Privacy policy

Who is answerable for your data

The lending business that gives you access is the controller of its customers' data. It decides what is collected, why, and how long it is kept.

Credix acts as a processor: we host and process that data on that business's instructions, and we do not use it for our own purposes.

If you are a customer of a lender and want to exercise your rights, the right route is to contact that lender. If you write to us directly, we will put you in touch with them.

Who this covers

• Platform users: employees of the lending business (administrators, officers and collectors) who sign in to the portal or the mobile app.
• The lender's customers: the people whose loans, payments and contact details are managed in the platform. They do not use Credix directly.

What data we handle

• User account data: name, email address, role, and the business you belong to. Your employer creates it; there is no public sign-up and no self-registration in the mobile app.
• Customer and loan data: names, national ID or RNC, address, phone numbers, loans, instalments, payments and balances. The lending business enters it.
• Location: a single reading, taken at the moment a collector logs a visit, to record where the visit happened. There is no background tracking: the app neither requests nor uses background location permission, and it does not record your route.
• Camera: used only to read the QR code that links your phone to your account. The image is processed on the phone and is never stored or sent anywhere. The app does not take photographs.
• Bluetooth: used only to connect to the thermal receipt printer. We do not derive location from Bluetooth scanning.
• Device identifier: a random identifier the app generates itself, to tell your phone apart when syncing. It is not an advertising identifier and cannot be used to track you outside Credix.
• Biometric data: if you turn on fingerprint or face unlock, Android performs the check. Credix never receives, sees or stores your fingerprint or face.

What we use it for

• Running the service: managing loans, calculating instalments and late fees, recording collections and issuing receipts.
• Working offline: the app keeps your route and your collections on the phone so you can work without a connection, and syncs them when signal returns.
• Tax compliance: issuing electronic tax receipts (e-CF) to the DGII when the business has that feature enabled.
• Security: authenticating users, detecting improper sessions, and keeping an audit record of operations.

What we do not do

• We do not sell personal data, or pass it to third parties for commercial purposes.
• We show no advertising and do not use the data for ad targeting.
• We run no analytics or advertising of our own, and no cross-app tracking library.
• One exception, stated plainly: the QR reader uses Google ML Kit, which sends Google diagnostic data about the library itself: device model, app version, a per-install identifier, performance metrics and errors. It receives no customer, loan or collection data. Detail: https://developers.google.com/ml-kit/android-data-disclosure
• We do not use one business's customer data for any purpose of our own, and we never combine it across businesses.

Who it is shared with

Only where it is essential to run the service, and only what is needed:

• DGII: the tax receipt's data, when the business issues electronic invoicing. This is that business's legal obligation.
• Infrastructure providers: hosting, storage and email delivery, under contract and with no permission to use the data for their own purposes.
• Payment processor: handles the subscription the lending business pays for Credix. It receives none of that business's customer data.
• Google: diagnostic data from the ML Kit library that reads the QR code, as described above.
• Authorities: where a law or court order requires it.

How we protect it

• All traffic between the app and our servers is encrypted in transit (TLS).
• The database the app keeps on your phone is encrypted. Its key is derived from the PIN only you know and is not stored, unless you turn on biometric unlock, in which case it is held in Android's secure store and released only after your fingerprint or face is verified. The PIN remains the fallback.
• Session credentials are held in Android's secure storage, backed by the device Keystore.
• The app's data is excluded from Android backups and from device-to-device transfer, so it does not leave the phone by that route.
• Each lending business has its own separate database. One business cannot reach another's data.

How long we keep it

For as long as the lending business keeps its account active, and afterwards for as long as the law requires of them.

Electronic tax receipts are kept for ten years, under article 16 of General Rule 01-2020 and article 50(h) of the Tax Code.

Data held on your phone is deleted when you uninstall the app, and also when you link the phone to a different account.

Your rights

Under Dominican Law No. 172-13 on the protection of personal data, you may request access to your data, its correction or deletion, and object to certain processing.

If you are a customer of a lending business, address your request to that business, which is the controller. If you are a platform user, write to us and we will handle it directly.

Account and data deletion

User accounts are created and removed by your lending business's administrator; the mobile app cannot create or delete accounts.

To request deletion of your user account and its associated data, write to info@pacificode.do from your work address, or ask your administrator. We will act on the request within 30 days, except for data we are legally required to retain.

To remove the data held on your phone at any time, sign out and uninstall the app.

Children

Credix is a workplace tool intended for adults. It is not directed at children and we do not knowingly collect their data.

Changes to this policy

If we change this policy we will update the date shown above. Where a change is significant, we will say so in the platform before it takes effect.

Contact

Pacificode LLC · info@pacificode.do

Write to that address with any question about this policy or about how your data is handled.