Privacy Policy

CreditKid ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the CreditKid mobile application ("App"), the CreditKid website at creditkid.vercel.app ("Website"), and related services (collectively, the "Service").

By using the Service, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

2.1 Information You Provide

• Account information: Name, email address, and password when you create an account, or profile information from Google or Apple sign-in.
• Identity verification (KYC): Legal first and last name, date of birth, home address, phone number, Social Security Number (last 4 digits or full as required by Stripe), and a government-issued photo ID. This is required to create a Stripe Connected Account and comply with financial regulations.
• Banking information: Bank account routing number, account number, and account holder name when you link a bank account for payouts.
• Event information: Event names, dates, times, locations, guest names, phone numbers, and gift messages when you create events and send invitations.
• Child information: Name and limited information about children when parents link a child to a virtual card through the App.

2.2 Information Collected Automatically

• Device information: Device type, operating system, unique device identifiers, and app version.
• Usage data: Pages visited, features used, timestamps, and interaction patterns within the App and Website.
• Transaction data: Payment amounts, dates, descriptions, and statuses associated with your connected account, as provided by Stripe.

2.3 Information from Third Parties

• Stripe: Account verification status, capability statuses, balance information, and transaction details from your Stripe Connected Account.
• Authentication providers: Basic profile information (name, email) from Google or Apple when you use social sign-in.

We use the information we collect to:

• Create and manage your account
• Provide, maintain, and improve the Service
• Process payments and manage your financial account through Stripe
• Create and manage events, send invitations via SMS, and track RSVPs
• Create virtual cards and manage child spending
• Verify your identity as required by financial regulations (KYC/AML)
• Communicate with you about your account, transactions, and service updates
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

We do not sell your personal information. We share information only in the following cases:

4.1 Service Providers

• Stripe, Inc.: Identity verification data, banking information, and transaction data are shared with Stripe to operate your connected account, process payments, and issue virtual cards. Stripe acts as an independent data controller for this information. See Stripe's Privacy Policy.
• Firebase (Google Cloud): Account data, event data, and authentication information are stored in Firebase (Firestore, Authentication, Storage) hosted on Google Cloud. See Firebase Privacy Information.
• Twilio: Guest phone numbers are shared with Twilio to send SMS event invitations and reminders. See Twilio's Privacy Policy.

4.2 Legal Requirements

We may disclose your information if required by law, regulation, legal process, or government request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

4.3 Business Transfers

If CreditKid is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

We retain your personal information for as long as your account is active or as needed to provide the Service. We may also retain information as required by law, to resolve disputes, enforce agreements, and for legitimate business purposes.

Identity verification documents submitted to Stripe are retained by Stripe in accordance with their retention policies and regulatory requirements. CreditKid does not store copies of your government-issued ID.

When you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it by law.

We implement appropriate technical and organizational measures to protect your information, including:

• All data transmitted between the App/Website and our servers is encrypted using TLS/HTTPS
• Sensitive financial data (card numbers, CVVs, SSNs) is handled exclusively by Stripe and never stored on our servers
• Authentication tokens are securely stored on your device using platform-native secure storage (e.g. Keychain on iOS)
• Backend API routes require authenticated Firebase tokens for access
• Stripe API secret keys are stored as environment variables and never exposed to the client

While we take reasonable precautions, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security of your data.

CreditKid allows parents and guardians to create virtual cards for their children. We do not knowingly collect personal information directly from children under 13 without parental consent.

Child accounts are created and managed exclusively by the parent or guardian. The only child information we store is what the parent provides (name and association to a card/event). Children do not create their own accounts or provide personal information directly to CreditKid.

If you believe we have inadvertently collected information from a child under 13 without appropriate consent, please contact us immediately and we will delete the information.

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request that we correct inaccurate or incomplete information
• Deletion: Request that we delete your personal information, subject to legal retention requirements
• Portability: Request your data in a structured, machine-readable format
• Opt-out: Opt out of non-essential communications

To exercise any of these rights, contact us at support@creditkid.com. We will respond to your request within 30 days.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• The right to know what personal information we collect, use, and disclose
• The right to request deletion of your personal information
• The right to opt out of the sale of your personal information — we do not sell personal information
• The right to non-discrimination for exercising your privacy rights

The Website may use essential cookies for authentication and session management. We do not use third-party advertising cookies or tracking pixels. The App does not use cookies but may collect usage analytics to improve the Service.

The Service may contain links to third-party websites (e.g. Stripe Dashboard, Apple Pay). We are not responsible for the privacy practices of these external sites. We encourage you to read their privacy policies before providing personal information.

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date and, where appropriate, by sending a notification through the App or email. Your continued use of the Service after changes are posted constitutes acceptance of the updated Privacy Policy.

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

CreditKid
Email: support@creditkid.com
Website: creditkid.vercel.app