1. Overview and Scope
This Privacy Policy explains how EvidencePair LLC ("COIScreen", "we", "us") collects, uses, retains, and protects information when you visit coiscreen.com, join our launch list, use our free ACORD 25 checker, sign in to the COIScreen dashboard, or upload documents through a vendor or broker portal.
2. Information We Collect
Account and Organization Data: When you create an account, we collect your name, work email address, authentication metadata, organization name, time zone, billing status, and Terms acceptance record (version, timestamp, and IP address).
Customer-Uploaded Documents and Third-Party Contact Details: We process ACORD 25 certificates of insurance, endorsement pages, commercial leases, and W-9 forms uploaded by customers, vendors, or brokers, together with vendor and insurance producer names, email addresses, and phone numbers.
W-9 Tax Identification Numbers (TINs): When W-9 tracking is enabled on Pro or Business plans, we extract only the last 4 digits for display and encrypt the full 9-digit SSN or EIN using AES-256-GCM before storing it.
Vendor-Entered Mobile Numbers and SMS Consent: When a vendor voluntarily enters a mobile phone number and ticks the SMS opt-in checkbox in the portal, we record the number, consent timestamp, and IP address solely to send certificate renewal reminders.
Launch List Sign-Ups: When you submit our pre-launch form and click the confirmation link, your email address, role, and first-touch source are stored as a Resend contact in our launch-list segment to receive product launch updates until you unsubscribe.
Usage Analytics and Attribution: We collect product interaction events and Core Web Vitals via PostHog, and store first-touch UTM tags, referrer hostname, and landing path in the first-party cookie cs_src.
3. How We Use Information
We use collected information solely to: (a) extract data from uploaded insurance certificates, W-9s, and leases and evaluate them against customer requirement templates; (b) send certificate requests, discrepancy notices, and scheduled renewal reminders at the customer’s instruction; (c) process subscription and add-on payments via Stripe; (d) maintain append-only audit logs for customer accountability; and (e) monitor reliability, security, and performance.
Mobile Numbers and SMS Data Non-Sharing Statement: Mobile phone numbers and SMS opt-in consent data collected through COIScreen are never sold, rented, or shared with any third parties or affiliates for their marketing or promotional purposes.
5. Data Retention Schedule
Unclaimed anonymous lead-magnet uploads and results are automatically purged 24 hours after upload. Unroutable inbound email attachments are deleted after 7 days. Bulk import ZIP archives are deleted as soon as the import job finishes.
Certificates, W-9s, extractions, evaluations, and audit events belonging to an active organization are retained for the life of the organization. Notification logs are retained for 2 years. When an owner deletes an organization, access is blocked immediately and all database rows and storage objects are permanently purged 30 days later. Database backups are retained for 7 days on Supabase.
6. Security Measures
All traffic is encrypted in transit via TLS (HSTS preload). Database tables and private object storage buckets are encrypted at rest by Supabase and isolated per organization with Postgres Row Level Security (RLS).
Portal, broker, status feed, and team invitation tokens are generated with 256 bits of entropy and stored only as SHA-256 hashes. W-9 tax IDs and outbound webhook secrets are encrypted at rest with AES-256-GCM using a versioned key prefix. Uploaded PDFs are served only via short-lived signed URLs on the storage origin. Application logs and error reports automatically redact portal tokens, feed tokens, and 9-digit numbers.
7. Subprocessors
We use the following subprocessors to operate COIScreen: Vercel (application hosting and edge network), Supabase (Postgres database, authentication, and private object storage in us-east-1), Anthropic (Claude API for optical document extraction, with zero data training on API inputs), Inngest (background job orchestration), Resend (transactional email delivery, inbound email routing, and launch-list contact storage), Twilio (toll-free SMS delivery for opted-in vendors), Stripe (subscription and payment processing), Cloudflare (Turnstile bot protection), Porkbun and Apple iCloud Mail (domain forwarding and support mailbox), Upstash (Redis rate limiting and short-lived confirmation tokens), Sentry (error monitoring), and PostHog (product analytics).
All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties.
8. California Privacy Rights (CCPA / CPRA)
California residents have the right to request to know the categories and specific pieces of personal information we have collected, the right to request deletion of personal information, and the right to request correction of inaccurate personal information, subject to statutory exceptions.
COIScreen does NOT sell personal information and does NOT share personal information for cross-context behavioral advertising. To exercise your privacy rights, contact us through your organization dashboard or by mail at the address below.
9. Children’s Data, Changes, and Contact
COIScreen is a business-to-business service and does not knowingly collect personal information from children under 16.
We may update this Privacy Policy periodically and will post the revised date on this page. Contact EvidencePair LLC regarding privacy requests through the customer dashboard or by mail at 109 W Cota St, Santa Barbara, CA 93101.