Private access
Cases, findings, and packets are stored under the authenticated user ID. The API checks ownership on every read and write. Do not share your site session or printed packet.
Plain-language privacy
Your report is case evidence, not a product.
This private workspace is designed to minimize what it keeps and to isolate every case to the signed-in owner.
Raw documents are minimized
Uploaded PDFs and images stay in private object storage while you review the analysis. When you create the complete PDF packet, the relevant source pages are copied into that packet and the separate raw report uploads and normalized extraction are deleted. Return letters are analyzed in memory and the raw reply file is not saved; only its minimized summary and follow-up drafts remain. Updated reports used for progress comparisons are also analyzed in memory and discarded after minimized comparison facts are saved.
Minimized AI processing
OpenAI is tried first. If unavailable, Gemini handles document extraction. Cross-report and reply analysis can fall back to DeepSeek or Gemini. Text-provider fallbacks receive automatically masked extracted text. Full SSNs, dates of birth, passwords, and full account numbers are neither requested nor intentionally retained.
What is retained
Your mailing profile, report filenames and processing status, normalized possible findings, the provider path used, approved letters, the final private PDF packet, attestations, and mailing-tracker dates, minimized reply summaries, recommendations, follow-up drafts, and minimized progress snapshots remain until you delete them or delete the case. Supporting proof is intentionally retained in private case storage so it can be assembled into a later packet; each proof file can be downloaded or deleted from the proof vault. Raw initial reports remain only until packet creation or case deletion. Raw reply files and updated comparison reports are not retained. Do not upload passwords, tax returns, or unrelated documents.
Redact first: last four only
CRAD does not pull a credit report and does not need a full Social Security number. Before upload, permanently cover the first five SSN digits, the full date of birth, passwords and login codes, and all but the last four account digits. Leave the facts needed for matching - sender, consumer name and mailing address, dates, balances, status, remarks, dispute results, and reason codes - visible. If you fail to redact a document, its visible content may be processed by the configured AI provider even though the system is instructed not to return or retain the unnecessary identifier.
Upload and application defenses
The site accepts only bounded PDF, PNG, and JPEG uploads, verifies file signatures, rejects encrypted PDFs and PDFs containing common active, launch, script, embedded-file, or rich-media markers, keeps storage private, checks the signed-in owner on every case operation, requires same-origin writes, and never sends provider credentials to the browser. These safeguards reduce risk; no website can honestly promise that malicious activity is impossible. Do not upload a file you did not expect, and independently verify suspicious sender names, links, phone numbers, QR codes, or payment demands.
Important provider facts
AI providers process content under their API terms and project data controls. This app sends OpenAI Responses requests with storage disabled, deletes temporary Gemini Files after use on a best-effort basis, and never exposes provider credentials to the browser. Provider abuse-monitoring or legally required retention may still apply. This is not a promise of zero third-party processing.
Your control
You review every flagged item, write the factual explanation, and attest that the statements are truthful before a packet is created. Deleting a case removes its structured workspace data and any remaining raw upload, saved proof, and generated packet objects. Deleting one proof file removes that private object and its saved match. Printed or downloaded copies remain under your control.
Not legal advice
This tool organizes information and drafts correspondence; it is not a law firm, does not guarantee a score increase or deletion, and does not submit a statement in your name. Commercial or public operation should receive jurisdiction-specific privacy, consumer-law, and credit-repair-organization review.