Skip to content
ColdCredit
Request early access

Data Processing Addendum

How ColdCredit processes personal information about guide visitors on behalf of the organizations that use it, exactly as published in this version. Part of the Business Terms.

Version 2026-10-23

This is the current version. Current addendum. Every version. SHA-256 of this text: f36d93b1ed357495f9f6bde9c81be8f8881d2a5a7cf96a1eda93c65e53ce0d6f

1. Scope and roles

  • This addendum is part of the Business Terms between Coldcredit LLC, a Georgia limited liability company with its principal office at 160 Ammons Road, Waleska, Georgia 30183 ("ColdCredit"), and the organization that accepted them ("Customer"). It applies when ColdCredit processes Customer Personal Data: personal information about guide visitors, including information the Customer sends or receives through the API and webhooks, that ColdCredit processes on the Customer's behalf.
  • For Customer Personal Data the Customer is the business or controller and ColdCredit is its service provider, contractor or processor under the California Consumer Privacy Act (as amended by the CPRA) and the other US state privacy laws that apply ("Data Protection Laws").
  • It does not cover the account details of the Customer's own staff (name, email, login), which ColdCredit handles as described in its privacy policy.
  • Annex 1 below describes the processing. If this addendum and the rest of the Business Terms differ on data protection, this addendum wins.

2. Instructions and purpose

  • ColdCredit processes Customer Personal Data only to provide the service described in Annex 1, on the Customer's documented instructions. The Business Terms, this addendum and the Customer's choices in the console and through the API are those instructions.
  • ColdCredit will tell the Customer if it believes an instruction breaks a Data Protection Law, and need not follow it.
  • The Customer confirms it has the right to have the data processed this way and gives guide visitors any notice the law requires.

3. Service provider commitments

ColdCredit will not:

  • sell or share Customer Personal Data, as the CCPA defines those words, or use it for targeted advertising;
  • keep, use or disclose it for any purpose other than the business purposes in Annex 1, including any commercial purpose of its own, or outside the direct business relationship with the Customer;
  • combine it with personal information ColdCredit receives from anyone else or collects itself, except as Data Protection Laws allow a service provider to do;
  • try to re-identify a guide visitor.

ColdCredit will:

  • comply with the Data Protection Laws that apply to it and give Customer Personal Data the level of privacy protection they require;
  • tell the Customer within 10 business days if it decides it can no longer meet these obligations;
  • let the Customer take reasonable and appropriate steps to ensure the data is used consistently with these obligations, and to stop and remediate any unauthorized use;
  • make sure everyone at ColdCredit who processes the data is bound to keep it confidential.

ColdCredit may use data that has been de-identified, so that it cannot reasonably be linked to a person, household or device, and aggregated across customers to run and improve the service. It keeps that data de-identified, does not try to re-identify it, publicly commits not to, and requires the same of anyone it shares it with.

ColdCredit certifies that it understands the restrictions in this section and will comply with them.

4. Financial institution customers

  • (a) If the Customer is a financial institution under the Gramm-Leach-Bliley Act, any Customer Personal Data that is nonpublic personal information or customer information (as defined in 12 CFR 1016.3 and 16 CFR 314.2), including any API session reference, metadata or webhook payload that relates to an identifiable customer or member, is "Customer Information".
  • (b) ColdCredit will implement and maintain administrative, technical and physical safeguards for Customer Information designed to meet the objectives of 16 CFR 314.4, 12 CFR Part 748 Appendix A and the Interagency Guidelines Establishing Information Security Standards, as applicable, including those in Annex 2.
  • (c) ColdCredit will not use or disclose Customer Information except to provide the service to the Customer, as permitted by 12 CFR 1016.11 and 16 CFR 313.11, and as required by law.
  • (d) ColdCredit will cooperate with the Customer's due diligence, contract and periodic assessment of ColdCredit as a service provider.
  • (e) The Customer will send through the API only an opaque or hashed reference and no account, member, loan or application number, name, contact detail or Social Security number, as the API documentation describes.

5. Subprocessors

  • The Customer authorizes ColdCredit to use the subprocessors listed on the security page and at the end of this page. ColdCredit has a written contract with each that protects the data at least as much as this addendum, including each restriction in section 3, and is responsible for what they do with it.
  • ColdCredit will email the Customer's account owners at least 30 days before it adds a subprocessor or switches on a planned one. The Customer may object on reasonable data protection grounds within those 30 days. If we cannot resolve the objection, the Customer may cancel and get back fees prepaid for the remaining period.
  • A video provider the Customer chooses to embed in a guide (YouTube, Vimeo, Loom or HeyGen) is the Customer's choice, not a ColdCredit subprocessor. Its player loads only when a guide visitor presses play, and then receives the visitor's IP address and browser details, under the provider's own terms.

6. Security

ColdCredit maintains administrative, technical and physical safeguards appropriate to the data, including those in Annex 2 and on the security page, and reviews them as the service changes. ColdCredit does not hold a SOC 2 report.

The Customer is responsible for the security of its own accounts, API keys and webhook endpoints and for what it sends to ColdCredit; ColdCredit is responsible for the measures in Annex 2.

7. Security incidents

  • If ColdCredit becomes aware of, or reasonably believes there has been, unauthorized access to, or acquisition, use, loss or disclosure of, Customer Personal Data (a "Security Incident"), it will notify the Customer's account owners and any security contact the Customer designates in Settings without undue delay, and in any event within 72 hours, or any shorter period the law applicable to ColdCredit requires. ColdCredit will also notify them as soon as possible of any incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the service for four or more hours.
  • Notice goes by email. It will describe what happened, the data and number of records involved as far as known, what ColdCredit is doing, and a contact. ColdCredit will update it as it learns more, and help the Customer meet its own notice duties, including to regulators such as the NCUA and the FTC.
  • ColdCredit holds no contact details for guide visitors, so it cannot notify them directly. The Customer decides whether and how to notify them and its regulators, unless the law requires ColdCredit to do so.
  • Telling the Customer about a Security Incident is not an admission of fault.
  • Report a suspected incident to security@coldcredit.co.

8. Requests from guide visitors and assessments

  • If a guide visitor asks ColdCredit to access, correct or delete Customer Personal Data, ColdCredit will tell the Customer and help it respond, by finding the visitor's records from what the visitor gives, such as the link they used and roughly when, or the visitor ID stored in their browser, and deleting or exporting them. For a link the Customer created for one person through the API, the Customer can identify the person's session by its own reference.
  • ColdCredit will give reasonable help with the Customer's data protection assessments that involve the service.

9. Deletion

  • When the Customer deletes its organization, it can be restored for 30 days. After that ColdCredit erases its guide records, API sessions, webhook endpoints and delivery logs, links' wording, branding, team and invitations, and redacts staff email addresses in its activity log. Link codes are kept, retired, so a printed QR code never opens another organization's guide.
  • While the organization is open, ColdCredit deletes guide records no later than 24 months after the visit.
  • The Customer can ask for an export before the 30 days end, or for earlier deletion.
  • Copies in the database provider's daily backups expire after 7 days. Backups are restored only to recover the service.

10. Information and audits

  • On the Customer's reasonable request, ColdCredit will make available the information in its possession necessary to demonstrate its compliance with this addendum and Data Protection Laws. ColdCredit answers in writing, and through its security packet and questionnaire answers.
  • ColdCredit will allow, and cooperate with, reasonable assessments by the Customer or an assessor it appoints, on 30 days' notice, during business hours, under confidentiality and at the Customer's cost, no more than once a year unless a regulator requires or a Security Incident occurs. With the Customer's consent, ColdCredit may instead provide the report of an independent assessor using an accepted control framework.

11. General

  • The limitation of liability in the Business Terms applies to this addendum.
  • Notices under this addendum are given as section 15 of the Business Terms describes.
  • ColdCredit stores and processes Customer Personal Data in the United States.
  • ColdCredit may update this addendum when the law changes or the service does, with the notice the Business Terms give for material changes. It will not reduce the protection of Customer Personal Data during a paid period. Every version stays available at coldcredit.co/business-terms/versions.

Annex 1: Details of processing

  • Subject matter and purpose

    Details
    Providing the guides a Customer creates, and showing the Customer how its links are used: visits, people, completions, QR versus direct, and reported problems. Where the Customer uses the API: creating a guide link for one person and sending that person's progress to the Customer's webhook endpoint.

  • Duration

    Details
    The term of the Business Terms, then until deletion under section 9. Guide records are deleted no later than 24 months after the visit.

  • Nature of processing

    Details
    Collection by the guide page and the API, storage, aggregation into the Customer's analytics, display to the Customer's users, delivery of session events to the Customer's webhook endpoints, and deletion.

  • Data subjects

    Details
    People who open the Customer's guides (guide visitors), including people the Customer creates an API session for.

  • Personal data

    Details
    A random visitor ID made and kept in the visitor's browser; event kind (visit, bureau marked done or not done, problem reported); bureau; the browser description (user-agent string) the visitor's browser sends, cut at 500 characters; device type; whether the visit came from a QR code; the problem type and any note the visitor types, with emails, phone numbers and long numbers removed. Guide visitors' IP addresses are not stored in ColdCredit's database: only a keyed hash of each, in a counter that expires within 30 minutes and is deleted daily. ColdCredit's hosting provider (Vercel) keeps request logs containing IP addresses for about a day.

  • API sessions and webhook deliveries

    Details
    API sessions: the Customer's external reference for a person, the bureaus selected, up to 20 metadata values supplied by the Customer, open and completion times. Webhook deliveries of session events to the Customer's endpoint, with a log of each delivery: the payload, the response status and the start of the response.

  • Sensitive data

    Details
    None is requested. Social Security numbers, dates of birth, addresses and bureau logins are never asked for. ColdCredit's API refuses some identifier shapes but cannot detect all of them; the Customer must not send them (section 4(e)).

  • Location

    Details
    United States.

Annex 2: Security measures

  • Isolation

    Measures
    A dedicated database schema and database role in ColdCredit's own database project; row-level security limits every read to the Customer's own organization; the credentials of Coldcredit LLC's other product have no access to it.

  • Encryption

    Measures
    HTTPS only, with HSTS; encryption at rest by the database provider; webhook signing secrets encrypted with AES-256-GCM under keys held outside the database; API keys stored only as hashes; card and bank details never reach ColdCredit.

  • Access

    Measures
    Owner, admin and viewer roles; email invitations that expire after 7 days; two-factor sign-in available to every user and required for every ColdCredit staff session; staff changes to a Customer's account appear in that Customer's activity log.

  • Integrity of guide data

    Measures
    Each guide page carries a signed token, so another site cannot post activity to the Customer's analytics; per-IP and per-link rate limits that refuse requests if the limiter is unavailable.

  • Minimization

    Measures
    Guides ask for no names or contact details; problem notes are scrubbed in the browser and again on the server; guide visitors' IP addresses are not stored in ColdCredit's database, only keyed hashes in rate-limit counters that expire within 30 minutes; no third-party analytics or trackers on guide pages; a video the Customer embeds loads from its provider only when the guide visitor presses play, and YouTube plays from youtube-nocookie.com.

  • Secure development

    Measures
    Server-side input validation; every write goes through an audited command; automated tests over access rules; secret scanning before every commit.

Current subprocessors

The list section 5 refers to, kept separately from the versioned text above. It is also on the security page, with what each subprocessor sees.

  • Supabase

    What it does
    Database, sign-in and logo file storage
    Guide visitor data
    Yes
    Where
    United States
    Status
    Active

  • Vercel

    What it does
    Hosting the site, console and guide pages
    Guide visitor data
    Yes
    Where
    United States, with a global delivery network
    Status
    Active

  • Stripe

    What it does
    Subscriptions, payments and invoices
    Guide visitor data
    No
    Where
    United States
    Status
    Active

  • Resend

    What it does
    Email: sign-in links, invitations, billing notices and contact form messages
    Guide visitor data
    No
    Where
    United States
    Status
    Active

  • Cloudflare Turnstile

    What it does
    Bot checks on sign-up, sign-in after failed attempts, password reset and the contact form
    Guide visitor data
    No
    Where
    Global network
    Status
    Active

  • Backup storage

    What it does
    Holding the nightly encrypted backup of ColdCredit's database schema for 30 days
    Guide visitor data
    Yes
    Where
    United States
    Status
    Planned, not active

  • Sentry

    What it does
    Error monitoring and sampled performance tracing
    Guide visitor data
    Yes
    Where
    United States
    Status
    Active