Our commitments under the law.

1Who We Are

CreditReportNow LLC ("CreditReportNow," "we," "us") is a consumer reporting agency reseller as defined in the Fair Credit Reporting Act, 15 U.S.C. § 1681a(u). We obtain consumer reports from a supplying consumer reporting agency under a written reseller agreement and deliver those reports to authorized end-users for permissible purposes specified in 15 U.S.C. § 1681b.

We do not maintain our own database of consumer credit information. We do not furnish information to consumer reporting agencies. We are not a credit repair organization and do not provide credit repair, credit counseling, or credit improvement services. We are not affiliated with Equifax, Experian, TransUnion, the Federal Trade Commission, the Consumer Financial Protection Bureau, or any government agency.

2Reasonable Procedures Under § 1681e

Section 1681e of the FCRA requires every consumer reporting agency to maintain reasonable procedures designed to limit the furnishing of consumer reports to permissible purposes and to assure maximum possible accuracy of the information concerning the individual about whom the report relates.

End-User Vetting

Before any business is granted access to consumer reports through our platform, we:

• Verify the legal existence and good standing of the business with the relevant Secretary of State or equivalent.
• Verify the business address, phone number, signage, and physical premises, including a physical or virtual on-site inspection where required by the supplying bureau.
• Require the business to identify and certify, in writing, the permissible purpose under § 1681b for which it intends to obtain consumer reports.
• Require the business to execute our End-User Agreement, which includes ongoing certifications, audit rights, indemnification, and immediate-termination clauses for misuse.
• Reject end-users in prohibited categories, including but not limited to: credit repair organizations, debt elimination services, marketing data brokers, individuals seeking reports on private parties for personal reasons, and any business that cannot demonstrate a recognized permissible purpose.

Per-Pull Certification

For every individual consumer report request, the end-user must:

• Re-certify the permissible purpose for that specific transaction.
• Identify the consumer with sufficient accuracy to ensure the correct report is delivered.
• Confirm the consumer has provided written authorization where required (e.g., employment purposes under § 1681b(b)(2)(A)).
• Pass identity-verification challenges sent to the consumer where applicable.

Accuracy

We deliver consumer reports as received from the supplying bureau. We do not edit, append, or modify the substantive content of a consumer report. We forward fraud alerts, active duty alerts, identity theft notices, and consumer statements as received. If a consumer disputes information contained in a report we delivered, we follow the procedures in Section 4 below.

Audit and Recordkeeping

We retain authorization records, identity-verification records, end-user certifications, transaction logs, and dispute records for a minimum of five years, consistent with industry standard and bureau requirements. Logs are immutable and tamper-evident.

3Your Rights Under the FCRA

If you are a consumer (the person the report is about), you have important rights under the FCRA. The Consumer Financial Protection Bureau publishes a complete official summary, available here:

In summary, under the FCRA you have the right to:

• Know what's in your file. You may request and obtain all information about you in the files of a consumer reporting agency.
• Get a free copy of your report. You can get a free credit report once every 12 months from each of the three nationwide consumer reporting agencies. Visit annualcreditreport.com or call 1-877-322-8228.
• Get an additional free report if a person has taken adverse action against you because of information in your report; if you are unemployed and intend to apply for employment within 60 days; if you are on public assistance; or if your report is inaccurate because of fraud.
• Dispute incomplete or inaccurate information. The consumer reporting agency must investigate, generally within 30 days.
• Have inaccurate, incomplete, or unverifiable information corrected or deleted.
• Have outdated negative information removed. In most cases, a consumer reporting agency may not report negative information that is more than seven years old, or bankruptcies that are more than 10 years old.
• Limit access to your file. Only people with a permissible purpose may obtain your report.
• Limit pre-screened offers. You may opt out of unsolicited "pre-screened" credit and insurance offers by calling 1-888-5-OPTOUT (1-888-567-8688) or visiting optoutprescreen.com.
• Place security freezes and fraud alerts on your file, free of charge.
• Seek damages from violators of the FCRA.
• Identity theft victims and active duty military have additional rights, including the right to extended fraud alerts.

Identity theft victims may obtain additional resources from the Federal Trade Commission at identitytheft.gov.

4How to Dispute Information

If you believe that information furnished or delivered through CreditReportNow is inaccurate, incomplete, or otherwise improper, you have the right to dispute it. We accept disputes by mail or by email. Please include as much of the following as you can:

• Your full name, current address, and previous addresses for the past two years.
• Your date of birth and last four digits of your Social Security Number (do not send the full number unless we request it through a secure channel).
• A copy of a government-issued photo ID and one document showing your current address.
• The specific item or items you are disputing and the reason.
• Any supporting documentation (court papers, payment records, ID theft reports, etc.).

What Happens Next

1. We send you a written acknowledgment within 5 business days of receipt.
2. We forward the dispute to the originating consumer reporting agency under § 1681i(f) reseller dispute procedures, along with all relevant information you provided.
3. The originating agency conducts a reinvestigation, generally within 30 days (45 days if you provide additional information).
4. You receive written notice of the results, including a copy of the report if it was changed.
5. If the result is unsatisfactory, you may add a brief consumer statement to your file, and you have the right to seek further remedy directly with the originating bureau or in court.

You Can Also Dispute Directly with the Bureaus

You always have the right to dispute information directly with the consumer reporting agency that supplied it. Contact information:

5Adverse Action Notices

If a business denies your application, charged you a higher rate, terminated your account, or took any other adverse action based in whole or in part on a consumer report, the FCRA requires that business (the "user" of the report) to provide you with an adverse action notice. The notice must include:

• The name, address, and telephone number of the consumer reporting agency that supplied the report (including its toll-free number for nationwide bureaus).
• A statement that the consumer reporting agency did not make the adverse decision and cannot give you the specific reasons for it.
• Notice of your right to obtain a free copy of the report from the consumer reporting agency within 60 days.
• Notice of your right to dispute the accuracy or completeness of any information in the report.

The end-user (the lender, landlord, or employer) is responsible for sending the adverse action notice itself. CreditReportNow does not send adverse action notices on behalf of end-users.

6Fraud Alerts and Active Duty Alerts

Under FCRA § 1681c-1 and § 1681c-2, consumers can place fraud alerts and active duty alerts on their credit files. As a reseller, we are required to honor and reconvey these alerts when present on a report we deliver.

Initial Fraud Alert

If you suspect you've been or are about to become a victim of identity theft, you can request an initial fraud alert. It stays on your file for at least one year. Contact any one of the three nationwide bureaus (the others are required to share the alert).

Extended Fraud Alert

Identity theft victims can request a 7-year extended fraud alert by submitting an identity theft report.

Active Duty Alert

Members of the military deployed away from their usual duty station can request an active duty alert that lasts at least one year.

Security Freeze (Credit Freeze)

You have the right to place a free security freeze with each of the three nationwide bureaus. A freeze prohibits a consumer reporting agency from releasing your report without your express authorization. Freezes can be placed and lifted at no cost.

To place fraud alerts or freezes, contact each bureau directly using the contact information in Section 4. For more information, see the FTC's identity theft resource at identitytheft.gov.

7Notice to Users of Consumer Reports

If you are a business that obtains consumer reports through CreditReportNow, you have specific obligations under the FCRA. The Consumer Financial Protection Bureau publishes the official "Notice to Users of Consumer Reports: Obligations of Users Under the FCRA," which we incorporate by reference and require all end-users to acknowledge:

Your Key Obligations as an End-User

• Permissible purpose: You may obtain a consumer report only for a purpose specified in § 1681b. You must certify the purpose for each report.
• Employment use: Before procuring a report for employment purposes, you must provide a clear and conspicuous written disclosure to the consumer in a stand-alone document and obtain the consumer's written authorization. Before taking adverse action based on the report, you must provide the consumer with a copy of the report and the CFPB Summary of Rights.
• Investigative consumer reports: Special disclosures under § 1681d apply.
• Adverse action: If you take adverse action based in whole or in part on a consumer report, you must provide the consumer with an adverse action notice meeting § 1681m requirements.
• Risk-based pricing: If you offer credit on materially less favorable terms based on a report, you must provide a risk-based pricing notice under 12 CFR Part 1022 Subpart H.
• Disposal: You must properly dispose of consumer report information per the Disposal Rule, 16 CFR Part 682 / 12 CFR Part 1022 Subpart I.
• Prohibited uses: You may not obtain a report under false pretenses (FCRA § 619 — federal crime).

8GLBA Safeguards Rule Notice

As a consumer reporting agency reseller, CreditReportNow LLC handles consumer financial information and is therefore a "financial institution" subject to the Federal Trade Commission's Safeguards Rule, 16 CFR Part 314, implementing Section 501(b) of the Gramm-Leach-Bliley Act.

Our Information Security Program

We maintain a comprehensive written information security program ("ISP") containing administrative, technical, and physical safeguards appropriate to the size and complexity of our operations and the nature and scope of our activities. The ISP is designed to:

• Ensure the security and confidentiality of customer information.
• Protect against any anticipated threats or hazards to the security or integrity of such information.
• Protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any consumer.

Required Elements

Our ISP includes each of the elements required by 16 CFR § 314.4:

• Designation of a Qualified Individual responsible for overseeing and implementing the ISP.
• Written risk assessments, updated periodically.
• Access controls and authentication, including multi-factor authentication for all individuals with access to customer information.
• Encryption of customer information at rest and in transit.
• Secure development practices for in-house applications.
• Procedures for the secure disposal of customer information.
• Change management procedures.
• Logging and monitoring of authorized user activity.
• Continuous monitoring or annual penetration testing plus semi-annual vulnerability assessments.
• Training for personnel with access to customer information.
• Oversight of service providers.
• Written incident response plan.
• Annual written report from the Qualified Individual to the governing body.

If a security event occurs that affects 500 or more consumers, we will notify the FTC as required by 16 CFR § 314.5.

9State Law Disclosures

In addition to the FCRA, we comply with applicable state consumer credit reporting laws. Specific notices are provided to consumers in the following states as required:

California

The California Consumer Credit Reporting Agencies Act (Civ. Code §§ 1785.1 et seq.) provides California consumers with rights similar to the FCRA, including the right to obtain a copy of your report and dispute inaccurate information. The Investigative Consumer Reporting Agencies Act (Civ. Code §§ 1786 et seq.) imposes additional requirements on investigative consumer reports. We provide California-specific disclosures and the California Summary of Rights to consumers when applicable.

Vermont

Under Vermont law (9 V.S.A. § 2480e), no consumer report concerning a Vermont consumer may be obtained without the consumer's consent except under limited circumstances. We require Vermont end-users to obtain affirmative written consent from Vermont consumers prior to each report.

Washington

The Washington Fair Credit Reporting Act (RCW 19.182) provides Washington consumers with additional rights and includes specific requirements regarding employment purposes.

Massachusetts

Massachusetts consumers have rights under M.G.L. c. 93 § 50 et seq., including the right to a free annual credit report and protections regarding employment use.

New York

New York consumers have rights under the General Business Law § 380, including specific limitations on the use of consumer reports for employment.

Other States

We comply with applicable laws in all U.S. states and territories. State-specific notices and rights summaries are delivered with reports where required.

10Contact Our Compliance Team

For compliance questions, regulatory inquiries, or to schedule an audit or inspection:

CreditReportNow LLC
Attn: Compliance Officer
1234 N. Central Avenue, Suite 500
Phoenix, Arizona 85004
Email: compliance@creditreportnow.ai
Phone: (602) 555-0100

For consumer disputes, see Section 4. For privacy questions, see our Privacy Policy.