Independent • Not for sale For Agencies

Privacy policy

Last updated: September 30, 2026

Debt Collection Index collects almost nothing from people who read the site: no accounts, no cookies and no tracking, only cookieless counts that identify nobody. We collect more from companies that claim their page with a company account: the name, role and work email of the person acting for the company, what they tell us about the company, and any images or documents they upload. Signing in to a company account sets two cookies, both needed only to keep you signed in. We do not sell or share personal information, and we never use it for advertising. The detail is below.

Who we are

Debt Collection Index LLC runs debtcollectionindex.com and account.debtcollectionindex.com. Our registered address is 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, United States. For anything about your information, write to corrections@debtcollectionindex.com with "Privacy" in the subject.

If you read the site

No account, no form and no cookie is needed to read any page. We use Cloudflare Web Analytics, a cookieless service from our hosting provider, to count page views and referring sites. It sets no cookies, stores nothing in your browser, and does not follow you across sites or identify you.

We also keep two counts of our own, on our hosting provider's servers. Neither sets a cookie, neither can identify you, and neither follows you to another site. The first records, when a visit arrives with a tracking tag in the address (the utm_source a search or answer engine adds), that tag, the page you landed on, and the website you came from. The second records, when someone clicks one of our outbound links, which link was clicked, which agency it related to, and the two-letter country your request came from.

Like every website host, Cloudflare processes technical request data, such as your IP address, to deliver and protect the site, under its own privacy terms. We do not keep your IP address.

If you used our claim form

From 17 to 30 September 2026, a company's staff could claim its page with a claim form. The form is now closed: pages are claimed by signing in to a company account (below). The form collected:

  • your name, your role and your work email at the company's own website domain;
  • what you tell us about the company: how it works, its licenses, memberships and certifications, and any corrections you send;
  • images you choose to upload (a logo, photos);
  • if you give them, a named contact for new business, their email and phone, and a founder's or leader's name.

We used this to confirm you worked for the company (we emailed a six-digit code to your work address), to check the facts, and to publish them on the company's page. To stop the form being used to send codes in bulk, we kept your email address, your company's domain and your connection's address only in a scrambled, one-way form (a keyed hash) that cannot be turned back into the original, and only for two days.

What we publish from it: facts about the company, labeled as supplied by the company or as checked by us. We publish a person's name only where you ticked the box saying that person agrees. A new-business email given through the form stays private: we use it only to pass on inquiries. A phone number for new business is shown on the page if you gave one.

Submissions reached us by email. They were sent through Resend, our email service, and are held in our company mailbox, which is hosted by Google.

If you hold a company account

Company accounts at account.debtcollectionindex.com let a company's staff sign in and keep its page current, and are now the only way to claim a page. What a company adds through its account goes on its page; we do not ask for anything to keep to ourselves, apart from what it takes to sign in and run the account. An account holds:

  • the work email and role (owner or editor) of each person on the account;
  • invitations an owner sends to colleagues at the same company;
  • a record of what was done on the account and when (signing in, invitations, changes, and the email addresses involved), which cannot be edited, with your connection's address kept only as a keyed hash;
  • what you tell us about how the company works, and every earlier version of it. This includes a founder's or chief executive's name and role, published only when you tick the box saying they agree, links to the company's own social media profiles and to its listing in a vendor's partner directory, all shown on the page;
  • the clients a company says it collects for, published only when you tick the box saying every client listed has agreed to be named. A client that asks us to take its name off is removed;
  • your logo and photos, if you upload them. Each is scanned for malware and re-saved without hidden data such as a photo's location. We keep them now and do not show them on the page yet;
  • corrections you send us ("Is anything on your page wrong?"), which we also email to our own inbox so we can re-read the public record. Nothing on the page changes until we have checked;
  • facts about the company's record you ask us to add, such as a membership, a certification or a state registration number, and the result of checking them;
  • every detail given with a membership, certification, insurance, bond or award (such as a member, certificate or bond number, the insurer, an amount or the auditor), which is shown on the page with it;
  • documents you upload as proof, such as a membership certificate or a certificate of insurance (see below), which readers of the page can open;
  • if an owner sets one, a contact email for new business, at the company's own domain and confirmed by a code sent to it. It appears on the page 24 hours after it is confirmed.

Checks we run automatically. To check a fact you add, we look it up in the public record of the body that issued it: for example a state's business records, or a trade body's published list. If your company's website does not let our systems read it, you can prove the domain is yours with a DNS record, and we then read your domain's public DNS and registration records. Once a week we read your company's public website to see whether you have placed the badge, if your page has one. When the filings shown on your page change, we email the account's owners.

Documents you upload are checked for malware inside our own hosting account before anything else is done with them, and pictures are saved again without the hidden data some cameras add, such as location. While the fact a document backs is on the company's page, anyone reading the page can open it, labeled as supplied by the company and not confirmed with its issuer; it is not listed by search engines. Upload only what you are happy to show, and never a consumer's or debtor's personal information.

Company accounts are also covered by our company account terms. There are no passwords. You sign in with a six-digit code we email to your work address. The code itself is never stored; we keep only a keyed hash of it, and it stops working after 10 minutes.

Cookies

debtcollectionindex.com sets no cookies. The company account site sets two, and only when you sign in. Both are strictly necessary: the sign-in cannot work without them. Neither is used for tracking, analytics or advertising, and neither can be read by any other website.

  • __Host-dcip_b: ties a sign-in code to the browser that asked for it, so a code read out to someone else is useless to them. Lasts 15 minutes.
  • __Host-dcip_s: keeps you signed in. It ends when you sign out, after 12 hours without use, and after 7 days at most.

Because we use only these, we do not show a cookie banner. If we ever add any other cookie, this policy will change first, and we will ask before setting any cookie that is not strictly necessary.

What we publish about agencies

Agency pages contain business information from public records: licensing and bond filings, certifications, complaint statistics and regulators' enforcement actions. We publish facts about companies, not private individuals. We do not publish consumer complaint narratives or any debtor's personal information.

These pages are an independent record, built from public sources, so they are not removed at a company's request, whether or not the company has claimed its page. If a fact is wrong, tell us under our corrections policy: we check it against its source and correct it if the record supports the change.

Who processes it for us

  • Cloudflare: hosting, the databases behind the claim form and company accounts, private storage for uploaded documents and encrypted backups, the malware check on uploads, the cookieless counts above, and our email addresses.
  • Resend: sending our emails, including sign-in codes.
  • Google: our company mailbox, where claim and correction emails arrive.

Each works under its own terms and security commitments. We do not sell personal information, we do not share it for advertising, and we do not let anyone else use it for their own purposes. Because we never sell or share it, there is nothing to opt out of, but a Global Privacy Control signal from your browser is respected in the same way.

Where it is held

Our service providers store and process information in the United States and in the other countries where they operate. Sending your information to these providers is necessary to provide the claim form and company accounts that you asked to use.

How long we keep it

  • Sign-in and claim codes, and the scrambled email, domain and connection records beside them: deleted automatically after 2 days.
  • Claim form submissions, corrections and uploaded images: kept while the company's page is listed, as the record behind what we publish. We delete them within 12 months after the page stops being listed, or sooner if you ask. This is done by hand, not automatically.
  • Company account details: for as long as the account exists. When a person leaves an account or it is closed, their email is erased from the account within 30 days (it stays in the record of actions below).
  • Documents uploaded as proof: kept while the fact they prove is on the company's page, then deleted automatically 90 days after it comes down. A document that is refused, or that fails the malware check, is deleted automatically after 30 days.
  • The new-business inquiry contact: kept until an owner removes or replaces it; then deleted automatically within 30 days.
  • The public contact email: shown until an owner removes or replaces it; then taken off the page, usually within the hour, and deleted automatically within 30 days.
  • Logos and photos uploaded through an account: kept while the account keeps them. One that is removed or replaced, or that fails the malware check, is deleted automatically after 30 days.
  • Corrections sent through an account: deleted automatically a year after we have dealt with them.
  • Encrypted backups of company account data: one a day, each deleted automatically after 35 days. Sign-in codes and sessions are never included.
  • Invitations: deleted within 30 days after they are accepted, withdrawn or expire.
  • Sessions: deleted within 30 days after they end.
  • The record of actions on an account: for the life of the account and 2 years after, so a dispute about a published fact can be answered. Connection addresses in it are hashed.
  • The cookieless counts: our own two counts are kept for three months; Cloudflare Web Analytics keeps its page-view figures for six months.

How we protect it

Codes, sessions and connection addresses are stored only as keyed hashes. Uploaded documents are checked for malware, and stored where only the file behind a published fact can be opened; backups are encrypted. The company account site loads no third-party scripts, and every page that handles your information blocks framing and caching. Our hosting and code accounts are protected by two-step sign-in. If a breach ever puts your information at risk, we will tell you and the relevant regulator as soon as reasonably possible, as the law requires.

Your rights

Wherever you live, you can ask us to tell you what personal information we hold about you and give you a copy, correct it, delete it, stop using it, or withdraw a consent you gave (for example, to your name being shown). Write to corrections@debtcollectionindex.com from the address the information relates to, or tell us how to confirm it is you. We reply within 30 days and never charge for it.

These rights cover information about you as a person that you, or your company, gave us: through the claim form or a company account, such as your name, your email, and anything you asked us to publish. If you delete something you supplied, what it backed on the page comes down. They do not cover a company's page itself, which is built from public records (see "What we publish about agencies" above). We do not remove a page, or a fact taken from a public record, because it is asked for.

If you are unhappy with our answer, you can complain to your state's attorney general.

Children

This site is for adults and businesses. We do not knowingly collect information from anyone under 18.

Changes

If we change what we collect, how long we keep it, or add any cookie or measurement not described here, this policy is updated first, and the date at the top changes.