Privacy Policy

Last updated: September 27, 2026

1. What We Collect

• Your account. The email address you sign in with, held by our sign-in provider, Clerk, and stored with your account. If you add a picture, Clerk holds it with your sign-in.
• Credit report PDFs you upload. We keep the PDF itself, so you can open the report again later from any device.
• What we read from the report. Accounts, balances, statuses, dates, inquiries and public records, and the findings we produce from them. These are saved to your account.
• Identity details from the report. Your name, date of birth, the last four digits of your Social Security number, and your address, taken from the first report you upload. We keep these to check that every later upload belongs to the same person. Each check is recorded, along with what the later report showed for those details and the result of the check.
• Your answers to the questions we ask about your report.
• Dispute records. The letters we prepare at your request, the items in each letter, the date you tell us you mailed it, any certified-mail number you enter, the reply you record from the bureau, and any notes you type.
• Payment records. Stripe handles your card. We keep the payment reference Stripe gives us and the date of the payment. We give Stripe your email address so it can send you a receipt.
• Technical information used to run the service: timestamps, which bureau a report came from, page counts, counts of findings, and server logs.

2. How We Use It

We use this information to read your report and look for reporting problems; to save your report and findings to your account so you can return to them; to check that later uploads belong to the same person as the first; to prepare dispute letters you choose to send and to keep track of them; and to run, support and secure the service, including taking payment.

We do not sell your data. We do not use your credit report or your findings for advertising or profiling. Our analysis is rule-based: we do not send your report to any AI service and we do not use it to train AI models.

3. Third Parties

• Stripe processes payments. Stripe handles your card details directly; VioVerse never receives them. We give Stripe your email address for your receipt.
• Clerk handles sign-in and holds your email address and login, and any picture you add.
• Postmark sends our account emails, such as the confirmation when you delete your account. It receives your email address and the email itself, and keeps a copy of each email for 45 days.
• Vercel hosts the web application.
• Render hosts the backend service, the database, and the file storage where your reports are kept.
• Sentry tells us when something breaks on our website or our servers. It receives a technical description of each error, the web address where it happened and the kind of browser and device you use, and keeps each error report for up to 90 days. It does not receive your credit report, your findings, your answers or your letters, and it does not keep your IP address.

These providers process data on our behalf under their own privacy and security commitments. No other third party receives your credit report, your findings or your letters.

4. Data Retention

Everything in Section 1 is kept while your account is open. Hiding a report from your list does not delete it. When your twelve months of paid access end, nothing is deleted; your reports and findings stay in your account. Accounts are not deleted automatically, however long they go unused.

Your data is deleted in one of two ways. If you delete your account yourself (Section 5), everything is deleted right away. If you email us to ask, we delete it within 30 days. In both cases, copies in our backups are gone within 7 days after that.

While you are working, some information is also held temporarily in the server's memory and is cleared when the server restarts. The saved copy in your account is not affected by that.

5. Your Rights

You can delete your account yourself. Sign in, choose the circle with your initials or picture in the top bar, then Account, then Delete my account. After you confirm, we delete your account and its sign-in, every report and its PDF, what we found in them, your identity details and identity checks, your answers, and your dispute records, right away. It cannot be undone.

Paid access ends with the account. The payment is not refunded, though a refund request within 7 days of purchase is still considered under Section 5 of the Terms. Stripe keeps its own records of your payment under its own policy.

If you cannot sign in, email the address in Section 9 from the address you sign in with and ask us to delete your account. We delete it within 30 days and confirm when it is done.

To get a copy of the data we hold about you, email the same address from the address you sign in with. We respond within 30 days.

If you live in a state whose privacy law gives you additional rights, you can exercise them through the same address.

6. Security

All data is encrypted in transit using HTTPS. Payment data is handled by Stripe, a PCI-compliant payment processor, and never reaches VioVerse's servers. Your reports and findings are stored on our hosting provider's database and disk. Access to backend systems is limited to authorized personnel with multi-factor authentication.

7. Children

VioVerse is intended for adults reviewing their own credit reports. The service is not directed at children under 13, and we do not knowingly collect data from children under 13.

8. Changes to This Policy

This policy may be updated from time to time. Material changes will be reflected in the "Last updated" date at the top of this page. Substantive changes affecting how we handle existing user data will be communicated by email.

9. Contact

Privacy inquiries can be directed to david@vioverse.io.