Privacy Policy | Credtics

1. Introduction

Lendtech Innovations Ltd ("we," "our," or "us") is committed to protecting the privacy of the people whose information we handle through Credtics, our AI document automation platform, including the Credtics website at credtics.com, the Credtics application at app.credtics.com, our APIs and related services (the "Platform"). This Privacy Policy explains how we collect, use, disclose, and safeguard personal information.

Credtics helps organizations such as insurers, microfinance institutions, banks, SACCOs, lenders, finance teams and law firms process insurance claims, loan files, invoices, receipts, expense claims, contracts and other business documents.

Please read this Privacy Policy carefully. By accessing or using the Platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access the Platform.

2. Our Role

2.1 When We Are the Data Controller

We decide how and why your information is used, and act as data controller, for information about visitors to our website, people who contact us or request a demo, and the customers and authorized users who hold accounts on the Platform.

2.2 When We Process Data for Our Customers

Our customers upload documents to the Platform that may contain personal information about other people, such as policyholders, claimants, beneficiaries, borrowers, guarantors, suppliers, employees and contract counterparties ("Customer Data"). For Customer Data, the customer is the data controller and we act as its data processor, processing the information only on the customer's instructions and under our agreement with that customer.

If your information appears in a document that one of our customers uploaded, for example an insurance claim or a loan application, please direct questions and requests to that organization first. We will assist our customers in responding to your request.

3. Information We Collect

We collect several types of information from and about users of our Platform, including:

3.1 Personal Information

Personal information is data that can be used to identify you individually. The personal information we collect may include:

Contact Information: Email address, phone number, first name, last name, job title, and company name (for entities).
Payment Information: We collect transaction data related to payments made through our Platform, including billing details and limited payment method details. Card, mobile money and bank payments are processed by our payment providers, Stripe and Flutterwave, and we do not store full card numbers.
Account Information: Information you provide when you create an account on our Platform, including your role and permissions.
Communications: Records and copies of your correspondence if you contact us, request a demo or attend a meeting with us.
Profile Information: Information related to your profile on our Platform.

3.2 Customer Data in Documents

Depending on the services a customer uses, documents processed through the Platform may contain:

Insurance claims: names and contact details of policyholders, claimants and beneficiaries, policy and claim numbers, identity documents, medical reports, hospital bills and other health information, police abstracts, vehicle and property details, photographs, and bank or mobile money details for settlement.
Lending and microfinance: names and contact details of borrowers and guarantors, national identification numbers, employment and income information, bank and mobile money statements, credit history, collateral details, and loan and repayment records.
Invoices, receipts and expenses: names, contact details, tax identification numbers and bank details of suppliers and vendors, invoice, purchase order and receipt line items, and employee expense claims.
Legal documents: names, roles, contact details and signatures of the parties to contracts, agreements and other legal documents, and the terms those documents contain.

3.3 Non-Personal Information

We also collect non-personal information that does not directly identify you. This may include:

Usage Data: Information about how you use our Platform, including your browsing actions and patterns, and aggregated information such as document volumes and processing times.
Device Information: Information about your device, including IP address, operating system, browser type, and device identifiers.
Cookies and Similar Technologies: Information collected through cookies, web beacons, and other tracking technologies.

4. How We Collect Your Information

We collect information in the following ways:

4.1 Direct Collection

Information you provide to us directly when you:

Register for an account
Complete forms on our Platform, including demo requests
Subscribe to our services
Make payments for our services
Upload documents or other content to our Platform
Communicate with us

4.2 Customer Uploads and Integrations

Customer Data that our customers and their authorized users upload, forward by email, or send to the Platform through APIs and integrations that they set up.

4.3 Automated Collection

Information collected automatically as you navigate through our Platform using various technologies, including:

Cookies: Small data files stored on your device that help us improve our Platform and your experience.
Web Beacons: Electronic files used to track your navigation of our Platform and your interactions with our communications.
Analytics Tools: We use Google Analytics to collect information about how visitors use our website and Platform.

4.4 Third-Party Sources

We may receive information about you from third parties, including:

Business partners
Payment processors
Identity verification services
Publicly available business sources, such as company websites and professional networks

5. How We Use Your Information

We may use the information we collect for various purposes, including:

5.1 Provide and Maintain our Services

To operate, maintain, and improve our Platform
To process and complete transactions
To provide customer support
To respond to your inquiries and fulfill your requests

5.2 Process Customer Data

To read, classify, extract, check and summarize documents for our customers
To apply each customer's own rules, policies, price lists and approval limits
To generate output such as extracted fields, flags, reports and summaries for the customer's personnel to review
To configure the Platform to a customer's workflow and to provide the support that customer requests

We do not use Customer Data for our own marketing, and we do not use it to make decisions about individuals. Decisions such as paying a claim, approving a loan or paying a supplier are made by our customers.

5.3 Model Training and Improvement

With a customer's consent, we use its Customer Data to train and improve the models and features that power the Platform, for example to recognize that customer's document types more accurately. Where a customer has not given that consent, we use its Customer Data only to provide the Platform to that customer. A customer may withdraw its consent at any time, and the withdrawal applies from that point onward. We do not use information about website visitors or account holders to train models.

5.4 Personalization

To personalize your experience on our Platform
To deliver content and product offerings relevant to your interests

5.5 Communications

To send administrative emails related to your account, service changes, or policy updates
To send promotional communications, such as newsletters and special offers, to which you have opted-in

5.6 Analytics and Improvement

To monitor and analyze usage and trends to improve our Platform
To conduct research and development for new features and functionalities

5.7 Security

To detect, prevent, and address technical issues
To protect the security and integrity of our Platform
To verify user identity and prevent fraud

5.8 Marketing and Advertising

To conduct remarketing and targeted advertising through Google Ads, Facebook Ads, and X (formerly Twitter) Ads
To measure the effectiveness of our marketing campaigns

5.9 Legal Compliance

To comply with applicable laws, regulations, and legal processes
To enforce our Terms of Use and other agreements
To protect our rights, privacy, safety, or property, and/or that of our users or others

6. Special Personal Data

Customer Data may include special personal data under Uganda's Data Protection and Privacy Act, 2019 and similar laws, such as medical records, health information and financial information. We process special personal data only on our customers' instructions and for the purpose of providing the Platform to them. Our customers are responsible for having a lawful basis, including any consent required, to collect this information and share it with us. Access to Customer Data within Credtics is limited to personnel who need it to provide, support or secure the Platform.

7. Disclosure of Your Information

We do not sell personal information. We may disclose personal information in the following circumstances:

7.1 Service Providers

We may share information with third-party service providers who perform services on our behalf, such as:

Cloud hosting and storage providers, such as Google Cloud
Artificial intelligence and document processing providers that help us read and analyze documents, which may include LlamaParse, Anthropic (Claude) and Google (Gemini)
Open-weight artificial intelligence models, such as Meta's Llama, Mistral AI's models, Google's Gemma and OpenAI's gpt-oss, which may be run on our own cloud infrastructure so that documents are not shared with the model's developer
Payment processors (Stripe and Flutterwave)
Data analytics providers (Google Analytics)
Email and communication service providers
Customer relationship and customer service providers
Marketing and advertising partners (Google Ads, Facebook Ads, X Ads)

These service providers are contractually obligated to use your information only as directed by us and in accordance with this Privacy Policy.

7.2 Our Customers

When we process Customer Data, we make the information and the output generated from it available to the customer that provided it and to that customer's authorized users.

7.3 Business Transfers

If we are involved in a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our Platform of any change in ownership or uses of your personal information.

7.4 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).

7.5 Protection of Rights

We may disclose your information to protect and defend our rights, property, or safety, or those of our users or third parties.

8. Data Security

We implement appropriate technical and organizational measures to protect the security of personal information from unauthorized access, use, alteration, or destruction, including encryption of data in transit and at rest, role-based access controls and logging of activity on the Platform. If a security incident affects Customer Data, we will notify the affected customer without undue delay so that it can meet its own obligations. However, no method of transmission over the Internet or electronic storage is 100% secure. Therefore, while we strive to use commercially acceptable means to protect personal information, we cannot guarantee its absolute security.

9. Data Retention

We retain personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. We determine the appropriate retention period based on:

The amount, nature, and sensitivity of the personal information
The potential risk of harm from unauthorized use or disclosure
The purposes for which we process the personal information
Whether we can achieve those purposes through other means
Applicable legal requirements

We retain Customer Data for as long as our agreement with the relevant customer requires. When a customer's subscription ends, the customer may request an export of its Customer Data within thirty (30) days, after which we delete or anonymize it, except where the law requires us to keep it or it is held in routine backups that are deleted on their normal schedule.

10. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information. These may include:

10.1 Access and Information

You have the right to request information about the personal information we hold about you and how we use it.

10.2 Correction

You have the right to request that we correct any inaccurate or incomplete personal information we hold about you.

10.3 Deletion

You have the right to request the deletion of your personal information in certain circumstances.

10.4 Restriction of Processing

You have the right to request that we restrict the processing of your personal information in certain circumstances.

10.5 Data Portability

You have the right to receive a copy of your personal information in a structured, machine-readable format.

10.6 Objection

You have the right to object to our processing of your personal information in certain circumstances.

10.7 Opt-Out of Marketing Communications

You can opt-out of receiving marketing communications from us by following the unsubscribe instructions included in each marketing email or by contacting us directly.

To exercise any of these rights, please contact us at ivan@credtics.com. If your request concerns Customer Data, we may refer it to the customer that controls that information.

11. Cookies and Tracking Technologies

11.1 Cookies

We use cookies and similar tracking technologies to track activity on our Platform and hold certain information. Cookies are files with a small amount of data that may include an anonymous unique identifier. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Platform.

11.2 Analytics

We use Google Analytics to collect and analyze information about how users interact with our Platform. These tools may collect information such as how often users visit the Platform, what pages they visit, and what other sites they used prior to coming to our Platform.

11.3 Remarketing

We use remarketing services provided by Google Ads, Facebook Ads, and X (formerly Twitter) Ads to advertise on third-party websites to previous visitors of our Platform. These services use cookies to serve ads based on your past visits to our Platform. This allows us to show advertisements to users who have previously visited our Platform while they browse other websites.

12. Children's Privacy

Our Platform is not intended for use by children under the age of 18, and we do not knowingly collect personal information from children under 18 for our own purposes. If we learn that we have collected such information, we will promptly delete it. Customer Data may sometimes include information about minors, such as dependants named in a medical insurance claim or beneficiaries of a policy; we process that information only on our customers' instructions and under this Privacy Policy. If you have concerns about a child's information, please contact us at ivan@credtics.com.

13. Third-Party Links

Our Platform may contain links to third-party websites and services that are not owned or controlled by us. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party websites or services. We encourage you to review the privacy policies of any third-party websites or services that you visit.

14. International Data Transfers

We serve customers in Uganda and in other countries, and your information may be transferred to and processed in countries other than the country in which you reside. These countries may have different data protection laws than your country of residence. By using our Platform, you consent to the transfer of your information to countries outside of Uganda, including but not limited to the United States and the other countries where our cloud, artificial intelligence and other service providers process data.

Whenever we transfer personal information outside of Uganda or a customer's country, we ensure a similar degree of protection is afforded to it by implementing appropriate safeguards in accordance with applicable data protection laws.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at:

Lendtech Innovations Ltd Physical Address: Mbalwa Kyaliwajjala, Namugongo Division, Wakiso District, Uganda Email: ivan@credtics.com Phone: +256 757 712 667

17. Compliance with Laws

This Privacy Policy is designed to comply with applicable data protection laws in Uganda, including the Data Protection and Privacy Act, 2019. Where we process information about people in other countries, we also take into account the data protection laws that apply there, such as Kenya's Data Protection Act, 2019, Rwanda's Law No. 058/2021 relating to the protection of personal data and privacy, South Africa's Protection of Personal Information Act, 2013, Egypt's Personal Data Protection Law No. 151 of 2020, India's Digital Personal Data Protection Act, 2023, and Sri Lanka's Personal Data Protection Act, No. 9 of 2022. We are committed to protecting your privacy in accordance with these laws and best practices in data protection.