Privacy policy

Metro2IQ is software for reading credit reports, finding where the bureaus disagree, and drafting and tracking disputes. Metro2IQ is operated by Aesthete Solutions LLC (“Metro2IQ”, “we”, “us”).

This policy covers metro2iq.com and the Metro2IQ app: the public pages, self-serve accounts for people working on their own credit file, business accounts, the client portal, the intake and sign-up forms businesses share with their clients, document-request links, and service-agreement signing links.

Metro2IQ is not a consumer reporting agency. We don’t furnish data to Equifax, Experian or TransUnion, we don’t sell credit reports, and we don’t make credit decisions about anyone. We work with reports that you, or a business working your file, upload.

Aesthete Solutions LLC also performs a done-for-you credit repair service, for Illinois residents only, under its own separate written agreement with you. That service works your file through a Metro2IQ business account, so what this policy says below about a business working your file applies to it too.

If you use a self-serve account

You are working on your own file, and we handle your information under this policy.

If a business is working your file

Credit consultants and agencies use Metro2IQ business accounts to work their clients’ files. When that’s you, the business decides what to collect about you and what to do with it, and we process it on the business’s behalf to run the software. The business is responsible for having your authorization to obtain and use your credit reports, for its own agreement with you, and for answering your requests about your data.

If you’re a business’s client, start with that business. You can also email support@metro2iq.com and we’ll help the business respond.

What we hold depends on how you use Metro2IQ. Across the app, it can include:

Account details

Your name, email address and sign-in details. For a business: the business name and the names and emails of its staff.

Identity details

Full name, prior or other names, mailing address, date of birth and the last four digits of your Social Security number. The bureaus use these to match a dispute to the right file.

Credit reports

The report files uploaded to the app, and the data read from them: accounts, balances, payment history, inquiries, public records, personal information and scores.

Documents

Files uploaded to support a dispute or an identity theft block: government ID, proof of address, FTC identity theft reports, police reports, letters from bureaus and creditors, proof of payment, and similar. A copy of a Social Security card is stored only with recorded consent.

Dispute records

Dispute items, letters and their PDFs, mailing dates, certified tracking numbers, outcomes, logged credit scores, notes, tasks and identity theft block requests.

Messages

Messages between a business and its client in the client portal.

Form submissions

What you enter in a business’s intake or sign-up form: name, email, phone, address, date of birth, last four of your SSN, your credit monitoring service, your message, and your consent to email and text messages.

Service agreements

When you e-sign an agreement: the agreement text, your typed name, the time, your IP address and browser details, and a log of each step (viewed, consent to sign electronically, disclosure acknowledged, signed, cancelled). The signed PDF is stored.

Billing

Your plan, subscription status and credit pack purchases. Card details go straight to Stripe. We never see or store your card number.

Technical data

Sign-in session cookies, the server request logs our host keeps (including IP address), error reports, and, if you accept the cookie banner, cookieless page-visit totals and session counts.

Our forms ask only for the last four digits of your Social Security number. A document you upload, such as a Social Security card or a credit report, may show the full number. We store the file as uploaded, and the AI that reads reports is instructed never to pull a Social Security number out of it.

• To run the software: store your file, read your reports, compare the three bureaus, draft letters and PDFs, and track response deadlines.
• To send the email the app needs to send: sign-in and invite emails, agreement links and signed copies, document requests, deadline alerts, and notices to a business’s staff about new leads and messages.
• To bill for plans and credit packs, and to count credits used.
• To keep the app secure, prevent misuse, and find and fix errors.
• To meet legal obligations and keep the records the law expects, such as signed service agreements.

We don’t sell personal information. We don’t use credit file data for advertising, we don’t build marketing profiles from it, and we don’t use your files to train AI models.

When a credit report is uploaded, or someone asks the app to check whether a document supports a dispute (an evidence check), the file’s pages are sent through Vercel’s AI Gateway to Anthropic’s Claude model. It returns the values printed on the page, which we store as structured data. The letter editor’s rewrite tool sends only the text you selected.

The model is instructed to record only what is printed, to leave a value blank rather than guess, and never to output a Social Security number. AI can still misread a page, so every value it returns can be checked against the report, and nothing goes into a letter until a person reviews it.

These companies run parts of Metro2IQ for us. Each gets only what its job needs, under its own terms and security commitments.

Clerk

Sign-in, accounts, sessions, business teams, and subscription billing.

Supabase

The database and the private file storage that hold your file and documents.

Vercel

Hosting, the daily scheduled jobs (overdue-deadline alerts and agreement status updates), the AI Gateway, and cookieless page-visit totals (Web Analytics), only if you accept the cookie banner.

Anthropic

Reads credit report and document pages, through Vercel’s AI Gateway.

Stripe

Payments for subscriptions (through Clerk) and for credit packs.

Resend

Delivers the app’s email.

Sentry

Error monitoring, plus session counts only if you accept the cookie banner. Request bodies, cookies and headers are left out, and consumer data fields are removed before an error report leaves our servers.

Other sharing

• The business working your file. If you’re a business’s client, its staff can see everything in your file.
• A business’s own systems. A business can have Metro2IQ notify its own systems when something happens (a new lead, a new client, a message, a dispute outcome). Those notices carry details such as name, email, phone, message text, creditor and bureau. Once sent, that business’s own policies apply.
• The done-for-you CRM. For the done-for-you service’s leads and clients only, name, email, phone and case progress are also kept in our customer relationship system (BridgeLink, built on HighLevel). No other business’s data goes there.
• Credit bureaus and creditors. Metro2IQ sends them nothing. Letters are printed and mailed by you or the business working your file, and carry whatever is enclosed, such as an ID copy.
• When the law requires it. We disclose information when required by law or valid legal process, or when needed to protect someone’s safety or our legal rights.
• If the company changes hands. If Metro2IQ is merged or sold, your information would move with Metro2IQ and stay covered by this policy.

The app sends email about your file and your account. When a business sends you something through Metro2IQ, it arrives from “[the business] via Metro2IQ”.

Metro2IQ itself doesn’t send text messages. A business’s sign-up form asks for your consent to receive email and text messages from that business. We record your consent with your details and pass it to the business, which sends any texts from its own systems. Message frequency varies, message and data rates may apply, and you can reply STOP at any time to opt out.

We don’t sell, rent or share mobile numbers or text-message consent with third parties or affiliates for their marketing or promotional purposes. Text-message opt-in data and consent are not shared with anyone other than the business you gave consent to and the service providers that run Metro2IQ.

Clerk sets the cookies that keep you signed in and protect your session. They’re required: without them you can’t sign in, so they don’t wait for the cookie banner. The app also keeps three things in your browser’s local storage: a view setting on the dispute screen, your light or dark theme choice, which applies on every page, and your answer to the cookie banner. None of them leaves your browser.

The first time you visit, a banner asks whether we can count your visit. Until you click Accept, none of the counting below runs. If you click Reject, or ignore the banner, it stays off. Your answer is remembered in this browser, and you can change it at any time with the button at the end of this section.

If you accept, we count page visits with Vercel Web Analytics, which comes with our host. It sets no cookies and stores nothing in your browser. It records the page address, the site you came from, your browser, operating system, device type and country, and shows them to us only as totals. It tells one visit from the next with a code made from the request, which is discarded after 24 hours. Before a visit is counted, we strip record numbers and private links (such as an agreement signing link) from the page address, and everything after the “?” except campaign tags. Nothing from your credit file goes to it.

If you accept, Sentry also counts sessions, so we can see how often the app breaks. Each page load sends whether an error happened, your browser type and our app version, under a random code. It carries no page address and nothing from your credit file.

Error reports don’t wait for the banner. Sentry gets one only when something breaks, so we can fix it, and it leaves out request bodies, cookies and headers.

We don’t use advertising cookies, ad trackers or tracking pixels, and we don’t sell or share browsing data. Because there’s no cross-site tracking, there’s nothing for a browser’s Do Not Track signal to switch off.

We keep your information while your account, or the account of the business working your file, is open, until it’s deleted.

Deleting a file

A self-serve user can delete everything from Account, under Your data, with “Delete all my data”. A business can delete a client’s file the same way. Deleting a file permanently removes its reports, disputes, letters, messages and uploaded documents, and removes the stored files from storage.

• Deleting your file doesn’t cancel a subscription. Cancel it first if you don’t want to keep being charged.
• Deleting your file doesn’t close your sign-in account. To close that too, email support@metro2iq.com.

What stays after a deletion

• A deletion record: the name on the file, who deleted it and when, how many of each kind of record were removed, and where the removed files were stored.
• If a service agreement was signed: the signed agreement PDF and its terms, because a signed credit repair contract has to be kept on file.
• Billing records, as long as tax and accounting rules require. Stripe and Clerk keep their own payment records.
• Copies in backups and in our providers’ logs, until they expire on those systems’ normal schedules.

• Everything moves over encrypted connections (HTTPS).
• Reports, documents and letters sit in private storage. A file opens through a link that expires after 60 seconds, issued only to someone allowed to see it.
• Database access rules tie every file to its own account, so one business can’t see another business’s clients.
• Signing and document-request links work only with the token in the email that was sent.
• Error reports leave out request bodies, cookies and headers. Fields for Social Security numbers, dates of birth, account numbers and credentials are removed, and so is any text shaped like a Social Security number.

No system is perfectly secure. If a breach affects your information, we’ll tell you and the business working your file as the law requires.

You can ask to see, correct, download or delete the personal information we hold about you. Self-serve users can correct their details and delete their file in the app. For anything else, email support@metro2iq.com from the address on your account. We’ll confirm it’s you before acting, and answer within the time the law where you live allows.

If a business is working your file, we’ll pass your request to that business and help it respond.

Depending on your state, you may have more rights under its privacy law. We don’t sell personal information or share it for cross-context behavioral advertising, and we won’t treat you differently for using any of these rights.

Your rights with the credit bureaus are separate from all of this. You can get your credit reports free at annualcreditreport.com, and you can dispute inaccurate information with the bureaus yourself at no cost.

Metro2IQ is for adults. It isn’t meant for anyone under 18, and we don’t knowingly collect information from them. If we learn we have, we’ll delete it.

When we change this policy, we’ll update the date at the top. If a change materially affects how we use information we already hold, we’ll tell you in the app or by email before it takes effect.

Questions or requests about your information go to support@metro2iq.com.

By mail: Aesthete Solutions LLC, 1 Mid America Plaza, Suite 300-7056, Oakbrook Terrace, IL 60181.

The rules for using Metro2IQ are in the terms of service.