How we handle your data

CredChain is a credential-compliance platform for staffing agencies. We process two broad categories of data: information about the agency using the product (our customer), and information about the agency's workers whose credentials are tracked. For worker data, the agency is the data controller and CredChain acts as a processor on its behalf.

• Account data: names, work email addresses, and roles of agency staff who sign in.
• Worker records: names, contact details, discipline, and employment metadata entered by the agency or imported via CSV.
• Credential documents: licenses, certifications, and check results uploaded by workers or staff, plus the fields drawn from them (license number, issuing body, dates).
• Operational data: audit logs, email-delivery records, and API usage.

We use this data solely to provide the service: tracking credential status, sending renewal and onboarding emails on the agency's behalf, verifying submitted documents, generating audit reports, and answering compliance-check API requests. We do not sell personal data or use it for advertising.

When an agency enables AI verification, a submitted credential document is sent to Anthropic to extract its fields and assess whether it plausibly matches the expected credential. Anthropic processes the document to return that result and does not use it to train models. AI is a screening aid that assists human reviewers — it is not a primary-source authority and does not, on its own, certify a credential's authenticity. Agencies can operate the platform with AI disabled, in which case documents are reviewed manually and are not sent to Anthropic.

We rely on the following subprocessors to operate the service:

Data is retained for as long as the agency's account is active and as needed to provide the service. Documents are stored in access- controlled object storage; data is isolated per agency at the database level. On account closure, we delete or return personal data on request, subject to legal retention obligations.

Workers who want to access, correct, or delete their personal data should contact the staffing agency that holds their records (the controller). Agencies can fulfil those requests directly in the product, and we will assist as processor where needed.

Questions about this policy or a data-processing agreement? Email privacy@credchain.app.