Privacy

Who we are and what this covers

ColdCredit is operated by ColdCredit LLC ("ColdCredit", "we"). This policy covers coldcredit.co, the ColdCredit console, and the guide pages businesses send people to. ColdCredit is offered only to businesses in the United States: a new account or organization can be created only from the United States or a US territory, judged by the country of the IP address. We store and process data in the United States. It does not cover the websites of Equifax, TransUnion or Experian, which have their own privacy policies.

Questions and requests go to privacy@coldcredit.co. There are two groups of people, and we handle their data differently:

• Business users: the staff of an organization with a ColdCredit account, and people who write to us. For this data ColdCredit decides what is collected and why.
• Guide visitors: the people a business sends a guide to. For this data ColdCredit acts on behalf of that business, as its service provider or processor, under our data processing addendum.

Business users

What we collect and where it comes from

• Identifiers and contact details

  What it is

  Your name and email address. If you sign in with Google or Microsoft, the name and email address that provider sends us.

  Source

  You, or your sign-in provider

• Account login

  What it is

  A password hash kept by our sign-in provider (we never store your password itself), and an authenticator-app factor if you add one. When you set a password we check it against known breached passwords by sending only the first five characters of its hash.

  Source

  You

• Invitations and roles

  What it is

  The email address an invitation was sent to, who sent it, the role, and whether it was accepted.

  Source

  A member of your organization

• Organization profile

  What it is

  Organization name, business type, website, console address, the NCUA charter number a credit union gives, branding (logo, color, favicon) and the wording of its links.

  Source

  You and your team

• Billing

  What it is

  Stripe customer and subscription IDs, plan, billing email, card brand or bank name and the last four digits, invoices and tax-exempt status. Full card and bank numbers stay with Stripe.

  Source

  You, and Stripe

• Activity log

  What it is

  Who changed what in your organization's account and when, without passwords or anything about the people who open your guides.

  Source

  Your use of the console

• Sign-up signals

  What it is

  Whether the account owner's address is a free email service, and whether it matches the organization's website, shown to ColdCredit staff to spot fake businesses.

  Source

  Derived from what you give us

• Contact form messages

  What it is

  Your name, email, organization and message. We email them to our own inbox and keep no copy in our database.

  Source

  You

• Security events

  What it is

  When you sign up, sign in, pass a two-factor check, reset your password, turn on two-factor sign-in, accept an invitation, create an organization, change a member's role, create, rotate or revoke an API key, or start checkout, we record what happened with your IP address, its approximate country and your browser details. We keep these records for 12 months. The country your organization was created from is also stored with its record. Our sign-in provider also records the IP address of each sign-in session and of sign-in events.

  Source

  Your browser, and the country our hosting provider finds for its IP address

• Technical data

  What it is

  IP address and browser details on every request. The IP address also limits how often requests can be made: for that, our database keeps only a keyed hash of it, which cannot be turned back into the address without our secret, in a counter that expires within 30 minutes. On sign-up, sign-in, password reset and the contact form they are also used for a bot check. Our hosting provider's request logs can hold them for a short time.

  Source

  Your browser

Why we use it

• To create and run your account, sign you in and keep it secure, including two-factor sign-in and bot and abuse checks.
• To prevent fraud and investigate misuse of an account, and to limit new accounts to businesses in the United States, using the IP address and country in security events.
• To bill for the subscription, send receipts, trial reminders and payment notices, and keep tax and accounting records.
• To show your organization's owners and admins what changed in the account and who changed it.
• To answer you, provide support, and tell you about changes to the service or these policies.
• To spot and stop fake businesses, fraud and misuse, and to meet legal obligations.

Separate from our consumer product

ColdCredit LLC also runs a consumer product, 3Bfreeze. ColdCredit has its own sign-in system and its own database, separate from 3Bfreeze's: your ColdCredit login does not sign you in to 3Bfreeze, and 3Bfreeze's credentials cannot read your organization, team or guide data.

We send business users service and account email only, such as sign-in links, invitations, billing notices and trial reminders. We do not send marketing email. If we start, it will say who it is from, include our postal address, and let you unsubscribe in one step.

Guide visitors

If a business sent you a guide, this section is for you. A guide is anonymous: it does not ask for your name, email address, phone number or any other contact detail, and it needs no account. You freeze or unfreeze your credit on each bureau's own website, which opens in a new tab. ColdCredit never receives what you type there, so we never receive your Social Security number, date of birth, address or bureau login.

What the guide records, for the business that sent it

• A random visitor ID

  What it is

  Made in your browser and kept there, so a return visit is not counted as a new person. It is not linked to your name or contact details.

• What happened

  What it is

  That the guide was opened, which bureau a step was about, and whether you marked a bureau done, marked it not done, or reported a problem.

• Device details

  What it is

  A shortened browser description (the user-agent string your browser sends), the device type, and whether you arrived from a QR code.

• A reported problem

  What it is

  The kind of problem and any note you type. Emails, phone numbers and long numbers are removed in your browser and again on our server before it is saved; anything else you type is kept as written.

If the business added an explainer video to its guide, the guide shows a play button first, and nothing is loaded from the video provider until you press it. When you press play, the video is played from the provider the business chose (YouTube, Vimeo, Loom or HeyGen; YouTube videos play from YouTube's privacy-enhanced player at youtube-nocookie.com). That provider then receives your IP address and browser details and may set its own cookies, under its own privacy policy. ColdCredit sends it nothing else.

The business sees counts of visits, people and completions for its own links, and the problems people report. Marking a bureau done is your own report: ColdCredit does not check it with the bureau. Your IP address is used to limit how often a page can send events: our database keeps only a keyed hash of it, never the address, in a counter that expires within 30 minutes.

Who decides, and who to ask

The business that sent you the guide decides to use ColdCredit and sees what the guide records for its links; its own privacy notice applies to it. You can ask that business, or write to us at privacy@coldcredit.co. Because a guide does not know who you are, we can find your records only from the random visitor ID stored in your browser; we will tell you how to send it if you ask. You can also delete your saved progress and visitor ID at any time by clearing this site's data in your browser.

Who we share data with

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising or for profiling that has legal or similarly significant effects. We share it only:

• With the service providers that host and run ColdCredit, under contracts that limit their use of it. The security page lists each one, what it sees and where it is located.
• With the business that sent a guide, for that business's own links. A business never sees another business's data.
• Within your organization, as your roles allow: owners and admins can see the team, invitations and the activity log.
• When the law requires it, to protect people or our rights, or in a sale or reorganization of our business, where this policy keeps applying to the data.

How long we keep it

• Account and organization data: while the account is open.
• When an organization is deleted it can be restored for 30 days. After that we erase its team, invitations, branding, link wording and every record its guides made, and replace staff email addresses in its activity log with "[redacted]". We keep the organization record, its status history, the redacted activity log and its link codes, so a printed QR code never opens someone else's guide.
• Guide records: while the business's account is open, and erased as above when it is deleted.
• Billing records and invoices: as long as tax and accounting law requires.
• Security events (IP address, country and browser details of sign-ups, sign-ins and security changes): 12 months, then a daily job deletes them. They are kept for those 12 months even if the organization or the login is deleted first; a deleted login's events are no longer linked to it.
• Rate-limit counters: they expire within 30 minutes and a daily job deletes them. Hosting request logs: the short period our hosting provider keeps them.
• Backups: our database provider takes a daily backup of the whole database and keeps it for 7 days, so data erased by the steps above leaves its backups within 7 days.
• A business user can ask us to delete their login at any time. We will do so unless they are the only owner of a live organization, in which case ownership must move to someone else or the organization be deleted first.

Cookies and browser storage

We use only the cookies and browser storage the site needs to work. ColdCredit sets no advertising cookies and uses no third-party analytics or tracking pixels. The one exception to "nothing from a third party" is an explainer video a business adds to its guide: once you press play, the video provider can set its own cookies and recognize your browser across other sites that embed its videos, as described in the guide visitors section. Until you press play, nothing is loaded from it.

• Guide pages

  What is stored

  Browser storage on your device: the random visitor ID, your progress through the guide, and events waiting to be sent if you were offline. A per-tab marker so one visit is counted once.

  How long

  Until you clear site data in your browser

• Console and sign-in

  What is stored

  Cookies that keep you signed in (from our sign-in provider) and short-lived cookies for email verification and sign-in with Google or Microsoft.

  How long

  The session, or up to an hour

• Display choices

  What is stored

  Your light or dark display choice and, in the console, which billing notices you dismissed.

  How long

  Until you clear site data

Do Not Track and Global Privacy Control

ColdCredit does not track you across other websites, so a Do Not Track signal does not change what we do. A video provider whose player a business embeds handles the signal under its own policy. We do not sell or share personal information, so there is nothing for a Global Privacy Control signal to opt you out of; if that changes, we will treat the signal as an opt-out request.

Your rights and how to use them

Depending on the state you live in, you may have the right to:

• know what personal information we hold about you, how we got it and who we share it with, and get a copy in a portable format;
• correct inaccurate information, and delete information about you;
• opt out of the sale or sharing of personal information, targeted advertising and certain profiling (we do none of these);
• limit our use of sensitive personal information (we use your account login only to sign you in and keep your account secure);
• appeal if we decline your request, and not be treated differently for using any of these rights.

Email privacy@coldcredit.co with what you want. We will confirm we received it within 10 business days and answer within 45 days, or tell you if we need another 45. To protect you, we confirm a request by writing back to the email address on the account; for a guide visitor, by the visitor ID in your browser. You can use an authorized agent, who must show us your signed permission. If we decline, we will say why and how to appeal; reply to our answer with "Appeal" and a different person will review it within 45 days. If you are not satisfied with the appeal, you can contact your state attorney general.

If a guide visitor asks us about data a business collected through its guide, we may pass the request to that business and help it answer, as its service provider.

For California residents

In the last 12 months we collected the categories in the tables above: identifiers (name, email address, the random visitor ID, IP address), approximate location (the country of a business user's IP address), customer records (billing contacts and the last four digits of a card or bank account), commercial information (plan and invoices), internet or other network activity (guide events, browser and device details), professional information (your organization and role), the account login (a sensitive category, used only to sign you in) and any note a guide visitor types. The sources and purposes are described above. We disclosed each category to our service providers for the business purposes described above, and we did not sell or share any of it. We do not knowingly collect information from anyone under 16.

Nevada residents: we do not sell covered information as Nevada law defines it.

Children

ColdCredit is a service for businesses and is not directed to children. Guides are meant for adults managing their own credit. We do not knowingly collect personal information from children under 13; if you believe a child used a guide, write to us and we will delete what we can identify.

Security

We use HTTPS everywhere, encryption at rest with our database provider, a database of ColdCredit's own (separate from ColdCredit LLC's consumer product, 3Bfreeze), row-level security that keeps each organization to its own data, two-factor sign-in for every ColdCredit staff session, and rate limits and bot checks on public forms. The security page describes the controls in detail. No system is perfectly secure; if a security incident affects your personal information, we will tell you, or the business that sent your guide, as the law requires. Report a security problem to security@coldcredit.co.

Changes to this policy

The version date at the top changes whenever this policy does. Before a material change takes effect, we will tell account owners by email. We will not use personal information already collected in a materially different way without the consent the law requires.

Contact

ColdCredit LLC, privacy requests and questions: privacy@coldcredit.co. Everything else: support@coldcredit.co.