Privacy Policy
Effective Date: October 5, 2026 | 123 CR Services LLC | 8 The Green, Ste A, Dover, DE 19901
Overview
This Privacy Policy ("Policy") describes the information collection, use, processing, disclosure, and protection practices of 123 CR Services LLC ("Company," "we," "us," "our") in connection with the website located at 123creditboost.com ("Site") and all associated services, tools, and software features (collectively, "Services"). This Policy is incorporated by reference into the Company's Terms and Conditions and constitutes a binding legal agreement between you and the Company. By accessing the Site or using the Services, you acknowledge that you have read and understood this Policy and that you consent to the collection, use, and processing of your personal information as described herein. If you do not agree, you must discontinue use of the Services immediately.
1. SCOPE, APPLICABILITY, AND LEGAL FRAMEWORK
This Policy applies to all personal information collected by or on behalf of the Company in connection with the Services, including information submitted by users, information collected automatically through the Site, and information obtained from third-party sources. This Policy governs personal information of all users regardless of geographic location, subject to the jurisdiction-specific provisions set forth herein, including provisions applicable to residents of California (CCPA/CPRA), the European Economic Area (GDPR), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and other jurisdictions with applicable comprehensive privacy legislation.
This Policy does not govern the data practices of third-party websites, services, or applications that may be linked from the Site or that interact with the Services. The Company is not responsible for the privacy practices of any third party.
2. CATEGORIES OF PERSONAL INFORMATION COLLECTED
The Company collects personal information in the following categories, as defined under the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. ("CCPA") and its implementing regulations:
COPPA: The Services are not directed to individuals under eighteen (18) years of age. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us immediately for deletion.
3. SOURCES OF PERSONAL INFORMATION
The Company collects personal information from the following sources:
- Directly from you: Information you voluntarily provide when creating an account, completing the dispute letter form, submitting your email address, drawing or uploading a signature, contacting customer support, or otherwise interacting with the Services.
- Automatically from your device: Log files, cookies, pixel tags, web beacons, and similar tracking technologies that record technical information when you visit the Site.
- From third-party service providers: Payment confirmation and billing data from Stripe, Inc.; fraud signals from Google reCAPTCHA; analytics data from Google Analytics 4; and network data from Cloudflare, Inc.
- Derived or inferred: Inferences drawn from your activity on the Site to create profiles about your preferences and behavior.
4. PURPOSES FOR WHICH PERSONAL INFORMATION IS PROCESSED — LEGAL BASES
The Company processes personal information for the following business and commercial purposes. Where applicable under the GDPR (Regulation (EU) 2016/679) or equivalent legislation, the applicable legal basis is identified in brackets:
- Account creation, authentication, and management [Performance of Contract; Legitimate Interests]
- Generation, review, and delivery of AI-powered dispute letters [Performance of Contract]
- Physical mailing of approved dispute letters via USPS Certified Mail through Lob, Inc. [Performance of Contract]
- Payment processing, billing, and subscription management through Stripe, Inc. [Performance of Contract; Legal Obligation]
- Fraud detection, identity verification, and platform security [Legitimate Interests; Legal Obligation]
- Customer support, dispute resolution, and communications [Legitimate Interests; Performance of Contract]
- Legal compliance, including tax reporting, audit, and regulatory requirements [Legal Obligation]
- Site analytics, performance optimization, and user experience improvement [Legitimate Interests]
- Training and improvement of proprietary AI and machine learning systems using anonymized and aggregated data [Legitimate Interests; Consent]
- Marketing communications (with your consent, where required) [Consent; Legitimate Interests]
- Enforcement of legal rights and contractual obligations [Legitimate Interests; Legal Obligation]
5. AI AND MACHINE LEARNING — DATA PROCESSING DISCLOSURE
Artificial Intelligence Training Consent and Disclosure
The Company utilizes proprietary AI systems and integrates with third-party AI inference providers including Google LLC (Gemini API), OpenAI, LP, and Anthropic PBC to generate and review dispute letters. By using the Services, you acknowledge and agree that your inputs — including your dispute narrative, account details, name, address, and other submitted information — may be processed by these third-party AI providers subject to their respective data use and privacy policies.
In addition, by submitting any data through the Platform, you grant the Company a perpetual, irrevocable, worldwide, royalty-free license to use, store, process, anonymize, aggregate, and incorporate such data into the Company's proprietary AI training datasets, fine-tuning pipelines, evaluation systems, and model improvement workflows. Data used for AI training purposes is anonymized and aggregated to the extent technically practicable prior to such use.
Important Limitation: Once data has been incorporated into anonymized training datasets or model weights, it may not be technically possible to identify or remove such data upon a deletion request. The Company will make commercially reasonable efforts to honor deletion requests but cannot guarantee removal of data that has been anonymized and incorporated into AI models.
6. DISCLOSURE OF PERSONAL INFORMATION — THIRD-PARTY RECIPIENTS
The Company may disclose personal information to the following categories of third-party recipients for the stated business purposes. The Company does not sell personal information for monetary consideration within the meaning of Cal. Civ. Code § 1798.140(t)(1), except as noted below:
CCPA "Sharing" Notice: The Company shares certain identifiers and internet activity data with advertising and analytics providers (including Google Analytics 4) for cross-context behavioral advertising and analytics purposes. This may constitute "sharing" of personal information under the CPRA. California residents may opt out of such sharing as described in Section 10 below.
7. COOKIES, TRACKING TECHNOLOGIES, AND DO NOT TRACK
The Company uses the following categories of cookies and similar tracking technologies on the Site:
Strictly Necessary Cookies
Required for the Site to function, including session management, authentication tokens, CSRF protection, and reCAPTCHA verification. Cannot be disabled without impairing Site functionality.
Functional Cookies
Remember user preferences, language settings, and previously entered form data to improve usability.
Analytics Cookies (Google Analytics 4)
Collect anonymized data about user interactions, page views, session duration, traffic sources, and conversion events to help the Company understand Site performance. Data is processed by Google LLC subject to Google's Privacy Policy.
Session Storage
Used to store lead email addresses and session tokens locally in your browser to maintain state across pages within a single session. Session storage is cleared automatically when the browser tab is closed.
You may control cookie preferences through your browser settings. Note that disabling certain cookies may impair the functionality of the Site. Opt-out tools for Google Analytics are available at tools.google.com/dlpage/gaoptout.
Do Not Track: The Company does not currently respond to "Do Not Track" browser signals as no uniform industry standard for such signals has been established. California residents may exercise opt-out rights as described in Section 10.
8. DATA RETENTION SCHEDULES
The Company retains personal information for no longer than is necessary to fulfill the purposes for which it was collected, or as required by applicable law, whichever is longer. Specific retention periods are as follows:
| Data Category | Retention Period | Legal Basis |
|---|---|---|
| Account and identity data | Duration of account + 3 years post-closure | Legal obligation; legitimate interests |
| Dispute letters and submissions | 7 years | FCRA; legal compliance; statute of limitations |
| Payment and billing records | 7 years | Tax law; IRS recordkeeping requirements |
| Electronic signature data | Duration of letter processing + 90 days | Performance of contract |
| Server and access logs | 12 months | Security; fraud prevention |
| Google Analytics data | Up to 26 months (per GA4 default) | Legitimate interests |
| Customer support records | 3 years from last interaction | Legitimate interests; legal defense |
| Anonymized AI training data | Indefinite | Legitimate interests (cannot be re-identified) |
| Lead capture emails (non-account) | 18 months from last activity | Legitimate interests; CAN-SPAM |
9. SECURITY MEASURES AND BREACH NOTIFICATION
The Company implements commercially reasonable administrative, technical, and physical safeguards to protect personal information against unauthorized access, disclosure, alteration, destruction, and other unlawful processing, including: (i) AES-256 encryption for data at rest; (ii) TLS 1.3 encryption for data in transit; (iii) role-based access controls with least-privilege principles; (iv) multi-factor authentication for administrative systems; (v) Cloudflare WAF and DDoS mitigation; and (vi) periodic security assessments and vulnerability scanning.
Security Disclaimer — No Absolute Guarantee
NOTWITHSTANDING THE FOREGOING SECURITY MEASURES, NO METHOD OF ELECTRONIC TRANSMISSION OR STORAGE IS ONE HUNDRED PERCENT (100%) SECURE. THE COMPANY CANNOT AND DOES NOT GUARANTEE THE ABSOLUTE SECURITY OF PERSONAL INFORMATION AGAINST UNAUTHORIZED ACCESS, CYBER ATTACKS, DATA BREACHES, HACKING, MALWARE, OR OTHER SECURITY INCIDENTS. YOU ACKNOWLEDGE THAT YOU PROVIDE PERSONAL INFORMATION AT YOUR OWN RISK.
In the event of a data breach that triggers notification obligations under applicable state or federal law, the Company will notify affected individuals and relevant authorities in the manner and within the timeframes required by such law, including but not limited to applicable state data breach notification statutes.
10. YOUR PRIVACY RIGHTS — JURISDICTION-SPECIFIC PROVISIONS
CALIFORNIA RESIDENTS — CCPA / CPRA RIGHTS (Cal. Civ. Code § 1798.100 et seq.)
California residents have the following rights with respect to their personal information:
- Right to Know (§ 1798.110): Request disclosure of the categories and specific pieces of personal information collected, sources, business purposes, and categories of third parties with whom data is shared.
- Right to Delete (§ 1798.105): Request deletion of personal information, subject to certain exceptions (including data necessary to complete transactions, comply with legal obligations, or used in anonymized AI training datasets).
- Right to Correct (§ 1798.106): Request correction of inaccurate personal information.
- Right to Opt-Out of Sale/Sharing (§ 1798.120): Opt out of the sale or sharing of personal information for cross-context behavioral advertising purposes. To exercise this right, submit a request via our contact page or email [email protected] with subject line "CCPA Opt-Out Request."
- Right to Limit Use of Sensitive Personal Information (§ 1798.121): Limit the use and disclosure of sensitive personal information to purposes strictly necessary for providing the Services.
- Right to Non-Discrimination (§ 1798.125): You will not be discriminated against for exercising your CCPA rights.
California residents may designate an authorized agent to submit requests on their behalf with written proof of authorization. We will respond to verifiable requests within forty-five (45) days, with one thirty (30)-day extension where necessary.
EEA/UK RESIDENTS — GDPR RIGHTS (Regulation (EU) 2016/679)
Residents of the European Economic Area and United Kingdom have the following rights under the General Data Protection Regulation:
- Right of Access (Art. 15): Obtain confirmation of processing and a copy of personal data.
- Right to Rectification (Art. 16): Have inaccurate personal data corrected without undue delay.
- Right to Erasure (Art. 17): Request deletion ("right to be forgotten") under specified circumstances.
- Right to Restriction (Art. 18): Restrict processing under specified circumstances.
- Right to Data Portability (Art. 20): Receive personal data in a structured, machine-readable format.
- Right to Object (Art. 21): Object to processing based on legitimate interests, including direct marketing.
- Rights Related to Automated Decision-Making (Art. 22): Not be subject to solely automated decisions that produce significant legal effects without human review.
- Right to Lodge a Complaint: File a complaint with your local supervisory authority.
Cross-Border Transfers: Personal data of EEA/UK residents may be transferred to the United States. Such transfers are made pursuant to Standard Contractual Clauses (SCCs) as adopted by the European Commission, or other legally recognized transfer mechanisms.
VIRGINIA (VCDPA), COLORADO (CPA), CONNECTICUT (CTDPA), AND OTHER STATE RESIDENTS
Residents of Virginia (Code § 59.1-571 et seq.), Colorado (C.R.S. § 6-1-1301 et seq.), Connecticut (P.A. 22-15), and other states with comprehensive consumer privacy laws have substantially similar rights to access, correct, delete, and opt out of targeted advertising and profiling. The Company will honor such rights to the extent required by applicable law. To submit a request, contact us at [email protected].
11. EMAIL COMMUNICATIONS — CAN-SPAM AND CASL COMPLIANCE
The Company sends transactional emails (account confirmation, letter generation notifications, billing receipts) and, with your consent, marketing communications regarding new features, promotions, and credit-related educational content. All commercial email communications comply with the Controlling the Assault of Non-Solicited Pornography And Marketing Act of 2003 (CAN-SPAM Act, 15 U.S.C. § 7701 et seq.) and, where applicable, Canada's Anti-Spam Legislation (CASL).
You may unsubscribe from marketing communications at any time by clicking the "Unsubscribe" link included in each marketing email. Transactional emails related to your account and Services cannot be suppressed while your account is active.
12. CHILDREN'S PRIVACY — COPPA COMPLIANCE
The Services are intended exclusively for users who are eighteen (18) years of age or older. The Company does not knowingly solicit, collect, or retain personal information from individuals under the age of 18. If we discover that we have inadvertently collected personal information from a minor, we will promptly delete such information. If you are a parent or legal guardian who believes your child has provided personal information to us, please contact us immediately at [email protected].
13. CHANGES TO THIS PRIVACY POLICY
The Company reserves the right to modify or update this Policy at any time. Material changes will be indicated by an updated effective date and, where required by applicable law, by email notification to registered users or conspicuous notice on the Site prior to the effective date of the change. Your continued use of the Services following any update constitutes acceptance of the revised Policy. We encourage you to review this Policy periodically. If you object to any modification, your sole remedy is to discontinue use of the Services.
DATA CONTROLLER / PRIVACY CONTACT
123 CR Services LLC
8 The Green, Ste A
Dover, DE 19901
United States of America
Email: [email protected]