No bank logins. No card numbers.
We never ask for either to open or maintain a wallet.
Anyone can open a wallet with an email link. A new email creates an account; an existing email signs in. This notice covers that wallet and earlier pilot contact-form submissions. /dashboard/
What we collect
Earlier pilot-form submissions include an email address, country, approximate number of cards, primary tracking problem, consent, referral source, submission time, and—if the demo was used—the selected example card. The public site now directs people to the wallet instead of that form.
For private accounts, we store your email address, account identifiers, sign-in security records, selected catalog cards, and the dates, notes and manual benefit usage you enter, plus your in-app reminder and email preferences and which updates or reminders you dismiss or snooze. For notification emails you opt into, we store delivery attempts, a fixed message copy for safe retries and the provider’s acceptance identifier with the private notice. Timezone and province are your choices, not inferred from your IP address. We do not connect to banks or import transactions. Do not enter card or account numbers, passwords, purchase transactions or claim details in notes; input checks cannot detect every sensitive detail.
For abuse prevention, Cloudflare may process network information such as your IP address. The form converts the address into a one-way rate-limit token; the raw address is not stored in the pilot database. Rate-limit records expire after approximately 24 hours.
How we use it
- Respond to earlier pilot-form submissions and product questions.
- Maintain the card catalog and wallet.
- Protect the form and private accounts from automated or repeated requests.
- Send requested sign-in links and maintain your private wallet. Separately, send reviewed-change and reminder emails only after you enable that preference. Creating a wallet does not subscribe you to marketing or notification emails.
We do not sell pilot or wallet information. We do not use it to make lending or eligibility decisions.
Where it is processed
The website, pilot database and account database are hosted by Cloudflare. Information may be processed in jurisdictions where Cloudflare operates. Cloudflare Email Service sends requested sign-in links, notification emails you opt into and a confirmation when you buy email alerts. It processes the recipient address and message, including the one-use sign-in link or notification details. Messages are sent as CreditCardKit from hello@creditcardkit.com. Provider acceptance is not proof of inbox delivery. If you buy email alerts, Stripe processes your payment on its own hosted pages. We store only your Stripe customer and subscription identifiers, status, billing currency and renewal date, never card numbers.
Retention and your choices
Pilot submissions are retained for up to 24 months unless they are needed for an active tester relationship or must be retained for legal reasons. You may ask to access or delete your submission, or withdraw from updates, by emailing hello@creditcardkit.com.
Email notifications are off by default and do not backfill earlier notices. You can turn them off in wallet settings or use the confirmation link in any notification email without signing in; simply opening the link does not unsubscribe. An email already in flight may still arrive. In-app notices remain available. Private wallet settings include a JSON export and account deletion. Deletion removes active account and wallet records, revokes sessions and removes unused sign-in links. It does not close a bank account or delete a separate pilot contact request. Provider recovery copies may remain under the provider’s retention rules.
Sign-in links expire after five minutes and sessions normally expire after seven days. Expiration prevents further use. Expired links and sessions are removed on the next successful daily cleanup; authentication rate-limit records are removed after at least 24 hours without a request, also on the next successful run. Cleanup runs on the configured daily schedule; service failures may delay removal, but do not extend link or session validity. Request IP addresses are used in rate-limit records but are not stored in wallet data or session profiles.
Changes
This notice will be updated as the product and its data practices develop. Material changes will be reflected on this page before they take effect.