Last updated: September 7, 2026
This policy explains how The Malloy Group Financial LLC d/b/a CredX handles information in its website, software workspaces, education and optional support services. It describes our practices, not a certification of compliance with every privacy law. Your rights depend on the laws that apply to you and to the information involved.
Report sources and account flow. Customers sign up, review and sign the applicable agreement, complete intake, then upload a credit report or use the provided third-party report-provider links. CredX provides credit-profile tracking, report-analysis and credit-building tools. A provider enrollment or saved provider details do not by themselves enable automatic report imports, continuous credit monitoring or alerts inside CredX. Third-party monitoring subscriptions have separate fees, terms and cancellation requirements.
Information comes from you, your authorized organization or professional, your use of the platform, and providers you authorize or use for payments and other connected services. We do not represent that we obtain live bureau information without an authorized source. Do not send passwords, full payment-card details or unnecessary sensitive records by ordinary email or chat. Where a legacy monitoring-access workflow is used, its scope must be separately authorized; uploading a report does not require sharing your monitoring password.
We use information to authenticate accounts, provide authorized workspaces and reports, assess readiness, organize goals and progress, deliver education, answer support questions, provide requested analysis/consultation and agreed support, administer billing, prevent abuse, investigate errors and meet applicable recordkeeping requirements. Documents or communications to a bureau, creditor or agency require the relevant authority and must be truthful; merely using the platform does not authorize every possible submission.
Messages and relevant context may be sent to AI providers to generate responses. Credit-report extraction can send report text to an AI provider. AI may generate summaries, suggestions and structured information; outputs require review and are not lending decisions. Avoid entering information that is not needed for the task. Provider processing and retention depend on the provider and applicable arrangement; we do not promise zero retention or that a provider never uses data for training without verified contractual support.
We use vendors for hosting and databases (including Railway), document storage (including Vercel Blob), AI processing, email, payments, security and operational support. Configured services may include Vercel AI Gateway/Anthropic, Resend/SendGrid/SMTP and Stripe/PayPal; the provider used depends on the feature and configuration. An organization owner or authorized professional can access information within their permitted workspace. Consider that access before joining a professional workspace.
We may disclose information to authorized bureaus, creditors or agencies for requested support, to professional advisers, when required by law, to protect rights and security, or in connection with a business transfer subject to applicable protections. Third-party products linked from CredX have their own privacy terms. We do not sell personal information or share it for cross-context behavioral advertising.
CredX uses HTTPS, password hashing, access controls and encryption for designated sensitive fields, along with private document-storage and time-limited access mechanisms where implemented. These safeguards do not mean all data is encrypted in every context or that no incident can occur. Payment processors handle payment credentials for supported checkout flows; CredX retains transaction and billing records. Do not enter payment-card details into uploads or general messages. No certification, audit standard or written security-program status is claimed by this policy.
Service and compliance records are generally retained during active service and for up to seven years afterward under our recordkeeping policy, or longer where a specific legal obligation, dispute or legal hold requires it. This is not a claim that federal law universally requires seven years for every record. Signed CROA disclosure acknowledgments have their own statutory retention requirements. Operational logs, backups and vendor records may have different retention cycles.
You may request deletion or copies by contacting us. We assess the request against applicable obligations, explain relevant limitations and retain only information needed for permitted purposes. Cancellation does not automatically delete your account; backup copies may persist through their retention cycle. We do not promise an automated deletion/export feature that is not available.
Depending on applicable law, you may have rights to access, obtain a copy, correct or delete information, limit certain sensitive-information processing, opt out of sale/sharing or certain profiling, and appeal a denied request. We do not discriminate for exercising applicable privacy rights. Email contact@credxme.com with "Privacy Request." We may verify identity or an agent's authority without requesting unnecessary sensitive information. We respond within applicable deadlines, generally within 45 days for covered state-law requests, and notify you of a permitted extension. Contact the same address to request an appeal where available.
Browser storage supports authentication, preferences and security. Configured analytics and error-monitoring tools may collect feature events, technical information and diagnostic data; safeguards are intended to exclude unnecessary sensitive information. We do not claim that every analytics provider is enabled. Blocking storage can affect login or platform functions. Linked third-party sites control their own cookies and data collection.
CredX is intended for adults 18 and older in the United States, not children. If you believe a child supplied personal information, contact us so we can investigate. Providers may process information in locations where they operate, subject to applicable arrangements and law.
We post revisions here with an updated date and provide notice or obtain consent for material changes where required. This policy does not itself authorize uses that require separate consent.
The Malloy Group Financial LLC d/b/a CredX
1392 Madison Avenue, New York, NY 10029
Email: contact@credxme.com
Phone: 866-CREDX-ME