<!-- LEGAL DOCUMENT CONFIGURATION ================================= Real names appear ONLY here and in the Definitions section below. The rest of the document uses the generic terms "the Company", "the Service", and "the User" -- edit here and the whole document stays consistent.

company_name: "CoverFi" service_name: "CoverFi" website_url: "https://coverfi.com" support_email: "support@coverfi.com" effective_date: "September 30, 2026" jurisdiction_state: "Delaware" jurisdiction_country:"United States" arbitration_venue: "Wilmington, Delaware" minimum_age: 18 ================================= -->

Privacy Policy

Last Updated: September 30, 2026

Definitions

"Company" (also "we", "us", or "our") refers to CoverFi.
"Service" refers to CoverFi, accessible at https://coverfi.com, including all related websites, applications, APIs, features, and content.
"User" (also "you" or "your") refers to any individual or entity that accesses or uses the Service.
"Personal Information" means information that identifies, relates to, or could reasonably be linked to an individual.
"Records Data" means consumer identity and related attributes made available through the Service from third-party and other datasets (for example, names, aliases, dates of birth, addresses, phone numbers, email addresses, and similar identifiers).
"Organization" means a workspace or tenant account on the Service.

This Privacy Policy describes how the Company collects, uses, discloses, and protects information when you use the Service. By using the Service, you acknowledge this Policy. Our Terms of Service govern use of the Service and are incorporated by reference where applicable.

1. Scope and Roles

This Policy covers:

Account and Service data about Users and Organizations (customers and visitors)
Operational data generated when you use the Service (logs, billing metadata, Credits usage)
How Records Data is processed in connection with providing lookup and identity-check features

Important. Records Data concerns individuals who may not be Users of the Service. Those individuals' information is sourced primarily from third-party marketing and identity datasets. If you believe Records Data about you is inaccurate or wish to exercise applicable rights, submit a request at /privacy/request or contact us at support@coverfi.com. We may need to verify your identity and may be limited by our contracts with data providers and by applicable law.

When you use the Service to search or match against Records Data, you are responsible for ensuring your use is lawful. The Company provides tools and data access under the Terms; you determine the purpose of each query.

2. Information We Collect

a. Information You Provide Directly

Account information: first and last name, email address, and password (stored only in hashed form; we never store your plaintext password)
Organization information: Organization names and slugs, optional claimed email domains, membership roles, and email addresses of people you invite
Consent and preference records: the date you accepted our Terms of Service; your permitted-use attestation (including its timestamp and version) made at signup and when creating API keys; marketing email opt-in or opt-out status
Search and identity-check inputs: details you submit to run a check or search (for example, name, date of birth, email, phone, address, or other query parameters). Public marketing forms may collect similar fields before account creation; for anonymous public checks we store only a non-reversible fingerprint of the submitted details together with the outcome, not the details themselves
Payment information: if you purchase Credits, payment details are collected and processed by our payment processor (Stripe). We do not store full payment card numbers; we retain purchase metadata such as the Credit pack, amount, status, and customer identifiers
Communications: information you send in support requests, emails, or other correspondence
User Content: prompts, feedback, or other content you submit to optional AI or other features

b. Information Collected Automatically

IP address, browser type and version, device type, and operating system
Approximate location derived from IP address (where processed by our infrastructure or security tooling)
Log data, including server logs, error logs, request paths, timestamps, and diagnostic context
Pages visited and features used within the Service (for security, metering, and product operation)
Authentication and session signals (see Cookies)
Acquisition information: how you arrived at the Service — campaign tags in the link you followed (such as utm_source), whether the link carried an advertising click parameter (recorded by parameter name only, for example "gclid", without its value unless you consent to Analytics), the domain of the referring website, and the public page you first landed on (path only, without query parameters; pages inside the signed-in app are recorded only as a generic placeholder) — recorded with your account when you sign up (see Cookies)
Credits ledger entries and usage attribution within an Organization
Rate-limiting and abuse-prevention signals

When errors occur, we may temporarily store request context (such as IP address, user agent, path, and error details) to diagnose and resolve issues. Such diagnostic context is retained for a limited period (typically up to seven days) unless needed longer for security or legal reasons.

c. Information from Third Parties

Payment processor: Stripe sends payment, invoice, and billing-status events
Email provider: delivery, bounce, complaint, and unsubscribe events for transactional and (if opted in) marketing email
Data providers: Records Data is obtained from third-party marketing and identity data sources and related licensors
Error monitoring (if enabled): tools such as Sentry may receive technical error data; we configure such tools to limit unnecessary personal data where practicable
AI providers (if you use AI features): providers such as Google (Gemini), OpenAI, or Anthropic may process prompts you submit to those features

d. Records Data (third-party consumer attributes)

The Service makes available Records Data that may include, among other fields: names and aliases; date of birth, age, or gender indicators; current and historical addresses; phone numbers; email addresses; marketing-email flags; IP addresses; mobile advertising identifiers; and deceased indicators. The specific fields available may change. Records Data is not collected from the individuals it describes through the Service's account registration flow; it is licensed or otherwise obtained for use in the Service as described in the Terms.

3. How We Use Information

We use the information we collect to:

Provide, operate, maintain, and secure the Service
Authenticate Users, manage Organizations, and enforce access controls
Perform identity checks, searches, matching, and display of Output
Meter usage, reserve/capture/release Credits, and enforce plan limits
Process transactions and send invoices, receipts, and billing notices
Send administrative communications (security alerts, service updates, verification and password-reset emails, Organization invitations)
Send marketing communications only where you have opted in; you may unsubscribe at any time
Respond to inquiries and provide customer support
Monitor, investigate, and prevent fraud, abuse, scraping, and unauthorized activity
Improve and personalize the Service and develop new features
Comply with legal obligations and enforce our Terms of Service
Protect the rights, safety, and property of the Company, Users, and the public
For any other purpose disclosed to you at the time of collection or with your consent

We do not use Records Data to make FCRA-regulated eligibility decisions about consumers, and we prohibit Users from doing so under the Terms.

4. Cookies and Tracking Technologies

We use the following technologies:

Strictly necessary cookies: we set an authentication cookie (a refresh token) to keep you signed in securely. It is an httpOnly cookie inaccessible to scripts. These cookies are required for the Service to operate and do not require consent.
First-party attribution cookie: we set a first-party cookie (coverfi_attr) that remembers how you arrived at the Service: campaign tags in the link you followed, which advertising click parameters were present (names only, not values), the domain of the referring website, and the public page you first landed on. It expires 90 days after it was last updated by a new campaign link or referring website. It never contains search inputs, other URL query parameters, record identifiers, or email addresses, and it is never shared with third parties. When you create an account, this information is stored with your account so we can understand which channels bring us new customers, and the cookie is then deleted. Outside the EU, EEA, and UK we rely on our legitimate interest in measuring our own marketing for this cookie (see Section 14). If you are in the EU, EEA, or UK, we store this cookie only after you allow Analytics on our consent banner; until then, this information is kept only in your browser's memory while the page is open and is not stored on your device. You can delete the cookie at any time through your browser settings.
Local storage: we may store interface preferences (such as your most recently selected Organization) in your browser's local storage. We also store your cookie-consent choice itself in local storage so we do not ask again on every visit; if you are signed in, each consent decision is additionally recorded to your account so we can demonstrate and honor it.
Analytics (opt-in only): with your prior consent, we use Google Analytics 4 (Google LLC) to understand aggregate site usage. Analytics loads only after you allow the Analytics category on our consent banner; if you reject it or make no choice, no analytics code loads and no data is sent. We configure analytics to receive page routes only — search inputs, URL query parameters, and record identifiers are stripped before anything is sent, and IP anonymization is enabled. You may change or withdraw your choice at any time via the "Cookie settings" link in the footer or on your profile page; after withdrawal, analytics will not load on subsequent page loads. With the same consent, we also remember the values of advertising click identifiers in links you followed (such as gclid or fbclid) in a first-party cookie (coverfi_clk, which expires 90 days after the click) and record them, together with your Google Analytics client identifier, with your account at sign-up; if you withdraw consent, we delete that cookie on your next page load.

We do not use third-party advertising cookies. If we introduce additional analytics or marketing technologies in the future, we will update this Policy and, where required, obtain prior opt-in consent through the same consent mechanism before loading them.

You can configure your browser to refuse or delete cookies. If you refuse the strictly necessary authentication cookie, you will not be able to remain signed in and some features will not function.

5. Third-Party Services

We rely on the following categories of third-party services:

Payments: Stripe (Credit pack purchases and payment processing)
Email delivery: a transactional email provider (for account, invitation, and billing emails, and — only if you opt in — marketing email). In production this may be Resend or a similar provider; in development, email may be captured by a local mail testing tool
Infrastructure and hosting: cloud infrastructure providers that host the Service, databases, cache, and object storage
Error monitoring: optional tools such as Sentry for application error tracking
Analytics: Google Analytics (Google LLC), loaded only after opt-in consent as described in Section 4
AI providers: optional providers (for example Gemini, OpenAI, Anthropic) when AI features are enabled and used
Data providers: licensors of Records Data and related identity/marketing datasets

These third-party services have their own privacy policies governing their use of information. We are not responsible for the privacy practices of third-party services. We encourage you to review the privacy policies of any third-party services you interact with through our Service.

We may share information in the following circumstances:

Service providers: with vendors that perform services on our behalf (payment processing, email delivery, hosting, monitoring, AI processing), subject to contractual obligations appropriate to the service
Within your Organizations: your name, email address, and role are visible to other members of Organizations you belong to; owners and administrators may see usage and billing metadata for the Organization
Data providers and licensors: as required to obtain, maintain, or audit licensed Records Data, or as required by our agreements with them
Legal compliance: when required by law, regulation, legal process, or governmental request
Protection of rights: to enforce our Terms, or to protect the rights, privacy, safety, or property of the Company, our Users, data subjects, or the public
Business transfers: in connection with any merger, acquisition, financing, reorganization, sale of assets, or bankruptcy
With consent: when you have given explicit consent
Aggregated or anonymized data: we may share aggregated or de-identified information that cannot reasonably be used to identify you

We do not sell Personal Information as "sale" is commonly defined under the CCPA/CPRA. We do not share Personal Information for cross-context behavioral advertising. If that changes, we will update this Policy and provide required opt-out mechanisms.

We do not provide Records Data to the general public without authentication and Terms acceptance. Authenticated Users may access Records Data subject to the Terms; that access is a core function of the Service, not a "sale" of your account Personal Information.

7. AI Processing

Certain features of the Service may use artificial intelligence. Content you submit to those features may be transmitted to and processed by third-party AI providers (such as Google Gemini, OpenAI, or Anthropic, depending on configuration) to generate responses.

We do not control how third-party AI providers use data beyond our agreements with them; their privacy policies apply to their processing. Do not submit sensitive Personal Information (health data, financial account numbers, government identifiers, or similar) to AI-powered features unless necessary and lawful. AI-related inputs and outputs may be retained to provide, secure, and improve the Service and to maintain audit records (including Credits metering).

8. Data Retention

We retain Personal Information for as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy, including:

Account data: for the life of the account and a reasonable period thereafter
Billing and transaction records: as required for accounting, tax, dispute resolution, and legal compliance
Credits ledgers: as needed for metering integrity and audit
Marketing preferences and consent records: as needed to demonstrate compliance
Query audit logs: each search, record view, address lookup, or identity check is recorded with the requesting account or API key, IP address, browser user agent, and access channel; these audit records are retained indefinitely for security, abuse prevention, metering integrity, and audit purposes. The query criteria themselves are removed from audit records after approximately 90 days. Anonymous public identity checks are recorded with IP address and user agent but store only a non-reversible fingerprint of the submitted details, not the details themselves
Error and security logs: typically for a short period (for example, up to seven days for detailed request context), longer if needed for investigations
Records Data: according to our agreements with data providers and operational needs; individual field availability may change as datasets are refreshed

After account deletion, we may retain certain information as required by law, to resolve disputes, enforce agreements, prevent fraud, or for legitimate business purposes. We may retain aggregated or anonymized data indefinitely. Organization-owned data may persist after an individual member leaves until the Organization is deleted or as otherwise required.

9. Data Security

We implement commercially reasonable technical and organizational security measures designed to protect Personal Information, including password hashing, encrypted connections (TLS), access controls, and network isolation in our hosting environment.

However, no method of transmission over the Internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security. We are not responsible for unauthorized access that occurs despite our reasonable security measures. You are responsible for maintaining the security of your account credentials and for configuring Organization access appropriately.

If we become aware of a security incident that requires notification under applicable law, we will notify affected parties as required.

10. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect Personal Information from children under 18. If we become aware that we have collected Personal Information from a child under 18, we will take steps to delete such information promptly. If you believe a child has provided us with Personal Information, please contact us at support@coverfi.com.

You must not use the Service to target or exploit minors.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have data protection laws that differ from those in your jurisdiction.

Where we transfer Personal Information out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses (SCCs), where required. We will take reasonable steps to ensure your information is treated securely and in accordance with this Privacy Policy.

12. Your Privacy Rights

Depending on your jurisdiction, you may have some or all of the following rights regarding your Personal Information:

Access: request a copy of Personal Information we hold about you
Correction: request correction of inaccurate account information. For Records Data sourced from third-party providers, we handle correction requests through suppression or referral to the data provider (see Section 1)
Deletion: request deletion of your Personal Information
Portability: request transfer of information in a machine-readable format
Objection / restriction: object to or request restriction of certain processing
Withdraw consent: where processing is based on consent (for example, marketing email), withdraw consent at any time without affecting prior lawful processing

To exercise any of these rights, submit a request at /privacy/request or contact us at support@coverfi.com. We may need to verify your identity before processing your request. We reserve the right to charge a reasonable fee for manifestly unfounded or excessive requests, where permitted by law.

Records Data about non-Users. Requests relating to Records Data are handled as permitted by applicable law and our contracts with data providers. Access, delete, and suppress requests may be submitted at /privacy/request. We suppress matching records locally and forward delete/suppress requests to our data provider. We may deny requests that are exempt, or limit responses where disclosure would adversely affect the rights of others or our trade secrets and security.

Marketing. You can unsubscribe from marketing emails via the link in those emails or by updating your profile preferences. Transactional emails (security, billing, invitations) are not marketing and may continue as needed to operate the Service.

13. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you may have additional rights under the California Consumer Privacy Act as amended by the CPRA, including the right to know, the right to delete, the right to correct, the right to opt out of sale or sharing, the right to limit use of sensitive personal information (where applicable), and the right to non-discrimination.

Categories of Personal Information. Depending on how you use the Service, we may collect identifiers (name, email, IP address); commercial information (plan and purchase history); internet or electronic activity (usage logs); professional information (Organization membership); and inferences only insofar as Output reflects database matching — not profiling for advertising.

Sources. You; your Organization administrators; automatic collection; payment and email providers; and licensed data providers (for Records Data).

Business purposes. As described in Section 3 (providing the Service, security, billing, compliance, and improvement).

We do not sell Personal Information as defined by the CCPA, and we do not share it for cross-context behavioral advertising. To exercise your California privacy rights, contact us at support@coverfi.com. You may also designate an authorized agent subject to verification requirements.

If you are a resident of the European Economic Area or the United Kingdom, you may have additional rights under the GDPR (or UK GDPR), including access, rectification, erasure, restriction, portability, objection, and the right to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with a supervisory authority.

Lawful bases for processing typically include:

Contract performance: creating and managing your account, providing the Service you request, billing
Legitimate interests: securing the Service, preventing fraud and abuse, improving features, enforcing Terms, limited product analytics that do not rely on non-essential cookies, and measuring which marketing channels bring us new accounts using the first-party attribution cookie described in Section 4 (outside the EU, EEA, and UK; within those regions we ask for your consent first)
Consent: marketing emails; any future non-essential cookies or similar technologies
Legal obligation: tax, accounting, and responding to lawful requests

Analytics and marketing cookies, if introduced, will be used only after prior opt-in consent, which you may withdraw at any time via the consent mechanism we provide, without affecting the lawfulness of processing before withdrawal.

To exercise your GDPR rights, contact us at support@coverfi.com.

15. Do Not Track

Some browsers transmit "Do Not Track" (DNT) signals. The Service does not currently respond to DNT signals. Third parties that collect data through the Service (if any) may also not respond to DNT signals.

16. Changes to This Privacy Policy

We may update this Privacy Policy at any time. Changes are effective when posted on this page. Your continued use of the Service after any changes constitutes acceptance of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically. For material changes, we may provide additional notice (for example, by email or in-product notice).

17. Contact

If you have any questions about this Privacy Policy, please contact us at support@coverfi.com.