Privacy Policy

This page explains what COI Tracker collects, where it lives, and how we use it. Plain language, no dark patterns.

What we collect

• Your email address (for sign-in and reminders).
• Vendor names, emails, certificate types, expiry dates, and optional PDFs — everything you choose to enter.
• Basic usage logs (IP, user agent, request timing) for abuse prevention.

Where it lives

• Database and file storage: Supabase (AWS us-east-1).
• Transactional email: Resend.
• Hosting & logs: Vercel.
• AI document processing (VendorReady COI Reader, beta): Anthropic (Claude), United States — used only when you upload a certificate for AI-assisted reading, under commercial API terms that prohibit training on your data.

How we use it

• To operate the Service: store your data and send reminders / vendor requests you trigger.
• To communicate: occasional product updates and billing emails.
• To prevent abuse: rate limits and security monitoring.

We do not sell your data. We do not run ads.

AI document processing (VendorReady COI Reader — beta)

The VendorReady COI Reader is a beta feature. When you use it to read a certificate, the document is sent to our AI subprocessor, Anthropic (Claude), in the United States, solely to extract the fields you then review.

• We use Anthropic’s commercial API under terms that prohibit training on your data; documents are retained only transiently to process the request.
• The Reader assists your review — it does not confirm coverage or make a compliance decision. You remain responsible for checking every value against the source document.
• You can disable AI processing for your account. With AI off, the Reader uses only on-server extraction, and declines to read documents it cannot process without AI rather than guessing.
• We log which model and version processed each document, so you have an audit trail.

Free tools and templates

When you request a free asset (like the COI tracking spreadsheet template) or use the free certificate scanner with the email opt-in, we store your email address, the exact consent wording you saw, when you submitted it, and which asset you requested. We use that record to deliver the asset and to prove — to you and to regulators — what you did and did not agree to.

• Requesting an asset is transactional: you get that one delivery email. It does not sign you up for anything else.
• Marketing emails (tips, product updates) are sent only if you tick the separate optional checkbox, and every one includes an unsubscribe link. Unsubscribing is recorded and honoured permanently.
• To have your lead record deleted, email privacy@coitracker.co.

Vendor emails

When you click “Request Update” we send the vendor’s email address a message on your behalf, with your email set as the reply-to so replies come back to you directly.

Your rights

You can export or delete all your data at any time. Email privacy@coitracker.co and we’ll respond within 30 days.

Retention

Account data is kept while your account is active. If you delete your account, we remove your records within 30 days (except what law requires us to retain).

Changes

Material changes will be announced by email. This page always shows the current version.

Contact

privacy@coitracker.co

COI Tracker · 5307 Victoria Drive #1245, Vancouver BC V5P 3V6