COI Tracker

Privacy policy

Last updated [DATE]

COI Tracker is operated by [COMPANY LEGAL NAME], [ADDRESS] (“we”). This policy explains what we collect when you use COI Tracker, why, and what you can do about it. Contact: [PRIVACY EMAIL].

What we collect

  • Account data: your name, email address and a hash of your password (never the password itself).
  • Workspace data: the certificates of insurance you or your vendors upload (the PDF files and the values read from them), vendor names and contact emails, insurance requirements, reminder settings and history.
  • Usage data: sign-in sessions (IP address and browser), and server logs kept for security.
  • Billing data: handled by our payment provider; we receive your subscription status, not your card.

Why

To provide the service you signed up for: storing and reading certificates, sending the reminders and requests you ask for, and billing. We do not sell personal data and do not use it for advertising.

Who processes it for us

  • [HOSTING PROVIDER], [COUNTRY] — servers where the application, database and files live.
  • [EMAIL PROVIDER] — delivers account, reminder and request emails.
  • OpenAI — when AI reading is used, the certificate’s text (or, for a scan, the PDF) is sent to be read. Requests are made with storage disabled.
  • Lemon Squeezy — merchant of record for subscriptions and payments.

How long we keep it

For as long as your workspace exists. Deleting a workspace deletes its certificates, files and history immediately; deleting your account deletes the workspaces you own alone. Backups are kept for up to [14] days, after which deleted data is gone from them too. Demo workspaces are deleted after 72 hours.

Your rights

You can see, correct and delete your data from within the product, or ask us at [PRIVACY EMAIL] to access, export, correct or delete it. Depending on where you live (for example under the GDPR or the CCPA) you may have further rights, including to object and to complain to a data protection authority.

Security

Data is encrypted in transit (HTTPS). Each workspace is isolated from every other at the database level, files are stored privately, and passwords are hashed.