Privacy Policy
Last updated: September 2026
This page explains what COI Tracker collects, where it lives, and how we use it. Plain language, no dark patterns.
What we collect
- Your email address (for sign-in, reminders, and replying to feedback you send).
- Optional feedback: your note, its category, and the product or free tool it concerns. These are sent through Resend to our private support inbox. Signed-in dashboard feedback includes your account email; free-tool feedback can be sent anonymously, with an optional email if you want a reply. Feedback text is not sent to product analytics. We temporarily store hashed account or connection identifiers to limit spam.
- Vendor names, emails, certificate types, expiry dates, and optional PDFs — everything you choose to enter.
- Basic usage logs (IP, user agent, request timing) for abuse prevention.
Where it lives
- Database and file storage: Supabase (AWS us-east-1).
- Transactional email: Resend.
- Hosting & logs: Vercel.
- Error monitoring and operational alerts: Sentry — never document contents.
- Product analytics: PostHog — page views and counts, never document contents.
- Model-assisted document reading (VendorReady COI Reader): Anthropic (Claude), United States — used only on the signed-in reader, only when our on-server engines cannot read a PDF, under commercial API terms that do not permit training on your data. The free public reader never sends a document to Anthropic.
How we use it
- To operate the Service: store your data and send reminders / vendor requests you trigger.
- To communicate: occasional product updates and billing emails.
- To prevent abuse: rate limits and security monitoring.
We do not sell your data. We do not run ads.
Model-assisted document reading (VendorReady COI Reader)
The reader tries on-server methods first — the PDF’s native form data, then its positioned text. The free public reader stops there: it never sends a document to an AI provider and stores nothing. On the signed-in reader, if those methods cannot read a PDF, the document may be sent to our AI subprocessor, Anthropic (Claude), in the United States, solely to extract the fields you then review.
- We use Anthropic’s commercial API under terms that do not permit training on your data. Anthropic states that API inputs and outputs are automatically deleted from its backend within 30 days of receipt or generation, longer only where required to enforce its usage policy or by law — see Anthropic’s data retention policy.
- The Reader assists your review — it does not confirm coverage or make a compliance decision. You remain responsible for checking every value against the source document.
- To turn model-assisted reading off for your account, email hello@coitracker.co and we will disable it. With it off, the Reader uses only on-server extraction and declines documents it cannot read rather than guessing. There is no self-serve toggle yet.
- For signed-in reads we keep an extraction record — which engine and model version ran, and the extracted field values with where each one was read from — so you can audit what was read. It is deleted with your account. Anonymous public reads keep nothing.
Free tools and templates
When you request a free asset (like the COI tracking spreadsheet template) or use the free certificate scanner with the email opt-in, we store your email address, the exact consent wording you saw, when you submitted it, and which asset you requested. We use that record to deliver the asset and to prove — to you and to regulators — what you did and did not agree to. We also store the IP address and browser user-agent the request came from, kept as part of that consent proof and to detect abuse of the forms.
- Requesting an asset is transactional: you get that one delivery email. It does not sign you up for anything else.
- Marketing emails (tips, product updates) are sent only if you tick the separate optional checkbox, and every one includes an unsubscribe link. Unsubscribing is recorded and honoured permanently.
- To have your lead record deleted, email privacy@coitracker.co.
Vendor emails
When you click “Request Update” we send the vendor’s email address a message on your behalf, with your email set as the reply-to so replies come back to you directly.
Your rights
Delete your account any time from the dashboard — it removes your files and records immediately. Your vendor list exports to CSV from the dashboard on every plan and each PDF can be downloaded; for a complete export in one go, email privacy@coitracker.co and we’ll respond within 30 days.
Retention
Account data is kept while your account is active. If you delete your account, we remove your records within 30 days (except what law requires us to retain).
Changes
Material changes will be announced by email. This page always shows the current version.
Contact
COI Tracker · 5307 Victoria Drive #1245, Vancouver BC V5P 3V6