Data and suppliers

What we keep, and for how long

What	Kept by Creditcrest
Bank statements and transactions	Never. Read while the request is open, then gone
Applications, loans, documents, identity results	Never. Kept in the lender’s own database
Counts of what a lender used, for invoicing	Seven years, as tax records. They name the lender, never a borrower
Request logs: time, address, status	No more than 30 days. Never a request’s body
Sandbox entries	Cleared at least once a day. Invented details only

No borrower’s data is used to train or tune anything. Nothing is sold.

Where it is processed

Cloudflare is a global network: a request is usually handled in Australia but may be handled elsewhere. A lender must say so in its own privacy policy (APP 8), and we give it the wording.

Suppliers

Each is used only for its job, and only once the lender has switched that service on. We tell lenders 30 days before adding one.

Supplier	What for	Where	When
Cloudflare, Inc.	Hosting, network, storage, cookieless visit counts	Global; United States company	Always
Didit	ID document, selfie and liveness checks	Spanish company	When identity checks are on
Resend	Email codes and notices	United States	When email is on
Twilio	Text-message codes	United States	When SMS is on
A bank-data provider accredited under the Consumer Data Right	Bank transactions, with the applicant’s consent	Australia	When bank connection is on; named in the order form
Zepto	Paying out loans, checking the account name, and collecting repayments by PayTo	Australia	When payments are on

Credit reporting bodies are not our suppliers: a lender contracts with them itself, and we run the enquiries and reports on its behalf.

A breach

We tell an affected lender within 24 hours of becoming aware of a breach that touches its data, with what it needs for its own assessment and any notice to the OAIC.