We collect information you provide directly: your name, mailing address, email, password (hashed), uploaded credit report PDFs, dispute item selections, generated letters, USPS tracking numbers, and bureau response uploads. We also collect basic operational data such as IP address, user-agent, timestamps, and per-feature usage signals.

We use your data exclusively to (a) prepare and mail your dispute letters via USPS Certified Mail, (b) track delivery and bureau response windows, (c) operate the service (authentication, billing, support), and (d) improve product quality. We do not sell your personal information.

Uploaded documents (credit reports, generated letters, bureau responses) are stored using encrypted cloud storage with encryption at rest. Access is restricted to the minimum personnel and processes necessary to operate the service. Every access is logged to an immutable audit trail.

• Certified mailing provider: we share the recipient name + bureau address and the generated letter PDF with our certified mailing provider. Postage data is shared with USPS for tracking.

• Payment processor: billing details are processed by our payment provider. We never see or store your full card number.

• Transactional email provider: operational notifications are sent via a transactional email provider, including recipient email + the rendered notification body.

We retain dispute records to comply with FCRA recordkeeping expectations and to support follow-up rounds. You may request deletion of your account at any time via support.

We use TLS in transit, AES-256 encryption at rest for documents, hashed passwords (bcrypt), least-privilege access, and continuous audit logging. Notifications are fail-closed by default — no automated customer emails are sent without explicit operator opt-in.

You may request access, correction, or deletion of your data by emailing support. We will respond within 30 days. To contact our privacy team: support@joincreditlift.com.