Privacy Policy

1. Data We Collect

Account Information

• Email address and name (collected at sign-up via magic link)
• Subscription status and billing history (managed by Stripe)
• AI consent acknowledgment date and version

Credit Report Data

• PDF files you upload (Equifax, Experian, TransUnion) — stored encrypted in Supabase Storage and automatically deleted after 30 days
• Analysis results extracted from your PDFs — cached for 30 days to avoid redundant processing, then deleted
• Dispute letter records — a minimal log of letters generated (bureau, round, mailed date) retained for up to 2 years to support FCRA deadline tracking. This log does not store full account numbers or creditor names.

Usage Data

• Error and performance data collected by Sentry (see Section 3 — all credit-report content is scrubbed before transmission)
• Upload history hashes used for duplicate-file detection (we store a hash, not the file content)

2. How We Use Your Data

• Extracting account information from your credit reports to identify potential errors
• Generating dispute letters citing applicable FCRA provisions
• Tracking dispute deadlines so you know when bureaus must respond
• Processing your subscription payments
• Detecting and fixing application errors (via Sentry — no credit content transmitted)

We do not sell your data, use it for advertising, or share it with data brokers.

3. Third-Party Services

Running ScoreIsUp requires us to share certain data with trusted service providers. Here is exactly what each provider receives:

All providers are contractually prohibited from using your data for any purpose other than providing their service to us.

4. Data Retention

• Credit report PDFs: deleted from storage after 30 days
• Analysis cache: deleted after 30 days
• Dispute letter records: retained up to 2 years to support FCRA deadline tracking, then automatically purged
• Account data: retained while your account is active; deleted upon account deletion request
• Payment records:retained per Stripe’s legal obligations (typically 7 years)

5. Your Rights

• Access: Request a copy of the data we hold about you
• Deletion: Request deletion of your account and associated data. Contact us at support@scoreisup.com — we’ll process requests within 30 days.
• Export: Request a copy of your analysis results and dispute letter records
• Correction: Update your account information via your profile settings

California residents may have additional rights under the CCPA. EU/UK residents may have additional rights under GDPR/UK GDPR. Contact us to exercise any of these rights.

6. Security

• All data in transit is encrypted via TLS
• Credit report PDFs are stored with server-side encryption
• Database access is restricted by row-level security — you can only access your own data
• Error monitoring (Sentry) is configured to scrub all financial identifiers before transmission
• We do not store full account numbers or SSNs in our database

7. Changes to This Policy

We will notify subscribers of material changes via email at least 14 days before they take effect. The “Last Updated” date at the top of this page reflects the most recent revision.

If we change how your credit report data is shared with AI providers, we will ask for your renewed consent before you can continue using the analysis features.

8. Contact

Privacy questions or data requests:

We aim to respond to all privacy requests within 5 business days.