Your report is case evidence, not a product.

What is retained

Your mailing profile, report filenames and processing status, provider connection reference, consent version and timestamp, automatic-pull status, normalized possible findings, the provider path used, approved letters, the final private PDF packet, attestations, and mailing-tracker dates, minimized reply summaries, recommendations, follow-up drafts, minimized progress snapshots, and any credit scores, score models, sources, dates, and notes that you enter remain until you delete them or delete the case. Self-entered scores are kept for timeline comparison; they are not treated as bureau-issued scores or approval guarantees. Supporting proof is intentionally retained in private case storage so it can be assembled into a later packet; each proof file can be downloaded or deleted from the proof vault. Raw initial reports remain only until packet creation or case deletion. Raw reply files and updated comparison reports are not retained. Do not upload passwords, tax returns, or unrelated documents.

Redact first: last four only

Manual upload and letter generation do not need a full Social Security number. Before upload, permanently cover the first five SSN digits, the full date of birth, passwords and login codes, and all but the last four account digits. Leave the facts needed for matching - sender, consumer name and mailing address, dates, balances, status, remarks, dispute results, and reason codes - visible. If you fail to redact a document, its visible content may be processed by the configured AI provider even though the system is instructed not to return or retain the unnecessary identifier.

Automatic report connection

If you choose automatic reports, a licensed credit-data provider may require your full legal identity, date of birth, address, and Social Security number to match your bureau files. Enter those details only in the provider-hosted verification screen. CRAD is designed to keep an opaque provider connection ID and the minimum consent and report facts needed for your case—not the provider's identity answers or a reusable bureau password. The provider's privacy policy, retention, security, fees, and cancellation terms also apply and must be shown before enrollment.

Upload and application defenses

The site accepts only bounded PDF, PNG, and JPEG uploads, verifies file signatures, rejects encrypted PDFs and PDFs containing common active, launch, script, embedded-file, or rich-media markers, keeps storage private, checks the signed-in owner on every case operation, requires same-origin writes, and never sends provider credentials to the browser. These safeguards reduce risk; no website can honestly promise that malicious activity is impossible. Do not upload a file you did not expect, and independently verify suspicious sender names, links, phone numbers, QR codes, or payment demands.

Important provider facts

AI providers process content under their API terms and project data controls. This app sends OpenAI Responses requests with storage disabled, deletes temporary Gemini Files after use on a best-effort basis, and never exposes provider credentials to the browser. Provider abuse-monitoring or legally required retention may still apply. An automatic credit-data provider separately processes identity and bureau information under its agreement and disclosures. This is not a promise of zero third-party processing.

Optional print-and-mail fulfillment

Paid mailing is separate from report analysis. When activated, CRAD will send only the approved recipient address, return address, reviewed mailing PDF, and the minimum order metadata to the mailing provider, currently Click2Mail. Card details will be collected by the payment processor, not stored in CRAD's case database. CRAD keeps the fulfillment status, provider job reference, tracking result, team assignment, and action history with the case. Team alert emails, when enabled, contain an order ID, status, and link to the private mail desk—not credit-report contents. No payment or mailing occurs from the current readiness screen; production checkout remains disabled until provider credentials, webhooks, and a test mailing are verified.

Your control

You review every flagged item, write the factual explanation, and attest that the statements are truthful before a packet is created. Deleting a case removes its structured workspace data and any remaining raw upload, saved proof, and generated packet objects. Deleting one proof file removes that private object and its saved match. Printed or downloaded copies remain under your control.

Not legal advice

This tool organizes information and drafts correspondence; it is not a law firm, does not guarantee a score increase or deletion, and does not submit a statement in your name. Commercial or public operation should receive jurisdiction-specific privacy, consumer-law, and credit-repair-organization review.