Is my data safe with CreditRefresh?
CreditRefresh protects your data with encrypted HTTPS connections, encryption at rest, AES-256 encryption on the full copy of each credit report in the CreditRefresh database, and card payments tokenized by the payment processor. CreditRefresh does not sell your personal information for money. In Settings you can turn on two-factor authentication, download your data and delete your account.
A short answer on how CreditRefresh protects your data
CreditRefresh is do-it-yourself, AI-powered credit dispute software that works with sensitive information, including your Social Security number and your Equifax, Experian and TransUnion credit reports. CreditRefresh protects that information with encrypted HTTPS connections, encryption at rest in CreditRefresh's production database, an extra layer of AES-256 encryption on the complete copy of each credit report in that database, and card payments tokenized so CreditRefresh's servers never receive your full card number. Pulling your own reports through CreditRefresh is a soft inquiry, so the pull does not lower your credit score.
How CreditRefresh protects your Social Security number and credit reports
- Encrypted connections. The CreditRefresh website and app load only over encrypted HTTPS connections. A plain http address redirects to https, and your browser is told to use HTTPS on every later visit.
- Encryption at rest. Personal information is encrypted at rest in CreditRefresh's production database, and the documents you upload are kept in private storage.
- Extra encryption for credit reports. CreditRefresh encrypts the complete copy of each credit report with AES-256 before the copy goes into the CreditRefresh database. The account details CreditRefresh shows you and uses in your letters are stored separately under the database's encryption at rest.
- Hashed passwords. CreditRefresh stores your password only in hashed form, so the password itself is never saved.
- Identity verification before any report pull. CreditRefresh pulls credit reports only after you pass identity verification, which helps keep someone else from pulling reports in your name.
How CreditRefresh handles the documents you upload
CreditRefresh asks for a photo ID and a proof of address because credit bureaus usually want proof of who you are before they act on a mailed dispute. When you place a RushMail order for your bureau letters, CreditRefresh encloses copies of those documents with each bureau letter. A copy of your Social Security card is optional, and CreditRefresh encloses one only if you upload it. When you upload a response letter from a bureau, CreditRefresh uses AI to read the letter so the app can show the outcome for each disputed account.
Your uploads are kept in private storage tied to your account. You can delete an uploaded ID, proof of address or Social Security card copy on the Documents page in the app. Replace on that page adds a new copy and keeps the earlier one, and Settings under Account lists every copy in Identity documents, each with its own delete button. You can delete an uploaded response letter with Delete file on that letter, which also removes any result recorded from it. Delete file is not offered once a reply to that letter has been prepared or mailed, so email support@creditrefresh.ai if that letter was uploaded by mistake.
How CreditRefresh handles your card payments
You enter your membership card details in a secure payment form that sends them straight to the payment processor, which returns a token CreditRefresh uses for billing. Updating your card in Settings works the same way. RushMail orders are paid on the payment processor's own checkout page. In every case CreditRefresh's servers never receive your full card number, and CreditRefresh does not store it. The payment processor keeps your card and billing address on file, and CreditRefresh shows the last four digits of that card in Settings so you can recognize the card.
How CreditRefresh uses AI with your credit reports
After CreditRefresh pulls your reports, an AI model analyzes them for possible errors and possible Fair Credit Reporting Act violations. Your data is not used to train third-party AI models.
The AI does not dispute information on your behalf. A dispute letter reaches a credit bureau only when you mail it yourself or place a RushMail order.
How to keep your CreditRefresh account secure
CreditRefresh gives you three security controls in Settings under Security.
- Change password. Use a password of at least 8 characters that you do not use anywhere else. Changing your password signs you out on every device.
- Two-factor authentication. Select Enable to add a one-time code from an authenticator app to every sign-in.
- Sign out everywhere. Select Sign out of all devices to end every session on every device, including the one you are using.
Do not share your password or two-factor code with anyone, including someone who says they work for CreditRefresh. CreditRefresh support does not need either one to help you. To avoid fake sign-in pages, type app.creditrefresh.ai into your browser instead of following a link in an unexpected message.
Which details you should never send CreditRefresh by email
Do not send your Social Security number, your full date of birth, your card number or photos of your ID by email. If CreditRefresh support needs your ID or proof of address, upload it on the Documents page in the app instead of attaching it to an email. Upload a bureau response letter with Upload a response letter on the dispute round that the letter answers.
How to download or delete your CreditRefresh data
- Download a copy. In Settings under Security, the Data & privacy section has Request data export. CreditRefresh emails you a download link when the export is ready. The link works for 7 days and downloads a file of your account records, without copies of your uploaded files. Download the export before you delete your account, because CreditRefresh stops sending email to an account scheduled for deletion.
- Delete your account. First cancel your plan with Cancel plan in Settings under Billing and subscription, because deleting your account does not cancel your plan and you cannot sign in to cancel afterward. If Billing and subscription shows no Cancel plan or Cancel renewal button, email support@creditrefresh.ai before you delete your account. Then select Delete account in the Data & privacy section and confirm. Deleting your account signs you out on every device, ends the credit monitoring CreditRefresh set up for you and schedules the account and its data for permanent deletion.
- Know what CreditRefresh keeps. CreditRefresh keeps some records after an account is deleted, such as billing records and records of account activity. The Privacy Policy describes how CreditRefresh retains data.
- Other privacy requests. To ask what CreditRefresh holds about you, to correct it or to opt out of targeted advertising, email support@creditrefresh.ai. CreditRefresh verifies your identity before acting and generally responds within 45 days.
- Marketing emails. Turn off Marketing emails in Settings under Notifications, or use the unsubscribe or Email preferences link at the bottom of a marketing email. Account and billing emails continue while your account is open.
What to do if you think someone else used your CreditRefresh account
- Change your password with Change password in Settings under Security. If you cannot sign in, select Forgot password? on the sign-in page and use the reset link CreditRefresh emails you. Changing or resetting your password signs you out on every device, including the one you are using.
- Sign back in with your new password.
- Turn on two-factor authentication by selecting Enable next to Two-factor authentication in Settings under Security.
- Email support@creditrefresh.ai with the activity you noticed and the date it happened.
- Protect your credit. If someone may be using your identity to open accounts, report it to the Federal Trade Commission at IdentityTheft.gov and consider a security freeze with Equifax, Experian and TransUnion.
Frequently asked questions about CreditRefresh and your data
Does CreditRefresh sell my personal information?
CreditRefresh does not sell your personal information for money.
Does checking my credit through CreditRefresh lower my score?
No. CreditRefresh pulls your own reports as a soft inquiry, and soft inquiries do not lower your credit score.
What does CreditRefresh do with my Social Security number?
Your full number goes to CreditRefresh's identity verification provider to confirm who you are before your reports are pulled. CreditRefresh does not save the full number you type into the verification form, and your CreditRefresh profile keeps only the last four digits, encrypted. Credit reports can also include your Social Security number as the bureaus report it, and CreditRefresh encrypts the complete copy of each report with AES-256. If you upload a copy of your Social Security card, CreditRefresh keeps that image in private storage.
Can CreditRefresh see my bank accounts?
No. CreditRefresh does not connect to bank accounts. CreditRefresh sees the credit accounts listed on your credit reports, such as credit cards, loans and collections.
Can CreditRefresh change my credit report?
No. Only a credit bureau can change your credit report, for example after a dispute or an update from the company that reported an account. CreditRefresh writes dispute letters, and you decide whether to mail them.
How do I delete my CreditRefresh account?
Cancel your plan in Settings under Billing and subscription first, because deleting your account does not cancel your plan. Then use Delete account in Settings under Security, which schedules the account and its data for permanent deletion.
Still have a question about your data? Email support@creditrefresh.ai.
Related articles
CreditRefresh is an app that uses AI to find errors and FCRA violations on your credit reports, then drafts custom dispute letters to Equifax, Experian, and TransUnion. It pulls your reports automatically, flags inaccurate balances, outdated items, and reporting that violates federal law, and tracks each bureau's 30-day response. You approve every letter before it's sent.
A soft pull is a credit check that doesn't affect your score and isn't visible to other lenders — covering things like checking your own credit, pre-approval offers, and the pulls CreditRefresh runs on your reports. A hard pull is a credit check tied to a credit application that does affect your score, usually by a small amount, and stays visible to lenders for two years.
A credit freeze blocks most new credit applications by preventing lenders from pulling your credit reports. It's free, federally protected, and the strongest single tool against identity-theft-driven new accounts. A freeze affects bureau pulls — including services like CreditRefresh — so frozen reports need to be temporarily thawed for scans and disputes.
Credit Karma, Experian, and similar tools tell you what's on your credit reports and what your score looks like. CreditRefresh goes further by acting on what's there — using AI to find errors and FCRA violations, drafting custom dispute letters for all three bureaus, and tracking the responses. Monitoring tools show you the problem. CreditRefresh works on fixing it.