Privacy Policy

We collect the following categories of personal information. Except where noted, we collect this information directly from you or generate it in the course of providing the Service.

• Identity information. Name, residential address, date of birth, phone number, and Social Security number, collected during enrollment. This information is required to verify your identity and to locate and retrieve your credit report securely, and is used for no other purpose except as described in this policy. Your full Social Security number is used transiently to retrieve your report and is not stored by the consumer Service — after retrieval we retain only its last four digits, for account identification.
• Contact and account information. Email address, authentication credentials, communication preferences, and records of your consents, including the time and version of the authorizations you provide.
• Credit report information. Your consumer report and credit score obtained from consumer reporting sources with your authorization through soft inquiries, including tradelines (accounts, balances, limits, and statuses), payment history, inquiries, and public-record items, together with derived analyses such as utilization calculations and score-factor explanations.
• Information you provide in the app. Credit goals you select, financial context you choose to share, questions and messages you submit to the AI advisor, and support requests.
• Usage and device information, collected automatically: IP address, browser type and version, device and operating system information, pages viewed, features used, timestamps, and interaction events, along with cookies and similar technologies described in Section 5.

We do not knowingly collect information about anyone other than the account holder, and the Service may not be used to retrieve another person's credit data.

We use personal information for the following purposes:

• To verify your identity and retrieve your credit report with your authorization;
• To operate the Service: analyzing your report, generating alerts and insights, producing AI-assisted guidance, and building and updating your action plan;
• To check your credit profile against the baseline requirements of debt consolidation options and, where your profile fits, present matching options available through our partners;
• To communicate with you about your account, alerts, security events, and changes to the Service or our terms;
• To maintain safety and security: authenticating sessions, preventing fraud and unauthorized access, enforcing our Terms of Service, and debugging and fixing errors;
• To improve the Service, using aggregated or de-identified information wherever practicable; and
• To comply with legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims.

We do not use your credit report information for advertising, and we do not use your personal information for automated decisions that produce legal or similarly significant effects about you. Bivo does not make credit decisions.

Your credit report is retrieved only with your written authorization under the Fair Credit Reporting Act, using soft inquiries that do not affect your credit score. Your authorization remains in effect while your account is active so the Service can retrieve updates to your report where an update feature is offered to you; it is revoked when you close your account. We use credit data solely to provide the Service as described in this policy. We do not sell credit data, we do not share it with third parties for their own marketing purposes, and we do not permit our service providers to use it for any purpose other than providing services to us. Your credit report itself is compiled and maintained by consumer reporting agencies; disputes about its contents must be raised with the relevant agency or the furnishing creditor.

We share personal information only in the following circumstances, and we do not sell personal information in any circumstance:

• Service providers. We share information with vendors that perform services on our behalf — including consumer reporting and identity verification providers, cloud hosting and database providers, email and messaging delivery providers, AI processing providers, and security and analytics providers — in each case under contracts that limit their use of your information to providing services to us and require appropriate safeguards.
• Partners, at your direction.If you choose to explore debt consolidation options through a partner — each a separate service — we share information with that partner only as needed to facilitate that choice and only with your consent. The partner's own privacy policy governs the information you provide to it.
• Corporate group. We may share information within Aurora Technologies Group for administration, security, and compliance purposes consistent with this policy.
• Legal and safety. We may disclose information to comply with applicable law, regulation, legal process, or governmental request; to enforce our terms; to detect and prevent fraud or security issues; or to protect the rights, property, and safety of our users, the public, or our business.
• Corporate transactions. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to this policy and applicable law.

We do not share personal information with third parties for cross-context behavioral advertising, and we do not permit third-party advertising networks to collect information through the Service.

We use cookies and similar technologies that are necessary to operate the Service — such as maintaining your authenticated session, remembering preferences, and protecting against fraud. We do not use third-party advertising cookies, and we do not currently run any analytics scripts. If we introduce analytics in the future, it will be first-party only, used solely to understand how the Service is used and to improve it, and it will respect the choice you make below.

You can set your analytics preference at any time in our cookie preferences. Most browsers also allow you to control cookies through settings; disabling strictly necessary cookies may prevent the Service from functioning. Because there is no consistent industry standard, the Service does not currently respond to browser “Do Not Track” signals.

We protect personal information with administrative, technical, and physical safeguards appropriate to its sensitivity. All data exchanged between your device and the Service is encrypted in transit using TLS, and stored data is protected with 256-bit encryption at rest. Sensitive identity fields used for verification receive additional protection within our infrastructure, and authentication credentials are stored only in hashed form — we never store your password in plain text.

Access to production systems and user data is restricted to the small set of personnel who require it to operate the Service, enforced through role-based permissions and recorded in audit logs. Row-level security controls in our database isolate each account's data. No credit report is retrieved until the identity details you submit — verified against consumer reporting sources — successfully match your credit file, so no one else can pull your report through the Service. Accounts are further protected by verified sign-in, session controls, and rate limiting that defend against automated attacks.

No method of transmission or storage is completely secure; we cannot guarantee absolute security, and you are responsible for maintaining the confidentiality of your own credentials. If you believe you have found a security vulnerability in the Service, or you suspect unauthorized activity on your account, report it through the support options available in your account settings — we review every report and appreciate responsible disclosure.

We retain personal information for as long as your account is active and as needed to provide the Service. You may close your account at any time from your account settings (“Delete account”). Closing your account permanently deletes your credit reports, scores, account history, plan, and advisor conversations from our production systems and revokes your credit report authorization.

Following account closure we delete or de-identify your remaining personal information within a reasonable period, except where retention is required or permitted by law — including to comply with legal, tax, accounting, or regulatory obligations; to maintain records of consents and authorizations; to resolve disputes; to enforce our agreements; and for security and fraud prevention. Where deletion is not immediately possible (for example, data held in secure backups), we isolate the data from further processing until deletion is possible. De-identified and aggregated information, which cannot reasonably be used to identify you, may be retained and used without restriction.

Depending on your state of residence, you may have some or all of the following rights with respect to your personal information:

• Access / to know — to confirm whether we process your personal information and to obtain a copy of it, including the categories collected, the purposes, and the categories of recipients;
• Correction — to correct inaccurate personal information (note that corrections to the contents of your credit report must be made through the consumer reporting agency or furnishing creditor);
• Deletion — to request deletion of your personal information, subject to the retention exceptions described in Section 7. You can exercise this directly at any time by closing your account from your account settings;
• Portability — to obtain a copy of personal information you provided in a portable format;
• Non-discrimination — not to receive discriminatory treatment for exercising your rights.

Because we do not sell personal information or share it for cross-context behavioral advertising, there is no need to opt out of sale or sharing. You may also, at any time: withdraw your credit report authorization by closing your account; adjust communication preferences in your account settings; and decline to explore partner options — pairing never shares information with a partner without your direction.

To exercise any of these rights, submit a request through the support options available in your Bivo account settings. We will verify your identity before acting on a request, and you may use an authorized agent where applicable law permits. If we decline a request, we will explain why, and you may appeal through the same channel where applicable law provides an appeal right.

The Service is intended for individuals 18 years of age and older, and we do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete it promptly.

The Service is offered only to residents of the United States, and the information we collect is stored and processed in the United States. If you access the Service from outside the United States, you do so at your own initiative and are responsible for compliance with local laws; your information will be processed in the United States.

The Service may link to websites and services we do not operate, including partner services. This policy does not apply to those third parties, and we are not responsible for their content or privacy practices. We encourage you to review the privacy policy of every service you use.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. If we make material changes, we will notify you by updating the date at the top of this page and, where appropriate, by additional notice in the app or by email before the changes take effect. Your continued use of the Service after changes take effect constitutes acknowledgment of the updated policy.

If you have questions or concerns about this Privacy Policy or our data practices, or wish to exercise your privacy rights, contact us through the support options available in your Bivo account settings.