Privacy Policy

1. Who we are

Andromeda Credit, Inc., a Delaware corporation with offices at 5331 West Schubert Avenue, Chicago, IL 60639, United States ("Andromeda", "we", "us"), provides software that reads the credit report you upload and prepares you for funding decisions. This policy explains what information we collect and how we use it.

2. Information we collect

We collect only what the service needs:

• Account data: name and email, managed through our authentication provider (Auth0).
• Credit report data: the credit report you upload yourself (PDF from Experian, Equifax and TransUnion or a tri-bureau provider). Andromeda does not pull reports from the bureaus and creates no inquiries. We extract scores, accounts, balances, limits and inquiries from that file.
• Business data: what you tell us about your company (entity, NAICS, banking relationships) to build your funding plan.
• Bank connection data: only if you connect an account through Plaid; access tokens are encrypted.
• Product events: what you do in the app (uploads, actions you mark done, outcomes you record). We do not use third-party advertising or analytics trackers.

We do not store your Social Security Number. Where an identifier is required, we retain only the last four digits.

3. How we use your information

We use your information to read the report you upload, run the Decision Engine, build your funding plan, send the alerts and reminders you request, and provide support. Outcomes you record (for example a credit limit increase) are shown back to you and used in aggregated, anonymous community statistics unless you turn that off in Settings. We do not sell your personal information.

4. Credit reports & the FCRA

We process your credit report only after you authorize it in the app, and we keep a record of that authorization (text, version, date, IP address). Under the Fair Credit Reporting Act you have the right to obtain your reports and to have inaccurate data corrected by the bureaus at no cost. You may withdraw your authorization at any time from Settings or by contacting us; we then stop processing new reports.

5. Service providers (sub-processors)

These providers process data on our behalf under their own security and privacy commitments:

• Auth0 — login and identity.
• Stripe — payments. Card numbers never reach Andromeda.
• Vercel and Railway — hosting of the app, API and database (encrypted at rest).
• Google (Gemini) and Anthropic (Claude) — AI models that read the content of the report you upload to extract and explain it. We send the data needed for that task and use business terms under which it is not used to train their models.
• Plaid — bank connections, only if you connect an account.
• Resend — transactional email.
• Cloudflare — DNS and network protection.

If an agency (white-label partner) invited you, that agency can see the reports and plan it manages for you, under the authorization you gave them.

6. Data retention & your choices

• Uploaded PDF: deleted as soon as it is processed, and in any case within 72 hours.
• Extracted report data and your plan: kept while your account is active.
• Assistant conversations: deleted after 90 days.
• Authorization and audit records: kept as required by law, even after deletion of the account.

From Settings you can export your data, revoke authorizations, and request deletion of your account. Deletion requests are executed automatically 30 days after the request, or sooner if you write to support@andromedacredit.com.

7. Changes to this policy

As an early-stage product, our practices may change. We will update the date above when we make material changes.