What we collect
- Your account: names, work email addresses, your company's details and your requirements. Passwords are stored only as a secure hash. If you use Sign in with Intuit, Intuit shares your name and email.
- Payments and bills: the vendors, bills and payments in QuickBooks or Xero once you connect one, or in the reports you upload, the payments you type in and the Zaps you set up. We use them to match payments to coverage.
- Documents: certificates of insurance, endorsements, licenses, leases, contracts and lien waivers that you, your subs, vendors, tenants or their agents upload or email to us, and the record of every signature made on Coverstamp. We also keep the names and contact details of your subs, vendors, tenants and their agents.
- W-9s: the forms your subs or vendors sign on Coverstamp. Their taxpayer IDs are encrypted under a key of their own, shown only by their last 4 digits, and never sent to an AI, to Zapier or to a webhook. When QuickBooks is connected, we also save each taxpayer ID to that vendor in QuickBooks, for your 1099s.
- Billing: your plan and invoices. Paddle handles your card, so we never see its full number. When a company adds its first card during its trial, we keep a fingerprint of the card's brand, last four digits and expiration date, so each card starts one trial.
- How you use Coverstamp: pages visited, device, browser and IP address, kept for security and support.
- Visits to this site: the page you open, when, your browser and the site that sent you, with only the first part of your IP address. Our server keeps this log at most 30 days, to see which search engines and AI tools read our pages and send people here.
- Waiting lists: your email and the answers you choose to give when you join a waiting list, with the first page you opened on this site in that visit and the site that sent you. We use your email only to tell you once when your place in Coverstamp is ready, or when a bigger plan opens, and the page and site only to see where people hear about us.
- Free tools: copying a sample, printing the checklist and typing a total into the audit estimate happen in your browser and send us nothing. The audit estimate reads the payments report you upload in memory, blanks taxpayer IDs before reading it and keeps nothing of it.
How we use it
To run Coverstamp for you: read certificates, check them against your requirements, send requests and reminders to your subs, vendors and tenants, and estimate your audit. We also use it to keep accounts secure, to answer support questions, and to send the emails you choose in Your account. We don't sell personal information or share it for advertising. Once a year we may publish counts across every company on Coverstamp, such as how many certificates miss an endorsement. A figure needs at least 10 companies behind it, names no company, sub, vendor, tenant, agent or person, and never uses payments.
Certificates we keep to test our reading
When someone on your team corrects a value we read wrongly, we ask an admin whether we may keep that one certificate to test our reading, and the answer starts at no. A certificate you let us keep is stored apart, with names, addresses and policy numbers removed. It trains no AI model, and we delete it when you ask, in Settings › Company › Your data.
Who else handles it
A few services do parts of the work for us. Each gets only what it needs for its job, and none may use your data for anything else.
| Service | What it does for us |
|---|---|
| Amazon Web Services | Hosting, file storage, email and the text of scanned pages, in Virginia, USA. It doesn't use your documents to improve its own services. |
| Anthropic | Reads certificates, endorsements and contracts with its AI, Claude. It doesn't use them to train its models, and it never sees a W-9. |
| Paddle | Checkout, invoices and sales tax. Paddle is the seller of record for your plan. |
| Intuit | The QuickBooks connection and Sign in with Intuit |
| Xero | The Xero connection, once you connect it |
Zapier, webhooks and calendar links get data only where you set them up. Zapier gets only what the Zaps you connect use, webhooks get the events you pick at the addresses an admin adds, and a calendar link lists whose policies and documents expire, and when, in the calendar you add it to. None of them ever gets a taxpayer ID or a document file; events link back to Coverstamp instead.
How long we keep it
For as long as your account is open. When an admin deletes the company, everything is deleted 7 days later, and backups are cleared within 35 days, except a short record of each signature: who signed, when, the signed file's fingerprint and the consent wording they saw, without the document itself. The people who signed, such as your subs or vendors, an owner or a lender, may need it to show what they signed, so we keep it 4 years, then delete it. The fingerprint of a card added during a trial is kept until the card expires, even after the company is deleted. A taxpayer ID is deleted 4 years after your last payment to that sub or vendor, or with the company. A payments report uploaded for the free audit estimate is read in memory and never kept. A waiting list entry, with its first page and the site that sent you, is deleted 2 years after it joined. The log of visits to this site is kept at most 30 days.
Your choices and rights
Admins can export all company data or delete the company in Settings › Company. Anyone can see and change their own details and emails in Settings › Your account. You can also ask us to see, correct or delete personal information; residents of California and other states with privacy laws have these rights by law.
Tracking across sites
We run no ads and no third-party trackers, so no other company collects data through Coverstamp about what you do here or on other sites. Because we don't track you across sites, a browser's "do not track" signal changes nothing here.
Security
Data is encrypted in transit and at rest, and each company's data is kept apart from every other company's. Only the people on your team, and our staff when they help you, can see it.
Changes and contact
If we change this policy in a way that matters, we email admins 30 days before the change takes effect, and the date at the top of this page changes with it. Questions: hello@coverstamp.com. Our terms of service say who provides Coverstamp.