Privacy Policy
Last updated November 2, 2026
What we collect
- Account details: your name, email address and organization settings.
- Vendor details: the names and email addresses you or your vendors give us.
- Documents and email: the certificates, endorsements and messages sent to your intake addresses, and what we read from them.
- Billing state: your plan and subscription status. Paddle holds your payment details; we never see them.
- Free checker: the files you upload, and an email address if you choose to give one. We keep a daily hash of your IP address and browser to enforce the limit, never the address itself.
- Practice Program applications: your firm name, email address, website or LinkedIn address, practice type and client count, and the invites you send or accept to a workspace.
- Support chats and tickets: what you type into the assistant, its answers, the page you were on, any email address you give, and our replies. Our support staff can read them, so please leave out policy numbers and certificate contents.
How we use it
To read your documents, compare them with your requirements, send the email you have configured, bill you and keep the service secure. We do not sell your data. If a free-checker visitor asks to save a report or start a trial, we use that address for that and nothing else.
Where the law requires a legal basis, ours are performing our contract with you, our legitimate interests in running and securing the service, and your consent where we ask for it. Customers decide what they upload about their vendors, and we process those records on their behalf.
Cookies and security
We use cookies only to keep you signed in, to remember whether you are viewing the live demo, and, once you write to support, to keep your chat in that browser so our reply can reach you. Cloudflare Turnstile on the free checker may set its own to tell people from bots. Documents are stored in private storage, sent over encrypted connections and available only through access controls per account.
Who processes it for us
- Supabase: database, sign-in and file storage
- Vercel: application hosting
- Inngest: background jobs
- Postmark: sending and receiving email
- Anthropic: reading documents that can't be read from the PDF alone
- Paddle: checkout and billing, as merchant of record
- Cloudflare: Turnstile bot protection on the free checker
How long we keep it
- Raw inbound email: 90 days. The message's log entry stays with your account.
- Free checker files: about 24 hours. A report saved with an email address: 30 days. A report without one goes with the files.
- A support chat with no ticket: 90 days after its last message. A ticket and its chat: 365 days once answered if you have no account, or for as long as your account is open.
- A Practice Program application: declined or marked as spam, 365 days. Approved, for as long as you stay in the program.
- Your account's records: for as long as the account is open or in maintenance mode.
- A closed account: deleted 90 days after it closes, except what billing and tax law require Paddle or us to keep.
Your choices
You can export your vendors at any time. To ask for a copy of your personal data, or to correct or delete it, write to support@coipilot.ai. If you are a vendor whose details a customer gave us, we will generally pass your request to that customer, who decides what they need to keep.
Changes
We will post changes here and tell account owners about material ones.