Privacy policy
Last updated September 2026
Information we hold
For debtors: name, contact details including a mailing address, account number, balances, and payment history. Identity is verified using the ZIP code on the account. We do not collect, request, or store Social Security numbers or dates of birth; if a creditor's upload contains either, the column is ignored on import. For creditors: company details, tax identifiers, and the contact information of authorised users.
Where it comes from
Almost all debtor information is supplied by the creditor who placed the account. We also record information you give us directly, such as corrected contact details or the contents of a dispute.
How we protect it
Sensitive identifiers are encrypted at rest using AES-256-GCM and are never displayed back after entry. Access is role-based: creditors see only their own placements, and every read-modifying action is written to an append-only audit log with the acting user and IP address.
Payment data
We never store card numbers or bank credentials. Card details are tokenised in the browser by Stripe; Affirm makes its own underwriting decision. We retain only the amount, the processor's transaction reference, and the last four digits where the processor provides them.
Who we share it with
The creditor who placed the account, our payment processors (Stripe and Affirm), our email provider, and, where legally required, regulators or courts. We do not sell personal information.
How long we keep it
Account and payment records are retained for the period required by applicable state and federal recordkeeping rules, then deleted. Audit logs are retained for the same period so historical actions remain explainable.
Your choices
You can request access to the information we hold about you, ask us to correct it, request that we stop contacting you, or dispute the debt. Use your online account or write to us.
This privacy policy describes how RecoverCollect handles personal information. Have counsel review and adapt it — including state-specific privacy rights such as CCPA/CPRA — for your jurisdiction.