Privacy Policy
Draft, pending legal review before launch.
the company operating COA Proof runs COA Proof. This policy says what we hold and why. Contact: support@coaproof.ai.
What we hold
- Account data: your email address, your organization and brand names, your time zone and your actions in the audit log.
- Documents and results: the COAs, spec sheets and emails you or your suppliers send, what was read from them, findings, and who decided what.
- Forgery registry: keyed hashes of report numbers, files and chromatograms. These cannot be read back into the original values and are never shown to another customer.
- Free pre-checker: the file and report, deleted after 24 hours, and a salted hash of IP address and browser that changes daily, used only for the daily limit. Nothing enters the forgery registry.
- Public pages: QR scans are counted per day. No IP address is stored.
- Payment: Paddle.com is the merchant of record and handles card details. We do not see them.
Who processes it for us
Supabase (database, files, sign-in), Vercel (hosting), Postmark (email), Anthropic (reading documents, and support questions the built-in answers do not cover; sent over its API, not used to train models under its commercial terms), Paddle (billing), Inngest (background jobs) and Cloudflare (Turnstile, bot protection).
How long we keep it
While your account is active. Demo workspaces are deleted after 2 hours. When an account closes, its documents and data are deleted 180 days later; audit records go with them. Forgery-registry hashes are kept, because the registry’s purpose is noticing reuse over time, and they carry no readable report or lot.
Your rights
You can ask for a copy, correction or deletion of your personal data at the address above. Where a customer controls the data (for example a supplier’s email sent to a customer’s intake address), we pass the request to them.