Privacy Policy

1. What we collect

Account information (your name, email and company), the subcontractor records you create (business names, contact emails, trades), the insurance documents you or your subcontractors upload, and standard usage logs. We collect what the service needs to work — nothing more.

2. How we use it

To run the product: extracting coverage details from certificates with AI, computing compliance status, sending renewal reminder emails to subcontractors on your behalf, and emailing you about your account. We do not sell your data, and we do not use your documents to train AI models.

We also limit how many times an account can be created or a sign-in can fail from one place, so a stolen password list cannot be tried against your account unchecked. That check records the network address and the email address that was tried — both stored only as one-way hashes, which can be counted but not read back — and the records are deleted automatically within 48 hours.

3. Where it lives

Your data is stored on Supabase (Postgres and file storage) with row-level security that isolates each company's records. Uploaded certificates sit in private storage buckets that are never publicly listable. Traffic is encrypted in transit with TLS.

4. Service providers

We rely on a small set of processors to run COI Shield: Supabase (database and file storage), Creem (payments — card details never touch our servers), Anthropic (AI document extraction), Resend (transactional email) and Vercel (application hosting and infrastructure). Each receives only what it needs to perform its function.

5. Retention and deletion

We keep your data while your account is active so your compliance history stays intact. If you cancel, we retain your data so you can return to or export it, and we delete your account and all associated data — certificates, records and logs — when you ask us to.

6. Your rights

You can export your roster to Excel at any time from inside the app, and delete your account and everything in it from Settings — subcontractors, certificates, projects, compliance logs and the uploaded files themselves. Deletion is immediate and cannot be undone, and it cancels any active subscription first so billing stops. You can also reach us to access or correct your data. Subcontractors who receive our reminder emails can ask the general contractor that added them to remove their contact details at any time.

7. Changes and contact

If this policy changes materially we will notify you by email or in the app before the change takes effect. For privacy questions or requests, write to info@coi-shield.com.