Privacy Policy

Last updated: September 19, 2026. Applies to visitors and subscribers in Canada (pages under /ca/ and posts whose address begins with “ca-“, in English and French).

This policy explains what personal information Kredua collects when you visit this website, answer one of our quizzes, subscribe to our emails or contact us; why we collect it; who we share it with; how long we keep it; and the rights you have. It is written to meet the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for residents of Quebec, the Act respecting the protection of personal information in the private sector as amended by Law 25. It is also our identification statement under Canada’s Anti-Spam Legislation (CASL) for the emails we send.

1. Who is responsible for your information

The site is operated by RR Digital (CNPJ ), Rua Balbino Bento da Silva, 02, União dos Palmares/AL, CEP 57800-000, Brazil, under the brand Kredua (“we”, “us”). General contact: [email protected].

Person in charge of the protection of personal information (privacy officer under PIPEDA and Law 25): [email protected]. This is the channel for questions about this policy, for exercising your rights and for reporting a concern.

2. What personal information we collect

  • Information you give us: your name, email address and, only when we ask for it explicitly, your mobile phone number, when you complete a quiz, subscribe to our recommendations or use the contact form. Also the answers you give in a quiz (for example the amount you are looking for, your work situation, your income range or how you rate your credit), which never include your Social Insurance Number, bank details, date of birth or any sensitive information.
  • Information collected automatically: IP address, approximate country and region, device and browser type, pages visited, how you arrived (UTM parameters) and cookie or similar identifiers, as described in section 9.
  • Email interaction: opens, clicks and unsubscribes when you receive our messages.

We do not collect sensitive personal information and we never consult Equifax, TransUnion or any credit file. Whatever you enter on a bank’s or lender’s website when you apply for a product is collected by that institution under its own privacy policy, not by us.

3. Why we collect it

  • To show you the result of a quiz and take you to the review that matches your answers.
  • To send you, with your express consent, emails with product recommendations and educational content, and to measure whether those emails are opened and clicked.
  • To answer your messages and handle requests about your personal information.
  • To operate, secure and improve the site: audience statistics, error detection, protection against abuse.
  • To display advertising and, where you have accepted it, to measure the results of our own advertising campaigns.
  • To meet legal obligations, including keeping proof of consent required by CASL.

We identify these purposes before or at the moment of collection, and we do not use your information for a new purpose without asking you first, unless the law requires or permits it.

4. Consent and how to withdraw it

We rely on your consent. For a quiz, consent is given when you tick the box and press the button after reading the short notice that links here. For marketing emails, consent is express, recorded with the date, time and the page where it was given, as CASL requires. For non-essential cookies and advertising tags, consent is given through the banner, and those technologies stay off until you activate them, as Law 25 requires for Quebec residents.

You can withdraw consent at any time: click “unsubscribe” in any email, change your choice in the cookie banner, or write to the privacy officer. Withdrawal does not affect the lawfulness of what was done before, and we may keep a minimal record (your email on a suppression list) so that we do not contact you again.

5. Quizzes, recommendations and automated processing

Quiz results are produced by simple rules written by our editorial team (for example, “if the person wants cash back, show the cash back card”). They are informational, are not a credit decision, do not create or deny any right and do not involve profiling with legal or similarly significant effects. If we ever introduce a decision based exclusively on automated processing of your personal information, we will tell you at the time, explain the main factors and give you a way to have it reviewed by a person, as Law 25 requires.

6. Who we share your information with

We do not sell personal information. We share it only with:

  • Service providers acting on our instructions: hosting (OVH, data centre in Beauharnois, Quebec), content delivery and security (Cloudflare), email delivery (MailerSend), and the analytics tools that measure how the site is used.
  • Advertising partners (Google, including AdSense and Ad Manager, and Meta) when you have accepted advertising cookies; they may combine what they observe on our site with information from other sites under their own policies.
  • Financial institutions: only what you yourself enter on their site after leaving ours. We do not forward your quiz answers or your email address to any bank or lender.
  • Authorities when the law requires it, and professional advisers under confidentiality.

Every provider is bound by a contract that limits the use of your information to the service it performs and requires appropriate safeguards.

7. Where your information is stored and transfers outside Canada and Quebec

The website and its database are hosted in Canada, in Quebec. However, Kredua is operated from Brazil, our editorial and support team accesses the systems from there, and some providers (email delivery, advertising, analytics) process information in the United States or the European Union. Personal information may therefore be communicated outside Quebec and outside Canada.

Before such a communication we assess the privacy factors involved, including the sensitivity of the information, the purposes, the protection measures and the legal regime of the destination, as Law 25 requires, and we use contractual clauses and technical measures (encryption in transit and at rest, access limited to named people) so that the information receives protection equivalent to what it has here. While abroad, it may be subject to the laws of that jurisdiction.

8. How long we keep it

  • Quiz answers and subscription data: while you are subscribed and for 24 months after your last interaction, then deleted or anonymized.
  • Proof of consent to emails: 3 years after the consent ends, as recommended under CASL.
  • Suppression list (unsubscribed addresses): kept indefinitely so that we honour your choice.
  • Contact messages: 2 years after the last exchange.
  • Technical logs and audience statistics: up to 13 months, then aggregated.

When information is no longer needed for the purposes it was collected for, we destroy it securely or anonymize it under our destruction schedule.

9. Cookies and similar technologies

We use: necessary cookies (session, security, remembering your cookie choice for up to 12 months); first-party measurement (an anonymous visitor identifier for 30 days, a session identifier for 30 minutes and the source of your visit for 24 hours); and, only after you accept them, advertising and measurement tags from Google and Meta. For Quebec residents, technologies that identify, locate or profile you are inactive by default and are activated only by your choice in the banner. You can change your choice at any time through the banner and through your browser settings; blocking necessary cookies may prevent parts of the site from working.

10. Email communications (CASL)

We send commercial electronic messages only to people who gave express consent. Every message identifies Kredua and RR Digital, gives a mailing address and a contact email, and includes an unsubscribe mechanism that works with one click and is processed within 24 hours. We keep a record of each consent. If you believe you received a message from us without consent, write to the privacy officer or file a complaint with the CRTC.

11. Security and confidentiality incidents

We protect personal information with measures proportionate to its sensitivity: encrypted connections, restricted and logged access, separate environments, regular backups and provider contracts. No system is infallible. If a confidentiality incident presents a risk of serious injury to you, we will notify the Commission d’accès à l’information du Québec and the Office of the Privacy Commissioner of Canada, notify you, and record the incident in our register, as the law requires.

12. Your rights

  • Access: know whether we hold information about you, obtain a copy and learn how it is used and with whom it is shared.
  • Correction: have inaccurate, incomplete or ambiguous information rectified.
  • Withdrawal of consent and, where applicable, deletion or de-indexing of your information.
  • Portability (Quebec): receive the computerized personal information you provided in a structured, commonly used format, or have it sent to another organization.
  • Information on automated decisions (Quebec), if any are ever used.
  • Complaint: with us first, then with the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.

To exercise a right, write to [email protected] from the email address you registered, or from another address with enough information to identify you. We answer in writing within 30 days, free of charge, and we explain any refusal with the legal reason and the recourse available.

13. Minors

The site is intended for adults. We do not knowingly collect personal information from anyone under 18 and, in Quebec, never from a person under 14 without the consent of a parent or guardian. If you believe a minor has given us information, write to the privacy officer and we will delete it.

14. Changes to this policy

We may update this policy when our practices or the law change. The date at the top shows the last revision; material changes are announced on the site and, for subscribers, by email. Continued use of the site after a change means you accept the updated policy, without affecting your right to withdraw consent.

15. Contact

Person in charge of the protection of personal information: [email protected]. General contact: [email protected]. Postal address: RR Digital (CNPJ ), Rua Balbino Bento da Silva, 02, União dos Palmares/AL, CEP 57800-000, Brazil.

Résumé en français (Québec)

Kredua, marque de RR Digital (Brésil), exploite ce site d’information sur les cartes de crédit, les prêts et les finances personnelles. Nous recueillons votre nom, votre courriel et vos réponses aux questionnaires uniquement avec votre consentement, pour vous montrer une recommandation et, si vous l’acceptez expressément, vous envoyer des courriels que vous pouvez cesser en un clic. Nous ne consultons jamais votre dossier de crédit et ne vendons pas vos renseignements. Les données sont hébergées au Québec, mais elles peuvent être communiquées à l’extérieur du Québec et du Canada (équipe au Brésil, fournisseurs de courriel et de publicité), après évaluation des facteurs relatifs à la vie privée, conformément à la Loi 25. Les témoins non essentiels sont désactivés par défaut. Vous pouvez accéder à vos renseignements, les faire rectifier, retirer votre consentement, demander leur suppression ou leur portabilité, et porter plainte à la Commission d’accès à l’information. Responsable de la protection des renseignements personnels : [email protected]. Réponse dans les 30 jours.

Last updated: 19/09/2026