Privacy Policy

• Account information — the name, email address, phone number and address you register, and the identifier supplied by our authentication provider when you sign in.
• Business details — registered and trading names, previous names, country and form of incorporation, registration and tax numbers, registered address, date of establishment, group structure, business activities and primary currency.
• Documents you upload — incorporation and tax certificates, bank statements and bank verification letters, financial statements, and identity documents for directors, shareholders and beneficial owners, together with the information extracted from them by automated analysis.
• Trade references — the name, email address, phone number and address of each reference you nominate, and their responses.
• Credit applications — the counterparties, the limit requested, the limit approved, and the status and timestamps of each application.
• Accounting data — where you connect Xero or QuickBooks, the access tokens for that connection and the accounting data it exposes.
• Billing information — subscription status and payment records. Card details are handled by our payment processor and never reach our systems.

Identity documents deserve particular care. We collect them only because trade credit assessment requires verifying who stands behind a business, we make them available only to you and to the vendors you submit an application to, and we do not use them to build profiles or for any purpose beyond the application they support.

• to operate your account and authenticate you;
• to assemble, submit and track credit applications, and to make them available to the vendors you apply to;
• to run automated analysis of uploaded documents, so that discrepancies and missing information surface for human review;
• to check whether your account meets the document and trade-reference requirements for submitting an application;
• to contact the trade references you nominate;
• to bill subscriptions and keep financial records;
• to secure the service, investigate suspected fraud or misuse, and comply with our legal obligations.

Where data protection law requires a legal basis, we rely on:

• Contract — to provide the service you have signed up for.
• Legitimate interests — to secure the platform, prevent fraud and improve the service, where those interests are not overridden by your rights.
• Legal obligation — to keep records and respond to lawful requests.
• Consent — where you connect an optional integration, and where consent is otherwise required.

• Vendors you apply to — receive your business details, supporting documents and analysis results when you submit an application to them. This is the point of the service, and it happens on your instruction.
• Authentication provider — manages sign-in and holds your credentials.
• Hosting and storage — our hosting provider runs the application and stores uploaded documents.
• Document analysis provider — uploaded documents are sent to a third-party language model provider for analysis.
• Payment processor — handles subscription billing.
• Backup storage — we keep encrypted backup copies of our records with a storage provider located in the European Union, for the retention periods described below. They are encrypted under a key that provider does not hold, so it cannot read them.
• Email provider — sends invitations and trade-reference requests on your behalf.
• Accounting platforms — exchange data with us only for connections you enable.
• Authorities and advisers — where we are legally required to disclose, or need to establish or defend legal claims.

We do not sell personal information or share it for advertising.

We keep account and application records for as long as your account is active and afterwards for as long as we need them for the purposes above — including record-keeping obligations that apply to credit and financial documentation. Documents you delete are removed from our file storage and from our records.

A vendor that has already received your application holds its own copy under its own obligations, which we cannot delete on your behalf.

Backup copies are retained on the same basis and are overwritten or removed on the backup schedule, so a deletion can take longer to propagate to them than to the live service.

Depending on where you are, you may have the right to access, correct, delete, export or restrict the use of personal information, to object to certain processing, and to withdraw consent. You can update most details directly in the application; for anything else, contact us at the address below. You may also complain to your local data protection authority.

Access is authenticated, documents are stored with unguessable identifiers and served through short-lived download links, and access to an application's documents is restricted to the account that owns them and the vendor it was submitted to. No system is perfectly secure, and we cannot guarantee absolute security.

We use cookies that are necessary for the service to work — keeping you signed in, remembering your interface preferences and protecting against cross-site request forgery. We do not use advertising cookies.

Our providers may process information in countries other than yours. Where information leaves its country of origin we rely on the transfer safeguards available under applicable law.

We will update this policy as the service changes, and will notify you of material changes before they take effect.

Credalize, [registered address]. Privacy requests: [email protected].