In short: we collect what's needed to run a secure credit platform, encrypt the sensitive parts, never sell personal information, and share it only with your Agency, the services that run the Platform, or when the law requires.
01Who we are and our role
Credit Wolf (the "Company") operates Credit Wolf. For an Agency's client records, the Agency decides what is collected and why, and we process that information on the Agency's behalf to run the Platform (as a "service provider" or "processor"). For account, billing and security information about our own users, we are responsible for it. If you are an Agency's client, your Agency's privacy notice also applies to you.
02Information we collect
- Account information: name, email, phone, password (stored only as a one-way Argon2id hash), sign-in provider, two-step verification settings.
- Client profile information: address, date of birth, last four digits of the Social Security number, goals and notes.
- Identity documents uploaded to the ID vault, such as a driver's license, passport, Social Security card, W-2, utility bill or insurance documents.
- Credit information: scores, tradelines, report details, Credit Karma snapshots, dispute letters and bureau responses that you or your Agency enter.
- Billing information: handled by Stripe. We receive limited details (for example the last four digits of a card) but never full card numbers.
- Security and usage data: IP address, browser type, sign-in times, and audit logs of sensitive actions (for example who viewed a document and when).
- Cookies: only essential cookies needed to keep you signed in and protect against attacks. We do not use advertising or cross-site tracking cookies.
03How we use information
- to provide, secure and maintain the Platform and the services Agencies offer through it;
- to verify identity, prevent fraud and abuse, and enforce our Terms;
- to process payments and send service messages (verification, invitations, security alerts);
- to comply with law, respond to lawful requests, and protect rights and safety.
05How we protect information
- Sensitive fields (SSN digits, dates of birth, account numbers, letters) and every uploaded document are encrypted with AES-256-GCM before storage.
- All connections use HTTPS. Documents are never available by public link and are decrypted only for authorized, signed-in users.
- Two-step verification is required for Agency staff by default; sessions can be revoked at any time.
- Each Agency's data is isolated, and sensitive views, downloads and prints are recorded in an audit log.
06How long we keep information
We keep information while an account is active and as needed to provide the service. Agencies may delete client records and shred vault documents at any time. After an account closes, we delete or de-identify information within a reasonable period unless we must keep it longer for legal, tax, security or dispute purposes. Encrypted backups expire on a rolling schedule.
07Your choices and rights
You can view and update your profile, manage two-step verification and sessions, and withdraw unverified uploads in your account. Depending on where you live (for example California), you may have rights to know, access, correct or delete your personal information, and not to be discriminated against for using them. Clients should contact their Agency first; you can also contact us and we will help or forward your request.
We will verify your identity before acting on a request.
08Children
The Platform is not for anyone under 18, and we do not knowingly collect information from children.
09Changes to this policy
We will post updates here with a new version date, and ask you to accept material changes before you continue. See also our Terms of Service and Disclaimers.
Questions about these terms: use the support contact in your account