Skip to main content
JOIN THE WAITLIST · FREE SIGNUP + FIRST REPORT ANALYSIS AT LAUNCH
Credit Hack AI
Draft notice. This policy is a working draft — not yet reviewed by a lawyer. Do not rely on it for legal compliance without professional review.

Privacy Policy

Last updated: October 23, 2026

This Privacy Policy explains what information Credit Hack AI ("we", "us", "our") collects when you use this service, how we use and share it, and the rights you have over your data. We aim to collect as little as possible and to keep what we do collect under your control.

What we collect

  • Account details — your email address, your display name, and, when you sign in with a third-party identity provider (Google or Microsoft), the account identifier they return to us.
  • Credit report uploads — the PDF credit reports you choose to upload, and the parsed data we derive from them so that we can generate dispute letters on your behalf.
  • Cycle data — the dispute letters we generate, their status in your dispute cycle, and the items (tradelines, collections, inquiries) those letters cover.
  • USPS tracking numbers — tracking numbers you enter for mailed letters so we can poll delivery status on your behalf.
  • Sign-in device signals — a salted hash of your IP address and a hash of your browser fingerprint. We use these to recognise known devices and alert you to sign-ins from new ones. We do not store raw IPs long-term.
  • Audit log metadata — a record of privileged actions taken on your account (sign-in, export, deletion, role changes). We keep this for security investigations.

How we use it

  • Generate dispute letters based on the reports you upload.
  • Contact you by email about the status of your dispute cycle, your account, and service changes.
  • Poll mail carriers for delivery events on letters you have mailed.
  • Back up your account data to the cloud destinations your operator configures, so that data survives the loss of any single environment.
  • Investigate abuse, enforce our Terms of Service, and meet our obligations under applicable law.

We do not sell your personal data. We do not use your data to train third-party AI models. Letter bodies are generated using templates we ship with the service — we do not forward the contents of your credit reports to external model providers.

Third parties

We share data only with the vendors we need to run the service. Where a vendor is named, the link is to its own privacy policy. To learn which provider fills an unnamed role, contact us and we will tell you.

  • Email delivery provider — we share your email address and the contents of account notifications (never the contents of dispute letters).
  • Google — OAuth identity provider, if you choose "Sign in with Google". Google returns your profile identifier, name, and email to us.
  • Microsoft — OAuth identity provider, if you choose "Sign in with Microsoft". Microsoft returns your profile identifier, name, and email to us.
  • USPS Web Tools — tracking lookup. We share only tracking numbers you have entered; never names, addresses, or letter contents.
  • Error monitoring provider — configured with PII scrubbing so request bodies, emails, and IP addresses are stripped before being sent.
  • Stripe — payment processing, if and when billing is enabled (currently unused by this deployment).
  • Backup storage provider — backups are encrypted before they leave our servers and are stored with a cloud storage provider. That provider's privacy policy applies to backed-up data at rest.

Your rights

Depending on where you live, you may have the following rights under laws such as the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA):

  • Access. Ask us what personal data we hold about you.
  • Portability & export. Download a copy of your data in a machine-readable format via /account/export.
  • Deletion. Request deletion of your account and associated data via your account settings.
  • Rectification. Correct inaccurate personal data through the profile editor in your account.
  • Restriction. Ask us to pause processing while a dispute is being resolved.
  • Objection. Object to processing based on legitimate interests.
  • Do Not Track. If your browser sends the DNT: 1 header we will not set non-essential cookies for you by default, and we will not show the cookie banner.

Data retention

We keep different categories of data for different periods. For the full breakdown, see our data retention page. In summary: credit report PDFs are deleted 24 hours after processing; cycle data is archived once a case completes; audit logs are kept for two years; tracking entries are kept for one year after their last API check.

Cookies

We use essential cookies only by default. Essential cookies keep you signed in and remember security choices (for example, whether you have completed a multi-factor challenge). You can review and change your cookie preferences at any time from the cookie banner or via the settings link at the bottom of every page. We do not set advertising cookies, and we do not enable analytics cookies without your consent.

International data transfers

Depending on where your operator has deployed this service and which cloud backup destinations they have configured, your data may be processed in the United States or other jurisdictions. Ask your operator for the list of destinations that apply to this deployment.

Children

This service is not intended for children under 16. We do not knowingly collect personal data from children. If you believe we have, email us at support@credithackai.com and we will delete it.

Changes to this policy

We may update this policy from time to time. Material changes will be announced on this page with a new "Last updated" date. Continued use of the service after a change means you accept the updated policy.

Contact

Questions about this policy or how we handle your data? Email support@credithackai.com.