Privacy Policy

1. About this policy

This Privacy Policy explains how CreditXray (“CreditXray”, “we”, “us”, or “our”) collects, uses, stores, and shares information when authorized users access our credit-policy management and calculation platform. CreditXray is the legal business responsible for this service.

2. Information we collect

Account and workspace information

We process names, business email addresses, profile information, roles, permissions, authentication records, and essential session information needed to operate and secure user accounts.

Policy and calculation information

Authorized users may provide lender-policy workbooks, policy rules, customer names and contact details, income and obligation information, requested loan information, calculation inputs, notes, and related business records. We also retain reviewed policy versions, calculation results, source citations, and audit history.

Google account and policy-folder information

If a user connects Google, we receive the connected account’s name and email address, OAuth authorization details, and information from the dedicated Drive folder and policy files created or uploaded through CreditXray. This can include file identifiers, names, metadata, document or image content, spreadsheet content, formulas, formatting relevant to interpretation, and subsequent changes to those app-authorized files.

Technical information

We process security and operational records such as session identifiers, timestamps, application errors, and activity logs. We use essential cookies or equivalent browser storage to maintain authenticated sessions and security controls.

3. How we use information

We use information to:

• authenticate users and enforce organization, role, branch, and team permissions;
• import, structure, compare, review, version, and publish lender policies;
• monitor linked spreadsheets for authorized changes and write reviewed values back when a user chooses that action;
• run eligibility and repayment calculations and preserve the policy and formula context used;
• provide audit history, support, troubleshooting, security, and service administration;
• comply with applicable law and protect the rights and safety of users, customers, and CreditXray.

4. How CreditXray uses Google user data

CreditXray requests only the Google permissions required for the managed policy-folder workflow: basic identity information and https://www.googleapis.com/auth/drive.file. The drive.file permission limits access to files and folders created by, uploaded through, or otherwise explicitly opened with CreditXray.

We use Google user data to identify the connected account, create the dedicated CreditXray Policies folder, store policy documents uploaded through the platform, import and normalize those documents, detect authorized source changes, show changes for review, and update approved spreadsheet values after an authorized publishing action. CreditXray does not use this permission to browse or access unrelated files in the user’s Google Drive.

OAuth access tokens are short-lived. Long-term refresh tokens are encrypted at rest and used only to maintain the connection requested by the user. An authorized user can disconnect Google in CreditXray or revoke CreditXray from their Google Account permissions, and may contact us to request deletion of the stored connection and associated Google account data.

5. AI-assisted processing

CreditXray may use configured AI service providers, including Google Gemini and OpenAI, to extract and normalize lender-policy information from an uploaded spreadsheet, document, PDF, or image. Only information needed for the requested policy-processing operation is sent. AI output is presented for authorized human review before publication and must not be treated as a guaranteed lending decision.

6. When information is shared

We do not sell Google user data or customer data, and we do not use it for advertising. Information may be available to authorized users within the same CreditXray organization according to their permissions. We may also use hosting, database, email, security, analytics, and AI-processing service providers solely to operate and protect the service. These providers receive only the information required for their function and are subject to applicable confidentiality and data-protection obligations.

We may disclose information if required by law, legal process, or a valid government request, or when reasonably necessary to prevent fraud, security incidents, or harm.

7. Storage, security, and retention

We apply role-based access controls, organization-level separation, encrypted transport, password hashing, encrypted Google refresh-token storage, session controls, and activity logging. No method of storage or transmission is completely secure, but we work to protect information proportionately to its sensitivity.

We retain information while the relevant workspace or connection remains active and as needed to provide version history, calculations, auditability, support, security, and legal compliance. Retention can vary by record type and an organization’s requirements. We delete or de-identify information when it is no longer reasonably required, subject to backups and legal obligations.

8. User choices and requests

Users can revoke Google access from their Google Account permissions. To request access, correction, deletion, or information about retained personal data, email shekharsocial.23@gmail.com. We may need to verify the requester’s identity and authority within the relevant organization.

9. Children

CreditXray is a business service and is not directed to children. Users must be legally able and organizationally authorized to use the platform.

10. Changes to this policy

We may update this policy to reflect changes in the service, law, or our data practices. We will publish the revised policy on this page and update the effective date. Material changes may also be communicated through the service or the registered business contact.

11. Contact

Questions or requests concerning this policy can be sent to shekharsocial.23@gmail.com.

Read the Terms of Service