Privacy Policy

1. Introduction and Scope

Felix Financial Services (“Felix,” “we,” “us,” or “our”) is a technology-enabled debt negotiation service that helps consumers understand their credit, prioritize accounts, and receive assisted negotiation with creditors. This Privacy Policy describes how we collect, use, disclose, retain, and protect your personal information when you use the Felix platform, website, embedded experiences offered through partner organizations, and related services (collectively, the “Services”).

This Privacy Policy applies to consumers who use the Services, visitors to our website, and individuals who begin but do not complete enrollment. If you access the Services through a partner organization’s co-branded portal, this Privacy Policy governs Felix’s handling of your personal information; the partner organization’s own privacy practices are governed by its separate privacy policy.

Partner co-branding does not change who provides your account or controls the Felix Services. Your account remains a Felix account, and Felix Financial Services is responsible for the Felix data practices described here. A partner name or logo identifies how you were referred to or accessed Felix; it does not replace Felix as the service provider.

By creating an account or using our Services, you acknowledge that you have read and understand this Privacy Policy. If you do not agree with these practices, please do not use our Services. This Privacy Policy is incorporated into our Terms of Service.

2. Information We Collect

We collect the following categories of personal information. For each category, we describe what the information includes; Section 3 describes the sources of this information and Section 4 describes the purposes for which we use it.

2.1 Personal Identifiers

Name (first and last), email address, telephone number, date of birth, mailing address, and the last four digits of your Social Security Number (used for identity verification and credit inquiry purposes; stored in encrypted form). We do not store your full Social Security Number in our systems.

When you authorize a credit check, you provide your full Social Security Number once. It is transmitted over an encrypted connection to our credit-data service provider for the sole purposes of verifying your identity with the consumer reporting agency and retrieving your credit report. Felix never stores, logs, or displays the full number. The service provider retains it exclusively in encrypted form (AES-256), and only so that your credit information can be refreshed without you re-entering it. That encrypted record is permanently deleted when you delete your account, when your subscription ends, or — if you complete a credit check but never subscribe — automatically within approximately thirty (30) days of your most recent credit check. Section 10 describes retention in more detail.

2.2 Financial and Credit Information

Credit report data obtained through authorized soft credit inquiries, including credit scores, account balances, payment histories, creditor names, account types, and delinquency information. We obtain this data from consumer reporting agencies through authorized intermediaries, solely with your consent and for the purpose of providing our Services. Soft inquiries do not affect your credit score, and we do not perform hard inquiries without separate, explicit authorization. We also collect financial information you provide directly, such as hardship reasons and the accounts you choose to enroll.

2.3 Payment Information

Subscription payments are processed by a PCI DSS-compliant third-party payment processor. We do not store your credit card numbers, debit card numbers, or bank account details on our servers. We retain transaction identifiers, subscription status, plan selection, and billing history for account management purposes.

2.4 Communication Records

Records of communications relating to your account and cases, including emails, text messages, support requests submitted through your account dashboard, and physical correspondence prepared through the platform. This includes the content, date, time, direction, and delivery status of such communications.

2.5 Electronic Signatures, Consents, and Documents

When you electronically sign documents through our platform (such as the individual creditor letters you authorize), we collect and retain your typed legal name, drawn signature image, the IP address from which you signed, the date and time of signing, and the browser and device information used. Signed documents are securely stored and available to you upon request. Separately, every consent you provide (credit pull, communications, letter authorizations, terms acceptance) is recorded in our consent ledger together with your IP address, timestamp, and the version of the consent text presented.

2.6 Documents You Upload

Documents and images you choose to upload through your dashboard, such as creditor letters and collection notices you receive at home, and supporting hardship documentation. These materials may contain personal identifiers, account numbers, and financial details, and are processed (including by automated tools, as described in Section 6) to associate them with your cases and summarize their contents.

2.7 Device and Usage Information

IP address, browser type and version, operating system, device identifiers, referring URLs, pages visited within our platform, timestamps of access, and general usage patterns. This information is collected through server logs, cookies and similar technologies (see our Cookie Policy), and analytics tools for the purpose of improving our Services and ensuring platform security. If you arrive at Felix from an advertisement or a campaign link, this category also includes attribution data: the referring site, campaign parameters (such as utm_source), and the advertising click identifier the platform appended to the link (such as fbclid or gclid), as described in Section 8.

2.8 Inferences and Derived Information

Analyses derived from the information above in order to provide the Services, such as account prioritization rankings, negotiation strategy assessments, and case risk indicators. These derived analyses are used solely to deliver and improve the Services and are always subject to your review and approval before any action is taken, as described in Section 6.

3. Sources of Personal Information

We collect personal information from the following sources:

Directly from you, when you create an account, complete enrollment, sign letters, upload documents, communicate with support through your account dashboard, or otherwise interact with the Services.
Automatically, through your use of the Services, via server logs, cookies, and similar technologies.
Consumer reporting agencies and their authorized intermediaries, which provide credit report data based on your prior express consent.
Partner organizations, if you enrolled through a partner, which may provide us with enrollment and referral information.
Service providers, such as our payment processor (transaction status) and communication providers (delivery status).
Your creditors, indirectly, through correspondence they mail to your home address that you choose to upload to your dashboard.

4. How We Use Your Information

We use your personal information for the following purposes:

Service Delivery: To provide debt negotiation services, including obtaining your credit report through authorized soft inquiries, analyzing your accounts, preparing creditor letters for your review and electronic signature, mailing letters you have signed, presenting settlement offers for your review and approval, and tracking your enrolled accounts.
Identity Verification: To verify your identity and eligibility for our Services, including through soft credit inquiries.
Payment Processing: To process subscription payments and manage your billing account.
Communications: To send you account notifications, case updates, settlement offers, and service-related messages via email, SMS, or mail, in accordance with your communication preferences.
Automated Processing: To use technology, including artificial intelligence, to assist with negotiation strategy, creditor correspondence analysis, and communication drafting, as further described in Section 6.
Recordkeeping and Auditability: To maintain the consent ledger, audit logs, and signed-document records that evidence your authorizations.
Legal Compliance: To comply with applicable laws, regulations, legal processes, and government requests, including obligations under the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA), the E-SIGN Act, and state privacy laws.
Security and Fraud Prevention: To detect, investigate, and prevent fraudulent, unauthorized, or illegal activity, and to protect the rights, property, and safety of Felix, our users, and others.
Service Improvement: To analyze aggregated and de-identified usage data to improve the functionality, performance, and user experience of our Services. De-identified data is maintained in de-identified form and is not reidentified.

Advertising Measurement and Attribution: To understand which of our own advertising campaigns bring people to Felix and to report a limited set of conversion events back to the advertising platforms where Felix — or the partner that referred you — advertises, as described in Section 8. This use is subject to your opt-out and to opt-out preference signals such as the Global Privacy Control.

We do not sell your personal information (see Section 8), and outside the limited advertising measurement described in Section 8 we do not use your personal information for targeted or cross-context behavioral advertising.

5. Gramm-Leach-Bliley Act (GLBA) Notice

Felix provides financial services to consumers and treats the nonpublic personal information we collect about you in accordance with the privacy provisions of the Gramm-Leach-Bliley Act and its implementing regulations. In summary:

We collect nonpublic personal information about you from the sources described in Section 3, including information you provide, information from your transactions with us, and information from consumer reporting agencies.
We do not disclose nonpublic personal information about current or former customers to nonaffiliated third parties, except as permitted or required by law — for example, to service providers who help us deliver the Services under contractual confidentiality obligations, to service providers that perform marketing and advertising measurement for Felix’s own services under contractual use restrictions (limited to the hashed identifiers and conversion events described in Section 8, and subject to your opt-out), to effect transactions you have requested or authorized (such as mailing a letter you have signed), and to comply with legal process.
Because we share nonpublic personal information with nonaffiliated third parties only under these legal exceptions, there is no sharing for you to opt out of under the GLBA.
We maintain administrative, technical, and physical safeguards designed to protect your nonpublic personal information, as described in Section 11.

6. Automated Processing and Artificial Intelligence

Felix uses automated tools, including artificial intelligence, to assist with certain aspects of our Services. These tools may be used to analyze creditor correspondence (including documents you upload), identify settlement opportunities, draft negotiation letters for your review and signature, classify creditor responses, and recommend next steps in the negotiation process.

Important safeguards regarding our use of AI:

No automated system makes final decisions on your behalf. All settlement offers require your explicit approval before they are accepted, and no creditor letter is sent without your individual electronic signature.
You may request human review of any action taken or proposed by automated systems at any time by contacting our support team through your account dashboard.
Data processed by our AI service providers is not used to train their models, is processed in the United States, and is subject to data processing agreements that protect your information.
All actions taken by automated systems are logged and auditable.
You may opt out of automated processing at any time; your cases will be handled through manual processes instead.

7. Information Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We share personal information only in the following circumstances, and only the information reasonably necessary for each purpose:

Credit Reporting Agencies and Intermediaries: We share necessary personal information with consumer reporting agencies and their authorized intermediaries to perform the soft credit inquiries you have authorized.
Your Creditors: When you review and electronically sign a letter, that signed letter — containing your name and account information — is mailed to the applicable creditor or collection agency in your name for the purpose of negotiating your debt. No information is sent to a creditor except through a letter you have individually signed.
Payment Processors: We share billing information with our third-party payment processor to process subscription payments.
Communication and Mail Providers: We use third-party service providers to deliver emails, text messages, and physical mail on your behalf and for service notifications.
Electronic Signature Providers: We use a third-party electronic signature service to execute and store certain signed template documents.
AI Service Providers: We share case-related data with our AI service providers for the automated processing described in Section 6, subject to data processing agreements that restrict the use of your data.
Hosting and Infrastructure Providers: We use third-party providers to host our platform, store data, and run background processing, all within the United States and under contractual confidentiality and security obligations.
Analytics Providers: We share aggregated and de-identified usage data with analytics providers to improve our Services. This data cannot be used to identify you personally.
Advertising Platforms (opt-out available): Unless you opt out, we report a limited set of conversion events to the advertising platforms where Felix — or the partner that referred you — advertises, so we can measure whether our advertising works. Section 8 describes exactly what is and is not disclosed and how to opt out.
Partner Organizations: If you enrolled through a partner organization, we may share account status and case progress information with that partner to the extent described in your agreement with them. Partners have view-only access and do not perform fulfillment activities.
Professional Advisors: We may share information with our lawyers, auditors, accountants, and insurers where necessary in connection with the professional services they provide to us, subject to confidentiality obligations.
Business Transfers: If Felix is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of some or all of its assets, your information may be transferred as part of that transaction, subject to this Privacy Policy or successor terms that are no less protective, and we will provide notice where required by law.
Legal and Regulatory: We may disclose your information when required by law, subpoena, court order, or governmental request, or when we believe disclosure is necessary to enforce our agreements, protect our rights, your safety, or the safety of others, or to detect and prevent fraud or security issues.

8. Sale and Sharing of Personal Information; Advertising Measurement

We do not sell your personal information for money, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information — including your credit report data, Social Security Number digits, financial account details, or hardship information — for advertising, and no such information is ever included in the disclosures described in this section. We do not knowingly sell or share the personal information of minors.

Advertising measurement and attribution. Felix advertises its own services on advertising platforms. To measure whether that advertising works, we use first-party cookies to remember how you arrived (see our Cookie Policy, Section 4.4) and, unless you opt out, report certain conversion events from our servers to the platform whose ad brought you here — for example, that an account was created or a subscription was purchased. Where you were referred to Felix by a partner organization, the same limited reporting may be made to the advertising accounts of that partner for its advertising of the Felix program. Each such disclosure is limited to:

contact identifiers in hashed (one-way encoded) form — such as email address, phone number, name, city/state/ZIP, and date of birth — used by the platform solely to match the event to the ad that was clicked;
the event name, the time it occurred, and the page it occurred on;
the advertising click identifier that the platform itself appended to the link you clicked;
your IP address and browser user-agent string; and
for purchases, the amount paid and the plan purchased.

We never disclose your credit scores, credit report contents, tradelines, account balances, debts, enrollment details, hardship reasons, case activity, or uploaded documents to any advertising platform, and we do not load advertising platforms’ code on our pages.

Your opt-out.Under some state privacy laws, this conversion reporting may be considered “sharing” of personal information for cross-context behavioral advertising. You can opt out at any time — before or after any data is disclosed — through any of the following, each of which stops all conversion reporting about you:

the “Your Privacy Choices” link in our website footer or in your account Settings (turn off “Marketing & advertising”);
the “Essential only” option in our consent banner; or
an opt-out preference signal such as the Global Privacy Control, which we honor automatically and treat as an absolute block (see Section 15).

9. Cookies and Tracking Technologies

We use a limited set of cookies and similar technologies to operate our Services:

Essential Cookies: Required for authentication, session management, and platform security. These cookies cannot be disabled without losing access to the Services.
Preference Cookies: Remember your settings and partner co-branding context across sessions.
Analytics Cookies: Collect aggregated, de-identified usage data to help us improve the Services.
Marketing and Attribution Cookies: First-party cookies that remember which campaign or advertisement brought you to Felix, supporting the advertising measurement described in Section 8. We do not use third-party advertising cookies, retargeting cookies, or social media tracking cookies, and no third party can set or read cookies on our Services.

You can manage your cookie preferences through your browser settings. For a full description of the technologies we use, their purposes, and how to manage them, please see our Cookie Policy.

10. Data Retention

We retain your personal information for as long as your account is active and as needed to provide our Services, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention practices include:

Active Account Data: Retained throughout the duration of your active subscription and account.
Full Social Security Number (held by our credit-data service provider): Retained exclusively in encrypted form, and permanently deleted when your account is deleted, when your subscription is canceled or expires, or — if you complete a credit check but never subscribe — automatically within approximately thirty (30) days of your most recent credit check. A later credit check you authorize will collect it again.
Post-Cancellation: Case data, documents, and offer history remain accessible for 90 days following cancellation or termination of your subscription. After 90 days, inactive case data may be archived.
Consent Records: Records of your consents (credit pull, communications, electronic signatures, terms acceptance) — including IP address, timestamp, and consent text version — are retained indefinitely as part of our compliance and audit obligations, and are preserved in our audit records even after your account is deleted.
Credit Reports: Retained in accordance with Fair Credit Reporting Act (FCRA) requirements and our legitimate business needs, and deleted with your account.
Signed Legal Documents: Retained in accordance with applicable record-retention requirements and the E-SIGN Act.
Audit Logs: System audit logs are retained indefinitely for security and compliance purposes.
Billing Records: Retained as required by tax, accounting, and financial recordkeeping obligations.

You may delete your account at any time from Settings → Account. Deleting your account cancels any active subscription immediately, permanently deletes your cases, documents, credit reports, and profile from our production systems, and instructs our credit-data service provider to permanently delete its records for you — including the encrypted full Social Security Number and the credit data it holds on our behalf.

Upon deletion of your account, we will delete or de-identify your remaining personal information within a reasonable time, except where retention is required by law or necessary for our legitimate business interests (such as the consent, audit, and billing records described above, fraud prevention, dispute resolution, or compliance). Where deletion is not immediately possible (for example, data stored in secure backups), we will isolate the data from further processing until deletion is possible.

11. Data Security

We implement administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, use, alteration, or destruction, appropriate to the sensitivity of the information we handle. These measures include:

Encryption of data in transit (TLS) and at rest, with additional application-layer encryption (AES-256) applied to the most sensitive identity fields;
Role-based access controls that restrict data access to authorized personnel with a need to know;
Comprehensive audit logging, including a recorded audit entry whenever restricted identity fields are revealed to authorized personnel;
Row-level security in our database to ensure multi-tenant data isolation;
Secure development practices, including code review and automated testing;
Contractual security and confidentiality obligations imposed on our service providers;
Storage and processing of all data within the United States.

While we take reasonable measures to protect your information, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach of security affecting your personal information, we will notify you and the appropriate authorities as required by applicable law. You play a role in security as well: keep your credentials confidential and notify us promptly through the support section of your account dashboard of any suspected unauthorized access.

12. Your Privacy Rights

Depending on your state of residence, you may have the following rights regarding your personal information:

Right to Know / Access: You may request confirmation of whether we process your personal information and a copy of the personal information we have collected about you, including the categories of information, sources, purposes, and categories of recipients.
Right to Correct: You may request that we correct inaccurate personal information, taking into account the nature of the information and the purposes of processing.
Right to Delete:You may request that we delete your personal information, subject to certain exceptions required or permitted by law (such as consent-ledger and audit records we must retain). You can also exercise this right directly at any time by deleting your account from Settings → Account, as described in Section 10.
Right to Data Portability: You may request your personal information in a structured, commonly used, and machine-readable format.
Right to Opt Out:You may opt out of certain data processing activities, including profiling in furtherance of decisions that produce legal or similarly significant effects, the sale of personal information, targeted advertising, and the “sharing” of personal information for cross-context behavioral advertising. We do not sell personal information; you can opt out of our advertising measurement at any time as described in Section 8, and you may opt out of our automated processing as described in Section 6.
Right to Limit Use of Sensitive Personal Information: Where applicable. We use sensitive personal information only for purposes permitted by law, such as providing the Services you request.
Right to Non-Discrimination: We will not discriminate or retaliate against you for exercising any of your privacy rights.

Note regarding credit report data: Certain information we handle, such as your consumer report, is regulated by the Fair Credit Reporting Act. If you believe information in your credit report is inaccurate, you have the right under the FCRA to dispute it directly with the consumer reporting agency that furnished it. Felix does not dispute credit report information on your behalf.

13. State Privacy Rights and How to Exercise Them

The rights described in Section 12 may be available to you under state privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Texas Data Privacy and Security Act, the Oregon Consumer Privacy Act, and other applicable state laws. Some information we process may be exempt from certain state privacy laws to the extent it is governed by federal financial privacy laws such as the GLBA and the FCRA; where an exemption applies, we nonetheless protect that information as described in this Privacy Policy.

How to submit a request: Contact us through the support section of your account dashboard and specify the right you wish to exercise.
Verification: We will verify your identity before processing your request, using information associated with your account. Because rights requests are submitted through your authenticated account dashboard, verification is generally satisfied by your login; we may request additional information for sensitive requests.
Authorized agents:Where permitted by applicable law, you may designate an authorized agent to submit a request on your behalf. We will require proof of the agent’s authorization and may require you to verify your own identity and confirm the request.
Response timing: We will respond within 45 days (or as otherwise required by applicable law). If we need additional time, we will notify you of the extension and the reason.
Appeals: If we decline to act on your request, we will explain why, and — where required by applicable state law — you may appeal our decision by responding through the same support channel. If your appeal is denied, you may contact your state attorney general or other authority designated under applicable law.

14. Children’s Privacy

Our Services are not directed to individuals under the age of 18, and use of the Services is limited to adults. We do not knowingly collect personal information from children under 18 (including children under 13 within the meaning of the Children’s Online Privacy Protection Act). If we learn that we have collected personal information from a child under 18, we will promptly delete that information. If you believe a child has provided us with personal information, please contact us through the support section of your account dashboard.

15. Do Not Track and Opt-Out Preference Signals

Some browsers offer a “Do Not Track” (“DNT”) setting or transmit opt-out preference signals such as the Global Privacy Control (“GPC”). We honor both, automatically and without requiring an account: when your browser sends a DNT or GPC signal, we treat it as a valid request to opt out of the sale or sharing of your personal information. We do not load non-essential analytics (unless you have explicitly opted in), we do not store advertising click identifiers from the links you arrive on, and we do not report any conversion events about you to advertising platforms — regardless of any preference previously saved in our consent tools. The advertising block cannot be overridden while the signal is present.

16. International Users; Data Residency

Our Services are designed for and directed to users in the United States. All personal information is stored and processed within the United States, including data processed by our AI service providers. We do not offer the Services to individuals located outside the United States. By using our Services, you consent to the collection, transfer, storage, and processing of your information in the United States.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will post the updated policy with a new “Last updated” date and, where required by law, notify you via email or an in-app notification before the changes take effect. We will not use previously collected personal information in a manner materially inconsistent with the policy in effect at the time of collection without obtaining your consent. Your continued use of the Services after the effective date of the revised policy constitutes your acceptance of the updated terms.

18. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices — including requests to exercise your privacy rights — please contact us through the support section of your account dashboard. Routing privacy requests through your authenticated dashboard allows us to verify your identity and respond securely. We will acknowledge and respond to inquiries within the timeframes required by applicable law.