Privacy Policy

CertCove is operated by Salish Studios LLC. This policy applies to the CertCove website, application, and related services. It does not apply to third-party websites or services that we do not control.

We collect the following categories of information.

Account information. When you create an account we collect your name, work email address, organization name, and either a password or profile information returned by Google when you use Google sign-in (name, email, and Google account identifier).

Vendor and subcontractor data. You may enter information about your vendors, subcontractors, and their insurance brokers, including business names, contact names, email addresses, and phone numbers. You are responsible for the accuracy of this information and for having the right to submit it.

Uploaded documents. Vendors and users upload documents through the Service, primarily ACORD 25 Certificates of Insurance and IRS Form W-9. These documents can contain sensitive personal information, including Social Security Numbers, Individual Taxpayer Identification Numbers, Employer Identification Numbers, and business and personal contact information. We treat these documents as confidential.

Extracted data. We extract structured fields from uploaded certificates (such as insurer names, policy numbers, coverage limits, and expiration dates) so we can compare them against your insurance requirements.

Usage and log data. We collect standard log data such as IP address, browser type, pages visited, and timestamps, as well as records of emails we send on your behalf (for example, request and reminder timestamps that appear in the audit trail).

We use the information we collect to:

• Provide, maintain, and improve the Service.
• Extract and verify certificate data and compare it against the requirements you configure.
• Send transactional messages, upload requests, and reminder emails to you and to vendors you have entered.
• Maintain audit records of requests, uploads, and reviews.
• Provide customer support, protect the security and integrity of the Service, and comply with legal obligations.

To extract structured fields from uploaded certificates, we send document contents to Anthropic (Claude) for transcription and extraction. This automated processing is used only to assist your compliance review and is not a substitute for human verification of the underlying documents. Uploaded documents are processed to provide the Service and are not used by us or, per our provider agreements, by our AI provider to train their general-purpose models.

We share information with the following categories of service providers ("sub-processors") strictly to operate the Service:

• Lovable Cloud (application hosting, database, authentication, and file storage, powered by Supabase).
• Resend (transactional and notification email delivery).
• Anthropic (Claude AI for reading and transcribing uploaded certificate documents).
• Google (optional OAuth sign-in, when you choose to sign in with Google).
• Stripe (payment processing for paid subscriptions, once billing is enabled).

We may also disclose information to comply with law, respond to lawful requests from public authorities, protect our rights, or in connection with a business transfer. We do not sell personal information.

We retain account, vendor, and document data for as long as your account is active and as needed to provide the Service, maintain the audit trail, and comply with our legal obligations. On request from an account owner, we will delete or return account data, subject to reasonable exceptions for backups, security, and legal retention requirements.

We take security seriously. Data is isolated per organization using row-level security in our database. Uploaded documents are stored in private storage and are accessed through short-lived signed links rather than public URLs. Data is encrypted in transit and at rest by our infrastructure providers. Despite these measures, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

You may request access to, correction of, export of, or deletion of personal information we hold about you by emailing hello@certcove.com. Residents of certain regions, including California, the European Economic Area, and the United Kingdom, may have additional rights under applicable law, such as the right to object to or restrict certain processing and the right to lodge a complaint with a supervisory authority.

We use a small number of essential cookies to keep you signed in and to maintain your session. We do not use third-party advertising cookies or cross-site tracking cookies.

The Service is intended for business use and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with information, please contact us and we will delete it.

The Service is operated from the United States and information we collect is processed and stored in the United States and other jurisdictions where our sub-processors operate. By using the Service, you understand that your information may be transferred to, and processed in, countries other than your own.

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and, when appropriate, notify account owners by email or through the Service.

Questions about this policy or our data practices can be sent to hello@certcove.com. CertCove is a product of Salish Studios LLC.