postal address, email address, telephone number.
• Credit-report information: the full three-bureau report retrieved through our credit-data provider, or a report the Agency uploads; the tradeline data derived from it — creditor, partially masked account number, balances, dates, status, payment history — and credit scores where the report contains them.
• Sensitive documents: government photo identification, proof of address, an optional Social Security card image, and a signed authorisation or representation agreement, each uploaded by the Agency.
• Social Security number and date of birth: we do not keep them as separate fields, but they can appear inside document images, inside the credit report and in information derived from the report.
• Dispute material: findings, selected dispute routes, generated dispute letters, evidence packets, approvals, bureau responses and next-round decisions.
• Mailing records: the destination bureau address, the return address, the mailpiece, the provider's job identifier and any tracking number.
• Free-text notes an Agency user types about a case.

2.2 About Agency users, sales representatives and platform staff (we are a controller)

Name, work email address, agency and role; a password stored in hashed form; federated sign-in identifiers if you use Google sign-in; session records; one-time invitation and password-reset tokens stored in hashed form together with the requesting IP address and user agent; additional sign-in security settings for platform administrators; support requests and sales-representative claims, including any free text typed into them.

2.3 About the Agency as a business

Agency name, primary contact name and email, mailing address, billing notes, payment-processor customer and invoice identifiers, purchase and refund records, Credits ledger entries, commission and referral records.

2.4 About website visitors and prospects

Launch-list submissions (name, work email, agency name, role, monthly client volume and any message); IP address, browser and device information, pages viewed and timestamps; approximate location derived from IP address; and — only after you accept Analytics cookies — the analytics identifiers described in the Cookie Policy.

2.5 Operational records

Application and request logs (identifiers, method, path with the query string removed, and status; not email addresses, not IP addresses, not tokens), operational event records, audit records of administrative actions, and deletion control records.

3. Where the information comes from

From the Agency and its users; from the consumer's own credit file, retrieved through our credit-data provider using the consumer's provider account email and a one-time access code, at the Agency's instruction; from documents the Agency uploads; from our payment processor; and from your browser when you visit the website.

4. Why we process it

To provide the platform; to retrieve and organise credit-report information at an Agency's instruction; to generate dispute letters with algorithmic and AI-assisted tooling; to produce and, where enabled, mail dispute packages; to authenticate users and secure the platform; to bill and to prevent fraud; to provide support; to meet legal obligations and to establish, exercise or defend legal claims; and — for the public website only, with consent — to understand how the site is used.

5. Artificial intelligence

Dispute analysis is partly rule-based and partly AI-assisted. We use OpenAI for AI-assisted analysis and drafting. The information we send to OpenAI may include credit-report content and the Agency's selections and instructions, which can include personal information. OpenAI processes that information under its service terms.

We store the prompts we send and the responses we receive, including generated dispute text, and keep them in line with section 8.

We do not use customer or consumer information to train or fine-tune AI models.

The Agency reviews and approves the content before anything is sent. AI output is not independently verified for factual accuracy by a human at Credit Impact.

6. Who we share it with

We do not sell personal information, and we do not share it for cross-context behavioural or targeted advertising. We have not enabled any advertising or ad-personalisation feature in our analytics.

We use these service providers under their service terms, limit what we share with each to what its service requires, and review them. Each provider may process information in the places where it operates.

We may also disclose information to professional advisers; in connection with a financing, merger, acquisition, reorganisation or sale of assets, where the successor assumes these obligations; when required by law, subpoena or court order; where necessary to protect rights, property, safety or systems; and with your consent or at your direction.

7. Where information is processed

The platform's primary hosting, databases, file storage and backups are on Google Cloud in the United States.

Other service providers listed in section 6 may process information in the places where they operate, which may be outside the United States. We make no representation that information never leaves the United States.

8. How long we keep it

We keep personal information only for as long as reasonably necessary for the following purposes:

• providing the services to the Agency and its users;
• security and fraud prevention;
• resolving disputes;
• enforcing our agreements;
• complying with legal obligations;
• our backup cycles; and
• legitimate legal holds.

This applies to all the information in section 2, including credit reports, documents, case and dispute records, AI prompts and responses, account and billing records, support communications and logs. Sessions and one-time tokens end when they expire, on logout or on revocation.

When an Agency asks us to delete a client's information, when a valid request under section 9 requires deletion, or when a relationship ends, we carry out the deletion through a manual process, except where law, a valid legal order or a legitimate legal hold requires us to keep the information. Copies in our backups remain until those backups expire in the ordinary course, and we do not use them for any other purpose. If a backup is restored, we take reasonable steps to re-apply the deletions we have completed.

9. Your rights and how to exercise them

Depending on where you live and which law applies, you may have the right to access, correct, delete, obtain a copy of (export), or restrict the processing of your personal information; to withdraw consent; to use an authorised agent; and to appeal a decision we make about your request.

How to make a request: email privacy@creditimpact.co (we also accept requests sent to legal@creditimpact.co). You can make an access, correction, deletion, copy or appeal request this way. We will verify your identity in a way that is proportionate to the sensitivity of the request, we take care not to disclose information to the wrong person, we document each request and our decision, and we respond within the time required by applicable law. We do not retaliate against anyone for exercising a right. Agency users can also update some profile and client details themselves in the platform.

If you are an Agency's client, the Agency controls your information and is normally the party that decides and responds, so please contact the Agency first; we act for the Agency and assist it. If you contact us directly, we will not simply turn you away: we will verify safely, identify the Agency responsible, forward the request to it or help it respond, and handle directly any data for which we are independently responsible.

Analytics consent can be withdrawn at any time through the "Cookie preferences" control described in the Cookie Policy, with no effect on your ability to use the website.

Do Not Sell or Share, and Global Privacy Control. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing for an opt-out of those activities to switch off. We honour a Global Privacy Control signal as an opt-out of sale and of targeted-advertising sharing. It does not by itself switch off ordinary consent-based analytics, because our analytics run only on affirmative consent and are withdrawn through the cookie control.

10. Security

We use administrative, technical and organisational safeguards that are reasonable and proportionate to the sensitivity of the information. They include:

• encryption of platform traffic in transit using HTTPS;
• passwords and one-time tokens stored in hashed form;
• secure session cookies that are not readable by page scripts and are not sent on cross-site requests;
• role-based access controls, and separation of each Agency's data from other Agencies' data;
• encryption of stored data by our cloud provider; and
• secrets kept in a managed secret store.

We do not claim perfect security. No method of transmission or storage is completely secure.

11. Security incidents

If we confirm a personal-data breach affecting an Agency's data, we will notify that Agency without undue delay after confirming the breach, and as required by applicable law, with a description of what happened, the categories of data affected where known, the measures taken, the risks, recommended steps, and follow-up updates. Unsuccessful attacks that compromise no data do not generate individual notices. Regulator and consumer notices follow applicable law and the allocation in the Data Processing Addendum.

Report a suspected security issue or incident to security@creditimpact.co.

12. Children

The platform is not directed to children, offers no consumer accounts, and requires its users to be at least 18. We do not knowingly collect information from a child through our website.

A case about a minor consumer is not automatically prohibited: the Agency must hold guardian authorisation and any other lawful authority, and must certify that it does. We perform no automated age detection or age verification. If we learn that the necessary authority is missing, we may stop processing.

13. Changes

Each version of this policy carries a version identifier, and the effective date of each version is shown with it. We post updates here. Prior versions are archived. We will give notice of a material change by email or in the platform.

14. Contact