Privacy policy

Plain-English summary

We collect the minimum information we need to verify COIs and run the business. We don't sell your data, we don't share it with advertisers, and we don't train AI models on your customers' insurance information.

What we collect

• Account information: name, email address, company name, role. Provided when you sign up or join the waitlist.
• Uploaded COIs and metadata: the PDFs you upload to verify, and the structured data we extract from them.
• Usage data: page views, feature usage, and performance metrics, collected via PostHog. Used to improve the product.
• Billing information:processed by Stripe. We don't store your card details on our servers.

How we use it

• To verify COIs and return verdicts.
• To send service emails (alerts, billing, account changes).
• To improve the product based on aggregate usage patterns.
• To respond to support requests.

What we don't do

• We don't sell your data to anyone.
• We don't share it with advertisers or data brokers.
• We don't use your customers' COI content to train third-party AI models.
• We don't track you across the web with marketing pixels.

Where the data lives

On our application database (encrypted at rest), in S3-compatible object storage for uploaded PDFs (encrypted at rest and in transit), and at sub-processors we trust: Stripe (billing), PostHog (analytics), Resend or Postmark (email delivery).

Your rights

You can request a copy of your data, request deletion, or opt out of analytics at any time by emailing hello@coiverify.com. We honor these within 30 days.

Security

SOC 2 Type II is in progress. Until certified, we follow SOC 2 controls in practice: encrypted data at rest and in transit, principle of least privilege for employee access, an audit log for every customer data action, and breach disclosure within 72 hours.

Updates to this policy

We'll email you about material changes. The current version is always at /privacy with the last-updated date at the top.

Contact

Questions? hello@coiverify.com.