What we collect, how we use it, with whom we share it.

Version

1.14

Last reviewed

October 25, 2026

Contact

privacy@debt-digest.com

1. Scope and Roles

This Privacy Policy applies to the Debt Digest website at debt-digest.com, the authenticated consumer portal, the creditor and settlement-firm dashboards, the application programming interfaces, and any related services we operate (collectively, the “Service”).

Debt Digest’s privacy role depends on the surface:

• Consumer-facing surfaces (consumer portal, marketing site). Debt Digest is the controller of the personal information it collects directly from the consumer for the purpose of operating the Service.
• Creditor-placed accounts. When a creditor places consumer accounts onto the platform for resolution, the underlying creditor is the controller of that information under the Gramm-Leach-Bliley Act (GLBA) financial-institution framework, and Debt Digest acts as a service provider (and, under the GLBA Safeguards Rule, a covered service provider). The terms of that service-provider relationship are governed by the Data Processing Agreement and the pilot or master services agreement between Debt Digest and the creditor.

2. Information We Collect

2.1 Information you provide directly

• Contact details: name, email address, phone number, mailing address.
• Identity-verification fields: date of birth and the last four digits of your Social Security number (“SSN4”). We use these to match you to an account placed by your creditor, and, if you add a debt yourself, to count that debt (we count a debt you added only after you give these details) and to leave your debt out of the counts we share and out of a creditor’s view when Debt Digest holds a record, sent to us by a law firm or settlement company, that it represents you. We never disclose your date of birth or SSN4 to a creditor, agency, or law firm, and we never display them back to you.
• Account communications and dispute submissions made through the portal.
• Hardship-program self-attestations, if you elect to submit one.
• Statement photo: From November 18, 2026 at the earliest, if you choose to read a statement from a photo, the photo is sent to Anthropic to read the details on it, and Debt Digest does not keep the photo.
• Debts you add yourself: the company name, the amount you enter, whether you are behind, and other details you choose to add (such as the last 4 digits of the account number, the type and status of the account, and a collector's name and how they contacted you), and, only if you choose to enter them, the interest rate, minimum payment, credit limit and due day from your statement, plus any payment you record on one (the amount and the date). These are your own numbers; we do not check them with the company. If the company you name joins Debt Digest, it can see your initials, the last 4 digits, your estimated balance, how many days behind you say you are, the kind of plan you said you would like, the date you named it, and whether you marked the debt resolved, so a payment you record changes the balance it sees; the amount and date of each payment you record are not shown to it or to anyone else. These details are included in your data export and deleted with your data.
• A date you type: if you choose to record the date you asked a company to show a debt is yours, we store that date with the debt you added. We use it only to show it back to you on that debt. We do not use it to work out any deadline and we do not send it to anyone. It is included in your export. Removing it stops it showing; it is deleted with the rest of your data. A letter you draft is built from details you already gave us and shown to you; we do not keep a copy of its text.
• A firm you choose: if you give a firm permission, we keep the name you typed, which letter you signed, when you signed and the internet address you signed from, the firm and the debts you picked. It is included in your export, except the internet address. When you delete your account, the name you typed, the signature record and that address are deleted; a record that the permission existed, with the firm, the debts and the dates, is kept without them.
• Payment details, which our payment processor collects and tokenizes when payment processing is enabled (see Section 4). The processor does not send raw card data to the creditor.

2.2 Information your creditor provides to us

• Account identifiers (internal account number, creditor name, charge-off date, days past due).
• Outstanding principal balance, accrued interest, fees, and any creditor-configured settlement matrix.
• Compliance flags (e.g., representation by counsel, bankruptcy notice, deceased, SCRA status, cease-communication request).

2.3 Information collected automatically

• IP address (used for rate limiting, security, and audit logging).
• Browser type, device type, operating system, referring URL, and pages visited.
• Session and authentication tokens necessary to keep you signed in.
• The step of the add-a-debt screen you reached and the name of the last field you touched, never what you typed. We use this only to find confusing screens, and it is deleted with your data.

We do not use cookies or pixels for cross-site advertising and do not participate in advertising-identifier exchanges.

3. How We Use Your Information

We use personal information for the following purposes only:

• To verify your identity and match you to the account placed by your creditor.
• To count a debt a person adds themselves, which we do only after they give their date of birth and SSN4.
• When Debt Digest holds a record, sent to us by a law firm or settlement company, that it represents a person who adds their own debt, to leave that person’s debt out of the counts we share and out of a creditor’s view.
• To provide the Service, including settlement offers, payment plans, hardship review, dispute handling, and account communications.
• If you turn on due-date reminders in Settings, to email you three days before a due date you entered on a debt you added yourself, naming that company and the minimum you entered. We keep a record of which debt and which due date each reminder was for, so you never get the same one twice, and it is deleted with your data.
• To generate and deliver legally required notices, including FDCPA §809(a) validation notices on accounts where the §1692e(11) Mini-Miranda is required (see the conditional matrix at /legal).
• When payment processing is enabled, to route consumer payments to the identified creditor through Stripe Connect. Debt Digest is not the payee.
• To enforce code-path compliance guardrails (Reg F dispute pauses, cease-communication enforcement, counsel / NDR firewall, SCRA scrub, bankruptcy scrub).
• To detect, prevent, and respond to fraud, abuse, or security incidents.
• To comply with federal and state regulatory obligations, including audit-log retention and reporting.
• To improve the Service (in aggregate or de-identified form only).

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use personal information to market unrelated products.

4. Third-Party Processors

Debt Digest uses a small set of vetted subprocessors. Each is contractually required to protect personal information, to use it only for the purposes specified, and to maintain safeguards consistent with the GLBA Safeguards Rule. Of the processors listed below, two receive personal information today: application hosting and its edge, and the managed database. The others are contracted or under notice and not enabled and receive nothing, which is why payments are simulated and notices sit in a manually released queue. We will give at least 30 days notice before enabling any processor listed here as not enabled. We also use a source-control and CI provider, which holds source code and configuration and no personal information, and authoritative DNS at Google Cloud DNS, which resolves names only and receives no personal information. Two code paths would route data to an artificial-intelligence model provider; both are disabled in the production configuration. Notice of the intent to enable the first of them, reading a document you choose to upload, is given above and its earliest enablement date is November 18, 2026; before that date both remain disabled. Enabling either requires the same 30 days notice.

If we add a new processor that materially changes how personal information is processed, we update this list and the effective date at the top of the page.

5. When We Share Information

• With your creditor of record, as necessary to service the account, route disputes, and complete settlements. Payment-card details are tokenized by the processor and are not shared with the creditor as raw card data.
• With our subprocessors, as described in Section 4.
• When required by law, including in response to a valid subpoena, court order, or regulatory request.
• In connection with a corporate transaction (merger, acquisition, financing, or sale of substantially all assets), subject to a successor commitment to honor this policy.
• To protect rights, safety, or property of Debt Digest, our users, or the public.
• With a company you name on a debt you add yourself, if that company joins Debt Digest. It sees your initials, the last 4 digits you entered, your estimated balance, how many days behind you say you are, the kind of plan you said you would like, the date you named it, and whether you marked the debt resolved. It does not see your date of birth, your SSN4, or the amount and date of any payment you record. We do not show it your debt if you have filed a deletion request, or when Debt Digest holds a record, sent to us by a law firm or settlement company, that it represents you.
• With a firm you choose to represent you. If you choose a firm to represent you, sharing starts when you sign, and we share with that firm only what the permission you sign lists, which is only these details about you: your name as you typed it, the email you sign in with, and for each debt you pick, the company, the last 4 digits, the balance shown to you and how many days behind it is. They stay up to date while the permission is in force. You can end this at any time from your Wallet; it also ends if the firm declines or you delete your account. Ending it does not take back what the firm already saw. Choosing a firm here does not, by itself, change what any company you owe can see, and we do not tell the companies you owe that you chose a firm.
• With a person you designate, when you create a helper link on your own debt picture. That person sees only the estimates you entered. They do not see connected creditor accounts, identity numbers, or payment methods. The link expires in at most 30 days, and you can revoke it at any time. When they open the link we record their IP address for security and audit.
• With an AI assistant you connect yourself ("Connect your AI"), when you create a read-only connection from your Wallet. That connection can read only your first name, your own debt picture, the public Your Rights page, and public company pages. It cannot add, change, send, or delete anything, and Debt Digest does not send anything to any creditor or collector through it. The provider of the AI you connect handles what you show it under that provider's own terms and privacy practices, not ours. Each connection expires within 90 days, and you can turn it off at any time from your Wallet.

We do not share consumer personal information with third parties for their own marketing purposes.

6. Data Security

Debt Digest applies administrative, technical, and physical safeguards consistent with the GLBA Safeguards Rule (16 CFR Part 314) and applicable state data-security laws. These include, at a minimum:

• Encryption of data in transit (TLS 1.2 or higher) and at rest at the database layer.
• Password hashing using a memory-hard key-derivation function (scrypt).
• Role-based access controls and tenant-scoped query enforcement.
• Server-enforced rate limiting and progressive lockout on authentication endpoints.
• Append-only audit logging of administrative access and material consumer events, retained for a minimum of thirty-six (36) months post-termination of the governing agreement.
• Annual access review and incident-response procedure.

Suspected security issues should be reported to security@debt-digest.com. See our published security posture for further detail.

7. Data Retention

Personal information is retained as long as necessary to fulfill the purposes described in this policy, comply with our legal obligations (including federal and state record-retention requirements applicable to debt servicing and collection), resolve disputes, and enforce agreements. Specific retention windows are documented per record class in our internal data-governance policy and in the DPA.

Audit-log entries supporting FDCPA, Reg F, and TCPA compliance are retained for a minimum of thirty-six (36) months post-termination of the governing agreement. Account-level financial records are retained for the term required by the creditor of record and applicable record-retention statutes, whichever is longer.

Identity-verification fields you provide yourself (date of birth and SSN4) are retained while your account is open and the debts you added remain in the Service, and are deleted with your account on request under Section 8.1, except where a specific legal-hold or audit-record obligation applies.

8. Your Rights

8.1 Under the California Consumer Privacy Act (CCPA / CPRA)

If you are a California resident, you have the following rights with respect to personal information Debt Digest holds about you:

• Right to know. Request the categories and specific pieces of personal information collected, sources, purposes, and the categories of third parties with whom it has been shared.
• Right to delete. Request deletion of personal information, subject to exceptions for information that is necessary to complete a transaction, comply with a legal obligation, or maintain integrity of audit and security records.
• Right to correct. Request correction of inaccurate personal information.
• Right to opt out of sale or share. Debt Digest does not sell or share personal information; this right is honored by default.
• Right to limit use of sensitive personal information. Honored by default. Sensitive personal information (including SSN4 and account financial detail) is used only to perform the services you have asked us for, to verify identity, and to prevent fraud and security incidents, which are the purposes permitted under Cal. Civ. Code §1798.121(a). Giving these details on a debt you added yourself is a step you choose; we do not use sensitive personal information to infer characteristics about you, and we do not sell or share it.
• Right to non-discrimination for exercising any of these rights.

To exercise these rights, email privacy@debt-digest.com. We will verify your identity before processing the request and respond within forty-five (45) days, extendable once for an additional forty-five (45) days as permitted by law.

8.2 Under the Gramm-Leach-Bliley Act (GLBA)

For accounts placed by a financial-institution creditor, the creditor is the controller of nonpublic personal information (NPI). The creditor’s own privacy notice and opt-out mechanisms apply. Debt Digest acts as a covered service provider under the GLBA Safeguards Rule (16 CFR Part 314) and applies the safeguards described in Section 6. NPI is used only as authorized by the creditor and as required to deliver the Service.

8.3 Under the Fair Debt Collection Practices Act (FDCPA)

You may dispute all or part of a debt under FDCPA §1692g; request validation under FDCPA §809; and request that direct communication cease under FDCPA §1692c(c). These rights are described in detail at /legal.

9. Children

The Service is not directed to children under the age of 18 and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact privacy@debt-digest.com and we will delete it.

10. Cross-Border Transfers

The Service is operated in the United States. By using the Service from outside the United States, you understand that your personal information will be processed in the United States, where data-protection laws may differ from those in your jurisdiction.

11. Changes to this Policy

Debt Digest may update this Privacy Policy from time to time. Material changes will be noted at the top of this page with an updated effective date. For substantive changes that affect how we use personal information, we will provide additional notice through the authenticated portal or by email where appropriate.

12. Contact

Email privacy@debt-digest.com for any data-rights request or for general privacy questions. For security reports, use security@debt-digest.com. For all other contact, use privacy@debt-digest.com.