Privacy notice

Who we are

CreditConfirm Technologies Inc., trading as CreditConfirm, is the data controller for the personal information described in this notice — we decide why and how it is handled. Where a vendor uses the service to run its own credit checks, that vendor is the controller of the applicant records it creates and we act as its processor for those records.

Contact us about privacy at privacy@creditconfirm.ca.

What we collect and why

• Vendor account details — name, business email, phone, company name and role. Used to create and secure your account, authenticate you, and provide support. Legal basis: performance of our contract with you.
• Applicant business information — legal and operating name, business number, addresses, trade and banking details submitted on a credit application. Used to operate the credit application, bank confirmation and trade reference workflow the vendor requested. Legal basis: performance of a contract and our legitimate interest in providing the service.
• Authorized signer and banker contact details — name, title, email, phone. Used to deliver an authorization or confirmation request and to record the response. Legal basis: legitimate interests of the vendor and the applicant in completing an authorized credit check.
• Authorization and signature records — the signed authorization, timestamps, IP address and one-time-code verification events. Used to prove that a check was properly authorized. Legal basis: legal obligation and legitimate interest in maintaining an audit trail.
• Masked account identifiers and banker responses — partial account numbers, institution and transit details, and the completed confirmation. Used to produce the record the vendor relies on. Legal basis: performance of a contract.
• Support messages — what you send us and our replies. Used to answer you. Legal basis: legitimate interests.
• Usage, device and log data — pages viewed, actions taken, browser type, IP address and error reports. Used for security, fraud prevention, troubleshooting and improving the product. Legal basis: legitimate interests.
• Marketing contact details — where you opt in to updates. Legal basis: consent, withdrawable at any time.

Payment card details are collected and handled by Paddle, our Merchant of Record. We never see or store full card numbers.

Who we share it with

• Service providers and subprocessors that host our infrastructure, deliver our email and SMS, and support our product — acting on our instructions under contract.
• Paddle.com, our Merchant of Record, for sale of the product, subscription management, payments, tax compliance and invoicing.
• The parties to a check you initiate: an applicant's authorized signer, their financial institution, or the trade references they nominate receive only what is needed to answer the request.
• Professional advisers such as our legal and accounting advisers, where necessary.
• Authorities, regulators or courts where we are required by law to disclose, or to establish or defend legal claims.
• A buyer or successor, if we are involved in a merger, acquisition or sale of assets.

We do not sell personal information and we do not share it for advertising.

Where it is stored

Our infrastructure and service providers may store or process information outside Canada, including in the United States and the European Union. Where information crosses a border, we use contractual protections such as standard contractual clauses, and comparable safeguards, and it remains subject to the laws of the country it is in.

How long we keep it

Credit files, authorizations and completed confirmations are retained under the vendor organization’s configured retention schedule, with support for legal holds. Account and billing records are kept while your account is active and for up to seven years after, to meet Canadian tax and record-keeping obligations. Log and usage data is kept for up to twelve months. When information is no longer needed, we delete or anonymise it.

Your rights

Under Canadian privacy law, including PIPEDA and comparable provincial legislation, you may ask us to:

• access the personal information we hold about you and be told how it has been used and disclosed;
• correct information that is inaccurate or incomplete;
• delete information where we no longer have a reason to keep it;
• withdraw consent, including for marketing, at any time;
• raise a concern about how we have handled your information.

Email privacy@creditconfirm.ca and we will respond within 30 days. If a vendor collected the record through the service, we may need to refer your request to that vendor as the controller, and we will tell you when we do. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada, or to your provincial privacy regulator. Individuals in the UK or EEA also have GDPR rights of restriction, portability and objection, and may complain to their local supervisory authority.

An authorized signer may decline an authorization request, or revoke it before a response is received, directly from the link they were sent.

Security

We use appropriate technical and organizational measures to protect personal information, including encryption in transit and at rest, row-level access controls that isolate each vendor workspace, one-time-code verification for signing, least-privilege access for our staff, and audit logging of sensitive actions. No system is perfectly secure, but we work to keep the risk low and will notify affected people and regulators where the law requires.

Cookies

We use strictly necessary cookies and similar storage to keep you signed in, secure your session and remember your preferences. These are required for the service to work. We use a small amount of privacy-respecting analytics to understand which pages are used, and our payment provider sets cookies during checkout. We do not use advertising or cross-site tracking cookies. You can clear or block cookies in your browser, though signing in will not work without the necessary ones.

Changes to this notice

We will update this notice as the service changes, and will tell you by email or in the application if the change is significant.