Privacy Policy

Effective date: August 21, 2026 · Last updated: August 21, 2026

The short version: COI Manager collects information you give us to provide the service. We don't sell your data. We use a small number of trusted third-party services to run the platform. You can request access to or deletion of your data at any time by emailing support@coimanager.com.

This Privacy Policy explains how COI Manager ("we," "us," or "our") collects, uses, and protects information when you use our software-as-a-service platform at coimanager.com (the "Service"). By using the Service, you agree to the collection and use of information as described here.

1. Information We Collect

Account Information

When you create an account, we collect:

Your name, email address, and password (stored as a hashed value — we never store your plain-text password)
Your company name, business address, and phone number
Your job title, industry, and company size (collected during onboarding)
The date and time you agreed to our Terms of Service

Vendor Data

To use the Service, you enter information about your vendors and contractors, including:

Vendor or company name
Contact name and email address
Phone number and address (if provided)

This information is used solely to send COI requests on your behalf and to track compliance within your account.

Uploaded Documents

The Service allows you and your vendors to upload certificates of insurance (COIs) and W-9 forms. These documents may contain sensitive business and tax information. We store them securely in your account and use them only to provide the tracking and compliance features of the Service.

Payment Information

We use Stripe to process subscription payments. When you subscribe, your payment details (card number, billing address) are entered directly into Stripe's interface and are never transmitted to or stored on our servers. We receive only a Stripe customer ID and subscription status. Stripe's privacy policy is available at stripe.com/privacy.

Usage and Log Data

We automatically collect certain technical information when you use the Service, including:

IP address and browser type
Pages visited and actions taken within the Service
Date and time of requests
Error logs and performance data

This data is used to operate, maintain, and improve the Service.

2. How We Use Your Information

We use the information we collect to:

Create and manage your account
Send COI and W-9 requests to your vendors on your behalf
Process subscription payments through Stripe
Generate compliance reports and expiration alerts
Respond to your support requests
Send service-related notices (account activity, billing, expiration alerts)
Detect and prevent fraud or abuse
Improve the Service through anonymized usage analysis

We do not use your data for advertising and we do not sell your data to third parties.

3. How We Share Your Information

We share your information only in the following limited circumstances:

Service Providers

We use a small number of trusted third-party services to operate the platform:

Stripe — payment processing. Privacy policy →
Resend — transactional email delivery (COI requests, password resets, compliance reports). Privacy policy →
Railway — cloud hosting for our application and database. Privacy policy →
Anthropic / OpenAI — AI document analysis for COI and W-9 extraction. Document content may be sent to the AI provider's API for processing. Document data is not used to train AI models under our service agreements.

These providers have access to your information only as needed to perform their services and are contractually obligated to protect it.

Legal Requirements

We may disclose your information if required to do so by law, court order, or government authority, or if we believe disclosure is necessary to protect the rights, property, or safety of COI Manager, our users, or the public.

Business Transfers

If COI Manager is acquired, merged, or sold, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Service before your data is transferred and becomes subject to a different privacy policy.

4. Data Retention

We retain your account information and uploaded documents for as long as your account is active. If you cancel your subscription, we retain your data for 30 days to allow for account recovery, after which it is permanently deleted. You may request earlier deletion at any time by contacting us at support@coimanager.com.

Log and usage data is retained for up to 90 days and then deleted.

5. Data Security

We implement reasonable technical and organizational measures to protect your data, including:

Passwords stored as bcrypt hashes — never in plain text
All data transmitted over HTTPS/TLS
Database access restricted to application servers
JWT-based authentication with session invalidation on password change

No system is completely secure. We cannot guarantee that unauthorized parties will never be able to defeat our security measures. If you believe your account has been compromised, contact us immediately at support@coimanager.com.

6. Your Rights and Choices

You have the following rights regarding your personal information:

Access — you can view and edit most of your account information from the Company Profile and Settings pages.
Correction — you can update your account details at any time from within the Service.
Deletion — you can request deletion of your account and all associated data by emailing support@coimanager.com. We will process deletion requests within 30 days.
Data export — you may request a copy of your data by contacting support before your account is deleted.
Opt-out of non-essential emails — you can adjust email notification preferences in your account settings. Note that transactional emails (billing receipts, password resets) cannot be opted out of while your account is active.

7. Vendor Data and Your Responsibilities

When you use COI Manager to collect and store information about your vendors, you are acting as the data controller for that vendor data. You are responsible for having a lawful basis to collect and store your vendors' contact information and for notifying them that their data is being processed. COI Manager acts as a data processor on your behalf for this data.

8. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child without parental consent, we will delete it promptly.

9. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete your personal information, and the right to opt out of the sale of your personal information. We do not sell personal information. To exercise your rights, contact us at support@coimanager.com.

10. International Users

COI Manager is operated from the United States. If you are accessing the Service from outside the US, your information will be transferred to and processed in the US. By using the Service, you consent to this transfer. We make no representation that the Service is appropriate or available for use in all locations.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice within the Service at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact us at:

Email: support@coimanager.com
Website: coimanager.com