Legal

Privacy policy

Complaint History is built to know as little about you as possible. There are no accounts, your IP address is never stored, and our software masks account numbers and other personal details in what people post.

This policy explains how XTO Pty Ltd (ACN 702 801 410) ("Complaint History", "we", "us") handles information on complainthistory.com. We are based in Australia and comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Our site is written for consumers in the United States, and we also respect the privacy rights that US state laws give their residents.

The complaint records we show

Most of what you see on Complaint History comes from public records of consumer complaints about financial companies. They are published by their source with consumers' names and contact details removed, and we do not add any personal information to them. Our terms explain where the records come from and their limits.

The rest is what visitors post here: experiences, comments, replies and poll answers, described below.

What we collect

Experiences you share: the company, the type of product or issue, a title and your story, your answer to "did they fix it?", and, if you choose to give them, a nickname and your US state. Everything you submit in an experience, other than the visitor code below, is published on the site.
Comments and replies: the text you write and, if you give one, a nickname. These are published.
Poll answers and flags: when you vote in a "did they fix it?" poll or flag a post, we record your choice with the visitor code, not with your identity. Poll results are shown only as totals.
A one-way visitor code: a keyed hash (HMAC) of your IP address, stored with posts, poll answers and flags so we can limit floods of posts, stop duplicates and allow one vote per visitor. It is made with a secret key and can't practically be turned back into your IP address. Your IP address itself is never stored by us.
Contact messages: what you send through the contact form, including your name and email address if you give them.
Server logs: our hosting provider keeps standard technical logs, which can include IP addresses, browser type and the pages requested, for a limited time for security and troubleshooting. We don't use them to identify visitors.

What we never ask for

No accounts, passwords, real names, Social Security numbers, account or card numbers, payment details or precise location. You don't need to tell us who you are to read the site or to post. Please don't include this kind of information in anything you post.

How posts are moderated

Nobody reads a post before it goes live. Instead, our software checks each experience, comment and reply automatically:

it masks personal and financial details it detects, such as email addresses, phone numbers, card numbers, bank account numbers and other long identification numbers, before the post is shown;
it "defangs" links, so web addresses are shown as plain text and can't be clicked;
it gives each post a spam score, and holds back posts that look like spam or advertising so they are not shown;
it limits how many posts and votes can come from one visitor code in a short time.

Automatic masking is good but not perfect, so please check what you write. Readers can flag a post that breaks the rules, and enough flags hide it automatically. We can also hold, edit to remove personal information, or remove posts ourselves.

Personal information inside posts

Posts are about companies and how they handled problems, not about individual people. Please don't include your own or anyone else's full name, home address, phone number, email address, account, card, loan or Social Security numbers, or the names of individual employees. Posts are public, and anyone, including the company you write about, can read them.

An experience about your own finances can still reveal something personal, such as a debt, a dispute or a hardship. Use a nickname rather than your real name, and leave out details that would let someone identify you if you would rather they couldn't.

If a post contains personal information about you, ask us to remove or correct it and tell us which post you mean.

Browser storage and cookies

Complaint History itself sets no tracking cookies. It uses your browser's local storage to remember your light or dark theme choice on your device only. You can clear it at any time in your browser settings. A sign-in cookie is used only by the site operator for the administration area; ordinary visitors never receive it.

Analytics and advertising

If analytics is enabled, we use Google Analytics to understand how many people visit and which pages are useful. If advertising is enabled, Google AdSense shows ads and may use cookies to measure and personalize them. In either case Google may set cookies and process information such as your device, approximate location and browsing activity, under its own privacy policy; see how Google uses information from sites that use its services. You can control ad personalization at adssettings.google.com, and you can block or delete cookies in your browser. We don't give Google, or any advertiser, the content of contact messages or anything that identifies you.

How we use information

to publish the experiences, comments, replies and poll results people post;
to keep the site free of spam, floods and vote manipulation;
to answer contact messages and handle removal and correction requests;
to keep the site secure, fix problems and understand which pages are useful.

We don't use what you post to make decisions about you, and we don't build profiles of visitors.

How long we keep things

Published experiences, comments and replies: until they are removed, through a request or by us.
Posts held back as likely spam: deleted automatically after 30 days.
Poll answers and flags: as long as the post they belong to.
Visitor codes: stored only with the posts, votes and flags above, and deleted with them.
Contact messages: as long as needed to deal with them and keep a record of requests.
Server logs: for a limited period set by our hosting provider.

Disclosure

We don't sell personal information. Published posts are public by design, and anyone can read, quote or link to them. We use service providers, such as our hosting provider and, if enabled, Google, to run the site. We don't pass posts or contact messages to the companies listed on the site, and we don't forward complaints. We may disclose information if the law requires it, for example in response to a valid court order, or to protect the safety of a person.

Overseas

We are in Australia, and our service providers may process information in other countries, including the United States. By using the site you understand that information may be handled outside the country you live in.

Your privacy rights

Wherever you live, you can ask us to:

tell you what information we hold that relates to you;
correct it if it is wrong;
delete it, including an experience, comment or reply you posted.

Residents of US states with consumer privacy laws, such as California, Colorado, Connecticut, Virginia and others, may have specific rights to know, access, correct and delete personal information and to opt out of its sale, of "sharing" for cross-context behavioral advertising, and of targeted advertising. We don't sell personal information. If personalized Google ads are enabled, you can opt out of them through Google's ad settings or by blocking cookies, and you can also ask us through the contact form. We honor these requests whether or not the law in your state requires it, and we won't treat you differently for making one.

Australians have rights under the Australian Privacy Principles, including access and correction.

To make a request, use the contact form. Because we hold so little, we usually can't link a post to you, so tell us which post you mean, for example by copying its title or link, and roughly when you posted it. If you're not satisfied with our response you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in the US, to your state attorney general or privacy regulator.

Children

Complaint History is a general information site for adults dealing with financial companies and is not directed at children under 13. We don't knowingly collect personal information from children. If you believe a child has posted personal information, contact us and we will remove it.

Security

We keep what we hold to a minimum, use encrypted connections (HTTPS), and limit access to the administration area. No website is perfectly secure, which is another reason not to post sensitive details.

Changes

We may update this policy as the site changes. The version on this page is the current one.