Global Privacy Policy

AltScore (KINLENDING S.A. in Ecuador, AltScore S.A. de C.V. in México, and Altscore INC. in the United States, "Altscore", "we", "us" or "our") takes the protection and security of your personal data very seriously. This privacy notice sets out the data we collect and process about you through our products and services, the purposes of the data processing and how you can exercise your privacy rights under our channels and the supervisory authority of your country.

You may be reading this notice because of a link provided by an organisation you are engaging (our customer), or you simply want more information on data processing in relation to our products and services.

Our customer and data supplier (you have engaged with) will have a lawful reason for collecting and processing your data and may have a separate relationship with you. It is separately required to provide you with information (for example through their own privacy notice) about how it collects and processes your data.

For Ecuador:

Our headquarters office address is at:
Edificio Aveiro
Av. de los Shyris 32-42
Quito, Ecuador

For Mexico:

Edificio Tabasco 262
Interior 302, entre insurgentes y Medellín
CDMX, Mexico

For United States:

4201 Cathedral Ave, Unit 919E
Washington DC, 20016
WDC, USA

If you have any questions about how we use your data, please read that document or get in touch to our Data Protection Officer by email at data.protection@altscore.ai.

We review this privacy notice on an annual basis, or sooner if changes to regulation require it or we change the way we process personal data.

The last version of this document is 20th December 2024.

AltScore provides products and services to help financial and other organizations make real-time credit decisions. We use data and produce alternative credit scores via our proprietary technology. This includes highly sophisticated algorithms and predictive analytics applied to metadata accessed via our APIs and mobile/web SDKs. Our rails of lending provide these alternative credit scores only for the benefit of the customer related to that data. We do NOT share nor the provided data, neither your alternative credit score with anyone else. More concrete examples are included below describing why we collect your personal data.

At AltScore, we are committed to maintaining the highest standards of security and data protection. We are proud to be SOC 2 and ISO 27001 certified, which demonstrates our robust security framework and dedication to safeguarding our customers' data. These certifications validate that we have implemented strong security controls, including access management, encryption, and monitoring, to ensure the confidentiality, integrity, and availability of data across our operations. Our compliance with these internationally recognized standards reflects our commitment to building trust with our customers and ensuring that their sensitive information is handled with the utmost care.

At AltScore, we create alternative data to provide creditworthiness assessments and enhance our services. This data is carefully selected to ensure relevance to the credit-scoring process while respecting your privacy.

We use advanced technology to extract anonymized and pseudonymized data points, which are processed securely on our servers. Instead, we focus on metadata that allows us to generate aggregated insights and risk profiles.

The data collected may include information about transactions, behaviour, interactions with applications or websites, and general usage patterns. This information is processed to deliver secure, real-time credit decisions for our customers, ensuring that we provide the most accurate and fair assessments possible.

To maintain transparency and protect your privacy, we strictly limit the data collected to what is necessary for the services you request. Our technology is designed to exclude sensitive or private content, and we never collect or process data without your explicit consent.

We collect your data only after we have also collected your consent either directly to us (via Altscore API, AltScore SDK) or via the organisation you are interacting with. We will NOT and cannot extract your data without your consent.

We do NOT request for your data from our customers (organisations that you have engaged with) without your consent and do NOT collect or process it without your consent. We/organisation that you have engaged with will also ask you to opt-in “proceed with credit analysis”, or similar, before commencing a credit scoring assessment on your mobile phone/web device.

You can be assured that we protect the information we collect. By using our products or services, you agree to the collection, use, and sharing of your data in accordance with this privacy notice. You may change and revoke your ‘access to data’ permissions at any time by using your phone/device/system settings.

We use your data to assess your creditworthiness for a service of your choice (loan, credit card etc.). The organisation of your choice may use AltScore’s assessment as part of their decision process whether or not to grant you a loan or other financial service.

We also use your data to: 

• Obtain an assessment of your creditworthiness including but not limited to an assessment of the probability of default of your obligations in the framework of contracts for the provision of financial services;
• Assess your interest in receiving financial services through algorithms and mathematical modelling.
• We retain derived data for the purposes of debugging and process improvement, which we typically include in contracts to clarify that this information belongs to us.

As explained above under "What do we do", the data collected by our technology is NOT directly sent to any organisation different from AltScore. 

I.e., we share the result of your credit assessment with the organisation you are applying for a financial service. The result of your credit assessment that we share, depends solely on your potential willingness to disclose your information in order to get the services you have requested from the organisation of your choice. We also share your potential willingness to communicate directly with the organisation of your choice, if requested by the organisation. We do NOT share the raw data collected from you with any person including the organisation.

We may also share your data in the following ways: when required by competent authority or necessary to comply with a valid legal process; when required to protect and defend the rights or property of Altscore, including the security of our products and services; when necessary to protect the personal safety, property or other rights of the public, Altscore or its customers or employees; or in connection with a sale of all or part of our business. If we are involved in a merger, acquisition or asset sale, we will abide by this privacy notice, and any affected users will be informed if we transfer any personal data to a third party or if personal data becomes subject to a different privacy notice as a result.

Cloud Providers

We are a cloud-native company. With that in mind, our data is securely stored using industry-leading cloud providers: Google Cloud Platform (GCP), MongoDB Cloud, and Amazon Web Services (AWS). These platforms provide enterprise-grade security measures, such as encryption at rest and in transit, regular audits, and state-of-the-art data protection mechanisms. Additionally, our infrastructure is designed with high availability to ensure uninterrupted service and rapid recovery in the unlikely event of an incident. By leveraging the capabilities of these providers, we deliver secure, scalable, and reliable solutions for your data, adhering to the strictest standards of data privacy and security.

We retain the data we collect from you for the length of time necessary to fulfill the specific purposes for which it has been collected (for example, to provide our customers with a service you have requested or for our customers to comply with applicable legal requirements, such as anti-money laundering). We may also keep it to comply with our legal obligations, resolve any disputes and enforce yours and our rights.

Once the respective purpose ceases to apply, we will either delete or anonymise the personal data or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your data and isolate it from any further processing until deletion is possible.

To implement and improve the functionality of AltScore’s technology and to update the credit scorecards developed for our clients, we will keep your data for up to 3 (three) years unless you or the organisation you have engaged with request us to delete your data at an earlier date.

If you have questions about or need further information concerning how long we keep your data for, please contact us using the contact details provided below.

Due to how AltScore processes data, your personal data is pseudonymised, therefore we are unable to fulfil your rights directly as it is not possible for AltScore to identify you as an individual.  

To exercise any of the rights outlined below, please consult with the organisation you have been interacting with, or contact us by our channels. They will then be able to provide AltScore with information to assist in exercising your rights.  

As an individual, you have rights under the law of your country regarding the use of your data, these are:

• The right to withdraw consent – you can withdraw consent at any time.  
• The right to erasure – you can request that Altscore remove your data from our systems.
• The right to restrict processing – you can request that Altscore only process your data for the purposes you specify.
• The right to data portability – you can request that the data you have provided to Altscore be ported to another organisation.
• The right to access your data – You have a right to know what data Altscore hold on you and for what purpose we are processing your data. This is known as a Subject Access Request (SAR).
• The right to rectification – you have the right to ask us to rectify any information you believe is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• The right to object to processing – you have the right to object to processing if we are able to process your information because the processing is in our legitimate interests.

You are not required to pay any charge for exercising your rights. We have one calendar month to respond to you. If the organisation you have been interacting with is  unable to comply with your request, we will provide you with an explanation.

We take all complaints seriously and can assure you we will do our best to deliver a satisfactory outcome. If you do wish to complain about how your personal data is used by Altscore then please write to us at: data.protection@altscore.ai  

Altscore will investigate your complaint and aim to respond within 20 working days. This allows us time to investigate your complaint thoroughly.  

Where you believe that Altscore have not taken our responsibilities with your data seriously, you have the right to complain to a relevant Data Protection Authority or regulator who governs data-privacy issues under your country or region.  Here is the list of government institutions for forwarding claims in the respective countries we operate:

• Mexico: Agencia de Acceso a la Información Pública
• Argentina: Agencia de Acceso a la Información Pública
• Ecuador: Superintendencia de Protección de Datos