Privacy Policy

3.1. Personal Identity Information

We collect information that identifies you as an individual, including but not limited to:

• Full legal name
• Email address
• Phone number
• Mailing and billing address
• Government-issued identification numbers (where required by law or for identity verification)
• Date of birth (where required for verification purposes)
• Electronic signature data

3.2. Business and Organizational Information

When you use Certgio on behalf of a business or organization, we collect:

• Company or organization name and legal structure
• Employer Identification Number (EIN) or Business Number (BN)
• State or province of incorporation or registration
• Business licenses, contractor licenses, or professional permits
• Business contact information (address, phone, email)
• Names and contact information of authorized representatives and administrators
• Corporate documents where voluntarily submitted

3.3. Insurance and Financial Data

As a COI management platform, the core of our service involves handling insurance-related information, including:

• Certificate of Insurance (COI) documents and their contents
• Insurance policy numbers, policy types, and coverage details
• Coverage limits, deductibles, and policy effective and expiration dates
• Names of insurers, underwriters, and insurance agents or brokers
• Additional insured and certificate holder information
• Billing history and subscription information

Financial Data Notice (GLBA): Insurance information and related financial data collected by Certgio may constitute "nonpublic personal information" under the Gramm-Leach-Bliley Act (GLBA).

3.4. Uploaded Documents and Files

Our platform allows users to upload, store, and share documents. These may include:

• PDF and image files of insurance certificates
• Scanned documents, licenses, and permits
• Any other files voluntarily submitted through the Platform

We process uploaded documents using automated tools, including AI-powered extraction and verification technology, to parse information and populate data fields within the Platform.

3.5. Account and Authentication Data

• Usernames and passwords (stored in hashed form)
• Authentication credentials and multi-factor authentication data
• Account preferences and settings

3.6. Usage and Technical Data

We automatically collect certain technical information when you use our Platform:

• IP address and approximate geographic location
• Browser type, version, and operating system
• Device identifiers and hardware information
• Pages visited, features used, and actions taken within the Platform
• Session duration, click patterns, and navigation data
• Referral URLs and traffic sources
• Crash reports and error logs

3.7. Communications Data

• Emails, chat messages, and support tickets exchanged with Certgio
• Records of consent and opt-in/opt-out preferences
• Responses to surveys or feedback requests

4.1. Directly From You

We collect information you provide directly when you:

• Register for an account
• Complete your profile or organization settings
• Upload or submit documents through the Platform
• Request, generate, or share a Certificate of Insurance
• Make a payment or manage your subscription
• Contact our support team
• Subscribe to marketing communications
• Respond to surveys or promotions

4.2. Automatically

We collect limited usage and technical data automatically when you interact with our website or Platform. Analytics of this kind is off unless you turn it on - Section 10 explains exactly what is stored, and how to change your choice at any time. We do not use web beacons, pixel tags, or advertising trackers of any kind.

Compliance Passport views are recorded. A Compliance Passport is a page a certificate holder reaches by scanning a QR code or following a link someone shared with them. When a passport is opened, we record that it was opened and when, against that passport's own record, and we count the view in our product analytics. The record identifies the passport, not the person who opened it - we do not set an identifier for the viewer, do not build a profile of them, and do not link the view to any other activity. This happens whether or not the viewer has accepted analytics, because recording access to a shared compliance document is part of providing it rather than measurement of the viewer.

4.3. From Third Parties

We may receive information about you from:

• Insurance brokers or agents who use our Platform on your behalf
• Publicly available business registries and databases

4.4. From AI-Powered Document Processing

When you upload insurance certificates or other documents, our AI technology automatically extracts and processes data from those documents, including policy numbers, coverage amounts, dates, and party names. This information is then stored and used to power the Platform's verification and tracking features.

5.1. Providing and Operating Our Services

• Creating and managing user and organizational accounts
• Processing, verifying, and storing Certificates of Insurance
• Enabling sharing and distribution of COIs between parties
• Sending automated compliance alerts and expiration notifications
• Processing payments and managing subscriptions
• Providing customer support

5.2. AI-Powered Processing and Verification

• Automatically extracting and parsing data from uploaded insurance documents
• Verifying the completeness and apparent accuracy of COI information
• Flagging potential compliance gaps or coverage discrepancies
• Improving the accuracy and performance of our AI models

5.3. Communications

• Sending transactional communications (account confirmations, receipts, alerts)
• Delivering operational notifications related to your COIs (renewals, expirations)
• Sending marketing communications (where you have consented or where permitted by law)
• Responding to your inquiries and support requests

5.4. Legal and Compliance Obligations

• Complying with applicable laws and regulations, including GLBA, CCPA/CPRA, PIPEDA, and Quebec Law 25
• Responding to lawful requests from regulators, law enforcement, and courts
• Detecting, investigating, and preventing fraud and security incidents
• Maintaining records required by applicable insurance regulations

5.5. Analytics and Product Improvement

• Analyzing usage patterns to improve Platform features and user experience
• Conducting research and development
• Performing market research and user feedback analysis

5.6. Legal Bases for Processing (US)

Under applicable U.S. laws, we process your personal information on the following legal bases:

• Contract performance: Processing necessary to provide our services under your agreement with us.
• Legal obligation: Processing required to comply with applicable laws and regulations.
• Legitimate interests: Processing for fraud prevention, security, and product improvement, where your interests are not overridden.
• Consent: Where required, based on your explicit consent, which you may withdraw at any time.

5.7. Legal Bases for Processing (Canada)

Under PIPEDA and Quebec Law 25, we collect, use, and disclose personal information only:

• For purposes that a reasonable person would consider appropriate in the circumstances;
• With your knowledge and consent (express or implied as appropriate to the sensitivity of the information); or
• As otherwise authorized by law.

5.8. De-Identified and Aggregated Data

In addition to using your data to provide the Certgio services, we may process, retain, and analyze information derived from the documents you submit (such as Certificates of Insurance) to create de-identified, anonymized, and aggregated datasets. We systematically strip this data of identifying details so that the resulting information cannot be reasonably linked back to you, your business, or your vendors. Because this de-identified data is no longer considered personal information under applicable privacy laws, we may use it for any lawful purpose, including to understand industry insurance habits, build benchmarking tools, and continuously improve the Certgio platform.

6.1. Document Intelligence

Our AI-powered document processing engine analyzes uploaded insurance certificates to extract structured data, recognize policy terms and coverage details, and populate fields within the Platform. This is an automated process that does not involve human review of every document.

6.2. Compliance Verification

The Platform uses automated logic to assess whether submitted COIs meet predefined compliance requirements set by certificate holders or administrators. Automated flags and alerts may be generated based on this analysis.

6.3. Important Limitations of AI

Certgio's AI tools assist in processing and verification but do not constitute professional insurance, legal, or underwriting advice. AI-generated analysis may contain errors. Critical decisions about insurance compliance should be reviewed by qualified personnel. Certgio is not responsible for decisions made solely in reliance on AI-generated output without human review.

6.4. Human Review of AI Determinations

Where a consequential decision may be made using AI (such as a flagging of a COI as non-compliant), you have the right to request human review of that decision. Please contact us at hello@certgio.com to exercise this right.

6.5. Limits on AI Decisions

We do not use AI to make final adverse insurance coverage or underwriting decisions.

7.1. With Other Platform Users (as Directed by You)

The core function of our Platform involves sharing COIs between parties - for example, from an insured party to a certificate holder. When you share a COI or grant access to your information through the Platform, that information will be visible to the designated recipients. This sharing is at your direction and is necessary to provide the service.

7.2. With Service Providers ("Data Processors")

We engage third-party service providers to assist us in operating our Platform. These providers are permitted to use your information only as directed by us and consistent with this Policy. Categories of service providers include:

• Cloud infrastructure and hosting providers
• AI and machine learning technology vendors
• Email delivery and communication services
• Analytics and error-monitoring providers
• Bot-prevention services

We name every one of them. The current list, including what each receives and where it processes, is published at certgio.com/subprocessors and kept up to date there rather than in this document.

7.3. With Business Partners

With your consent or as permitted by law, we may share information with authorized business partners, such as insurance brokers or agencies who manage COI compliance on behalf of their clients.

7.4. For Legal and Regulatory Purposes

We may disclose your information when required to:

• Comply with applicable laws, regulations, or court orders
• Respond to lawful requests from government authorities, including state insurance regulators
• Enforce our Terms and Conditions
• Protect the rights, safety, or property of Certgio, our users, or the public
• Investigate fraud, security breaches, or other violations

7.5. In Connection with a Corporate Transaction

If Certgio undergoes a merger, acquisition, reorganization, sale of assets, or bankruptcy proceeding, your personal information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information in accordance with applicable law.

7.6. GLBA Disclosure Notice

Gramm-Leach-Bliley Act (GLBA) Notice: We do not share your nonpublic personal information with nonaffiliated third parties for their own marketing purposes unless you have authorized us to do so. We share information with service providers as necessary to administer our services, consistent with GLBA requirements. You may have the right to opt out of certain sharing; please see Section 8 for details.

8.1. California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with the following rights, effective January 1, 2026:

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, our purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You may request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Correct: You may request that we correct inaccurate personal information we hold about you.
• Right to Opt Out of Sale/Sharing: We do not sell your personal information, and we do not share it for cross-context behavioral advertising - we run no advertising or targeting technology of any kind. Because we want that to be verifiable rather than merely asserted, the "Do Not Sell or Share My Personal Information" link in our website footer is live and takes you to our Cookie Settings page, where you can turn off the only non-essential processing we do. We also honour the Global Privacy Control (GPC) signal automatically, with no action needed from you.
• Right to Limit Sensitive Personal Information: You may direct us to limit the use of your sensitive personal information to only those purposes necessary to perform our services.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
• Automated Decision-Making: Beginning January 1, 2027, you may have the right to opt out of automated decision-making technology used to make significant decisions about you.

To submit a CCPA request, please contact us at hello@certgio.com. We will respond within 45 days (extendable by an additional 45 days with notice). You may designate an authorized agent to submit requests on your behalf.

8.2. Residents of Other U.S. States

Residents of the following states have privacy rights similar to those described above under their respective state laws. We honor these rights for residents of:

• Virginia (Virginia Consumer Data Protection Act - VCDPA)
• Colorado (Colorado Privacy Act - CPA)
• Connecticut (Connecticut Data Privacy Act - CDPA, as amended by SB 1295, effective July 1, 2026)
• Texas (Texas Data Privacy and Security Act - TDPSA)
• Montana (Montana Consumer Data Privacy Act - MCDPA, as amended effective October 1, 2025)
• Maryland (Maryland Online Data Privacy Act - MODPA)
• Minnesota (Minnesota Consumer Data Privacy Act)
• New Jersey (New Jersey Data Privacy Act)
• New Hampshire (New Hampshire Privacy Act)
• Nebraska (Nebraska Data Privacy Act)
• Rhode Island (Rhode Island Data Transparency and Privacy Protection Act)
• Kentucky (Kentucky Consumer Data Protection Act)
• Indiana (Indiana Consumer Data Protection Act - ICDPA)

Rights available under most state laws include the right to access, correct, delete, and obtain a portable copy of your personal data, and the right to opt out of the processing of personal data for targeted advertising. To exercise any of these rights, please contact us at hello@certgio.com.

8.3. GLBA Rights (Financial Information)

Under the Gramm-Leach-Bliley Act (GLBA), you have the right to:

• Receive a clear notice of our privacy practices regarding nonpublic personal information;
• Opt out of certain sharing of your nonpublic personal information with nonaffiliated third parties, where such opt-out right applies.

To exercise your GLBA opt-out rights, please contact us at hello@certgio.com.

9.1. Rights Under PIPEDA (Federal)

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), individuals in Canada have the following rights:

• Right of Access: You have the right to request access to personal information we hold about you and to be informed of how it has been used and disclosed.
• Right to Accuracy: You have the right to challenge the accuracy and completeness of your personal information and request corrections.
• Right to Withdraw Consent: Where we rely on your consent to process your personal information, you may withdraw that consent at any time, subject to legal or contractual restrictions.
• Right to Complain: You have the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC) if you believe your rights have been violated. Visit priv.gc.ca for more information.

9.2. Rights Under Quebec Law 25

Quebec's Act Respecting the Protection of Personal Information in the Private Sector (commonly known as Law 25 or Loi 25) provides Quebec residents with additional rights:

• Right to Access and Portability: You have the right to access your personal information held by us and, in certain circumstances, to receive it in a structured, commonly used technological format.
• Right to Correction: You have the right to request correction of any inaccurate, incomplete, or ambiguous personal information we hold about you.
• Right to Erasure: You have the right to request that we cease dissemination of your personal information or delete personal information that has been collected without authorization or in violation of Law 25.
• Right to Withdraw Consent: You have the right to withdraw your consent to the communication or use of your personal information at any time, subject to legal restrictions.
• Automated Decision-Making: If Certgio makes a decision based exclusively on automated processing of your personal information that produces legal or other significant effects, you have the right to be informed of this and to have the decision reviewed by a human being.

Quebec Law 25 Penalties: Non-compliance with Quebec Law 25 can result in penalties of up to $25 million CAD or 4% of worldwide turnover.

9.3. Privacy Impact Assessments (Quebec)

Quebec Law 25 requires an assessment of privacy-related factors before certain processing, including the communication of personal information outside Quebec. Certgio is committed to assessing the privacy impact of new technologies and processes that involve personal information, and to completing formal Privacy Impact Assessments for the processing that requires them, including our use of AI to read uploaded documents and our use of service providers located outside Quebec. This programme is in progress and not yet complete. If you would like to know the current status for a specific processing activity, contact our Privacy Officer at hello@certgio.com.

9.4. Exercising Your Canadian Privacy Rights

To exercise any of your rights under PIPEDA or Quebec Law 25, please contact our Privacy Officer at:

• Email: hello@certgio.com
• Mail: Privacy Officer, Technologies Certgio Inc., 12252 rue Filion, Montréal, Quebec H4J 1T8

We will respond to requests within 30 days. If we need additional time, we will notify you. Where we are unable to fulfill a request, we will explain why.

10.1. What We Store, Precisely

Strictly necessary - always active. Without these the Platform cannot sign you in or defend itself.

Functional - always active, signed-in users only. Small preferences that make the app less repetitive: which hints you have dismissed, an unfinished form draft, your onboarding checklist progress, recently used commands. All stored in your browser's local storage, all first-party, all kept until you clear your browser data. None of it is transmitted to us as analytics.

Analytics - only if you accept. None of the following is created, and neither service is loaded, unless you have accepted analytics. If you decline, or if your browser sends a Global Privacy Control signal, nothing in this group exists on your device.

The three durations above are maximums, and your browser may enforce a shorter one. Safari, in particular, deletes first-party local storage after seven days without a visit, so these entries can disappear sooner than stated. Shorter is the safe direction: it means the data is gone, and you would simply be asked for your choice again.

We do not use marketing or targeting cookies. There are none to consent to. We run no advertising technology, no ad network, no conversion pixel, and no cross-site tracking, and we do not participate in cross-context behavioral advertising.

One thing runs without your consent and is worth naming. If the Platform hits an error, we send a crash report to Sentry so the fault can be fixed. Crash reporting stores nothing on your device - the entry above is created by session replay, which is part of the analytics group and off unless you accept it. We treat crash reporting as necessary to keep the service working and secure; we treat recording your session as analytics, which is why the two are separated here rather than described together as "monitoring".

10.2. Your Cookie Choices

Analytics is off until you turn it on. The first time you visit, a notice offers two choices - Accept analytics or Decline - presented equally, with no pre-selected option and no way to dismiss it without choosing. Until you choose, nothing in the analytics group above runs. Declining is not a degraded experience: every feature, including the free COI checker, works identically either way.

Changing your mind. The Cookie Settings link in our website footer opens a page showing your current setting and letting you change it. It works whether or not you are signed in, and no account is needed. When you turn analytics off we delete what was stored for it and reload the page, because that is the only way we can reliably stop code that has already started.

Global Privacy Control. If your browser sends a GPC signal, we treat it as a refusal automatically: analytics does not run, and you are not shown the notice at all, because asking again after you have already signalled a preference would not be a genuine choice. The signal overrides anything stored on this site, including an earlier acceptance. We also honour the older Do Not Track signal the same way.

For California residents. GPC is the opt-out mechanism described in Section 8.1, and it is honoured automatically. The "Do Not Sell or Share My Personal Information" link in our footer leads to the same Cookie Settings page.

For Quebec residents. In accordance with Quebec Law 25, we obtain your explicit opt-in consent before storing anything non-essential on your device, and you may withdraw that consent at any time using Cookie Settings. The consent notice does not treat silence, a page dismissal, or continued browsing as agreement.

Compliance Passport views are recorded separately and are not covered by this choice; see Section 4.2 for what is recorded and why.

15.1. Transactional Communications

We will send you transactional and service-related communications (such as account confirmations, COI alerts, expiration notices, and security notifications) as necessary to provide our services. These communications are not optional if you use the Platform.

15.2. Marketing Communications (Email - CAN-SPAM / CASL)

We may send you marketing emails about our products, services, and promotions. In the United States, our marketing emails comply with the CAN-SPAM Act, which requires us to identify our messages as advertisements (where applicable), include our physical postal address, and provide a clear mechanism to opt out of future emails. We honor opt-out requests within 10 business days.

For Canadian recipients, we comply with Canada's Anti-Spam Legislation (CASL). We will only send commercial electronic messages (CEMs) to Canadian recipients with express or implied consent as defined under CASL, and every CEM will include our identification information and an unsubscribe mechanism that we will honor promptly.