Privacy Policy

1. Scope and our role

This Privacy Policy describes how WatchMyCover (“WatchMyCover,” “we,” “us,” or “our”) collects, uses, discloses, and retains personal information in connection with our website, web application, upload pages, shared reports, and related services (the “Services”).

We act in two different capacities, and this distinction matters to your rights:

• For information about our own customers, their users, and visitors to our website, we decide why and how it is processed. This Privacy Policy applies in full to that information.
• For information that a customer places in its workspace about other people, such as the contact details of its subcontractors and of their insurance agents and brokers, and the certificates and other documents those persons provide (“Customer Data”), we act as a service provider and processor on the customer’s behalf, under the customer’s instructions and our Data Processing Addendum. The customer decides what is collected and how it is used. If your information is held in a customer’s workspace, please direct requests about it to that customer; see Section 10.

The Services are intended for businesses and are operated from the United States.

2. Information we collect

Information you provide to us

• Account information: your name, work email address, password (stored only in hashed form), the name and address of your company, your role in the account, and, if you turn on two-factor sign-in, the related security credentials.
• Billing information: the plan you select and your subscription status. A payment card is entered on our payment processor’s own page, and the full card number and security code never reach us. So that you can see which card is on file, the billing page shows the card’s network, its last four digits, and its expiry date, as the payment processor reports them. We do not store them.
• Communications: the content of messages you send us, including through the contact form and by email, and the name, email address, and company you give when you do.
• Free tools and downloads: before a free tool on our website shows its result, or a file is downloaded from it, we ask for your name, work email address, and company, and you may also tell us roughly how many subcontractors you work with. We use these to know who is using the tools and the files, and we do not add you to a mailing list. They are recorded as an enquiry, as if you had used the contact form, with the name of the tool or file you opened. The answers you give to the compliance scorecard are sent to our server to work out your score, and are not stored.
• Customer Data: the subcontractor, requirement, project, certificate, and coverage records you enter, the documents you upload, and the notes and settings you record.

Information collected automatically

• Log and device information: internet protocol address, browser type, the pages and features requested, dates and times of access, and error reports. Our logs are configured to redact passwords, cookies, credentials, and the tokens contained in upload, report, invitation, reset, and confirmation links.
• Session information: a record of each sign-in and of the sessions on your account.
• Activity records: an audit record of the changes made in a workspace, including who made them and when, and of the viewing and downloading of stored documents.
• Usage information: page views, clicks on sign-up, contact, and pricing links, and named actions in the product (for example, that a subcontractor was added or a reminder was sent). These carry internal identifiers, counts, and statuses only. They do not carry names, email addresses, certificate values, or the contents of any document.
• Referral information: on our public website, the page from which you arrived, held in your browser for the duration of the visit.

Information we receive from others

• From customers: the business contact details of their subcontractors and of the insurance agents and brokers who serve them, and the insurance documents relating to those subcontractors.
• From subcontractors: the documents a subcontractor sends through an upload link issued by a customer.
• From service providers: the delivery status of email we send, including whether a message was delivered, returned as undeliverable, or reported as unwanted, and the status of subscription payments.

We do not knowingly collect sensitive personal information, such as Social Security numbers, government identification numbers, financial account numbers, health information, or precise geolocation, and our Terms of Service prohibit customers from submitting it.

3. How we use information

We use personal information for the following business purposes:

• to provide, operate, and maintain the Services, including comparing certificates against a customer’s requirements, sending reminders and other messages on a customer’s behalf, and producing the reports a customer chooses to share;
• to create and administer accounts, authenticate users, and process subscriptions and payments;
• to communicate with you about the Services, including confirmations, security notices, notices of changes, and responses to your requests;
• to protect the security and integrity of the Services, including detecting, preventing, and responding to fraud, abuse, and security incidents;
• to understand how the Services are used and to maintain and improve them;
• to comply with our legal obligations and to establish, exercise, or defend legal claims; and
• for any other purpose that we describe when the information is collected or to which you consent.

We do not use Customer Data to market to a customer’s subcontractors, and we do not build profiles of subcontractors across customers. We do not use personal information to make decisions that produce legal or similarly significant effects through solely automated processing.

4. Automated reading of certificates, and the help assistant

When a user asks the Services to read a certificate, the document is processed to produce a draft of its contents. A fillable form is read directly by our own systems. A flat or scanned document is sent to a third-party artificial intelligence provider, which processes it to return the draft. Under the commercial terms that govern that processing, the provider does not use the documents we send to train its models. A person reviews and saves every draft; nothing is recorded as the content of a certificate until that happens. The same applies to an endorsement form a user asks the Services to read, to a certificate a visitor submits to the free checker on our website (which is read and not stored), and to a certificate a subcontractor sends through an upload link, which is read once so that the subcontractor can be shown what still appears to be short; that first reading records nothing and decides nothing.

Our website and the Services include a chat that is answered by an artificial intelligence assistant. What a person types into it, and the earlier messages of that conversation, are sent to the same provider together with our published help articles and website pages, and the provider returns the answer. On our website, nothing from any customer’s account is sent with it. Inside the Services, when a signed-in user asks about their own organization’s register, the assistant may look up what is needed to answer, and what it looks up is sent to the provider with the question: the names of subcontractors, their trade, compliance status, findings, exceptions, coverage types, limits and dates, project names, and the name of a subcontractor’s contact and insurance agent. Email addresses, telephone numbers, documents, and billing information are not sent, and the assistant cannot change anything. A lookup is limited to the organization of the user who asked. An organization’s owner can switch this off under Settings, in which case nothing from the account is sent. The same commercial terms apply, so the provider does not use what we send to train its models. An answer is general guidance on using the Services, or a statement of what the register holds, and is not insurance advice.

We keep each conversation: its messages; the name, email address, and company of the person, which a visitor to the website gives at the start of a chat and which we take from the account of a signed-in user; an approximate location (the country, and the region and city where available) derived from the internet address the chat came from; any rating the person gives; and whether the conversation was passed to a member of our team. We do not keep the internet address itself with the conversation, and it is looked up in a database held on our own servers, so it is not sent to anyone to find the location: IP Geolocation by DB-IP. We use conversations to answer the person, to follow up where they ask us to, and to improve the assistant. A visitor who starts a chat is also recorded as an enquiry, as if they had used the contact form.

5. How we disclose information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We have not done either in the preceding twelve months. We disclose personal information only as follows:

• To service providers that process it on our behalf to provide the Services, under contracts that restrict their use of it to that purpose. They are listed below.
• At a customer’s direction. A shared compliance report is readable by anyone who holds its link until the link expires or the customer withdraws it. Reminder emails are sent to the subcontractor and insurance agent addresses the customer provides. When a subcontractor sends a certificate through an upload link, we notify the customer by email and attach the document.
• As required by law, or where we believe in good faith that disclosure is reasonably necessary to comply with a legal obligation or valid legal process, to protect the rights, property, or safety of WatchMyCover, our customers, or others, or to investigate fraud or a violation of our terms. Where the law permits, we will notify the affected customer before disclosing Customer Data.
• In connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business, subject to the commitments in this Privacy Policy.
• With your consent or at your direction.

Service providers

• Vercel Inc.: Hosting of the website and the web application. Location of processing: United States.
• Render Services, Inc.: Hosting of the application programming interface and background processing. Location of processing: United States.
• Neon, Inc.: Database and storage of uploaded documents. Location of processing: United States.
• Resend, Inc.: Delivery of account email and of email sent on a Customer’s behalf. Location of processing: United States.
• Anthropic, PBC: Automated reading of a certificate into a draft, when a user requests it, and answering what a person types into the chat assistant on the website and in the application, including, in the application, what the assistant looks up in that Customer’s own register to answer. Location of processing: United States.
• PostHog, Inc.: Product analytics and error reporting, without Customer Data content. Location of processing: United States.
• Dodo Payments Inc.: Sale of subscriptions as merchant of record, payment processing, and the tax on a purchase. Location of processing: United States.
• Google LLC: Address suggestions while a company address is typed. Location of processing: United States.
• Mintlify, Inc.: Hosting of the help documentation. Location of processing: United States.

If we add or replace a service provider, this list will be updated.

6. Cookies, analytics, and tracking signals

We use a small number of cookies that are strictly necessary to keep you signed in and to protect your account. We do not use advertising cookies, and there are no third-party advertising trackers on our website or in the application.

Our product analytics do not set a cookie and do not use browser storage. The identifier they use is held in memory for the open browser tab only and is discarded when the tab is closed. We do not record sessions, and we do not capture what you type. When you are signed in, analytics events are linked to an internal account identifier and not to your email address. Tokens contained in upload, report, invitation, and password reset links are removed from page addresses before anything is sent, and pages whose address contains such a token send no analytics at all.

Our public website keeps two things in your browser’s session storage: the page from which you arrived and, if you use the chat, that conversation, so that it is still there when you move from one page to another. Both are cleared when you close the tab. It also keeps one item in your browser’s local storage, under the key wmc.lead: a short signed note that you gave your details to a free tool or a download, so that you are not asked for them again. The note holds the day you gave them, a few random characters and a signature, and nothing about you. When you use the compliance scorecard, the note is sent to our server with your answers, to show that the details were given, and is not kept there. When you download the playbook or the file of a template, the note is sent to our server with the name of the file, for the same reason, and the note is not kept there. Neither the note nor the name of the file says who you are. Nothing else is kept under that key. Our server accepts a note for no more than 400 days. The note stays until you clear your browser’s storage for our website, or until you use the scorecard or ask for one of those files after our server has stopped accepting it: the note is then removed and you are asked for your details again.

Because we do not track you across third-party websites or over time, we do not respond to browser “Do Not Track” signals. Because we do not sell or share personal information, there is no sale or sharing from which an opt-out preference signal, such as the Global Privacy Control, would opt you out.

7. Retention

We retain account information and Customer Data for as long as the customer’s account remains open. Certificates that have been superseded are retained rather than deleted, because the history of what was on file on a given date is what an insurance claim or an audit requires; this is a deliberate feature of the Services.

When a customer closes its account or asks us to delete its workspace, we delete the workspace, including stored documents, within 30 days, except for information we are required by law to retain and copies in backups, which are overwritten in the ordinary course. Customers can export their compliance register at any time before closure.

We retain other personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to comply with legal obligations, resolve disputes, and enforce our agreements.

8. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, and destruction. They are described on our security page. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If we determine that a breach of security has resulted in unauthorized acquisition of your personal information, we will notify you and any regulators as required by applicable law. Where the information is Customer Data, we will notify the affected customer as provided in the Data Processing Addendum.

9. Your choices and rights

You may review and update much of your account information in the application. You may ask us to provide a copy of, correct, or delete personal information we hold about you by writing to us at the address in Section 15.

Depending on the state in which you reside, you may have rights under that state’s privacy laws, including the California Consumer Privacy Act and the consumer privacy laws of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states. Subject to exceptions, those rights may include the right:

• to know what personal information we have collected about you, the sources from which it was collected, the purposes for which it is used, and the categories of persons to whom it is disclosed;
• to obtain a copy of your personal information in a portable format;
• to correct inaccurate personal information;
• to delete personal information we collected from you;
• to opt out of the sale of personal information, of its sharing or processing for targeted advertising, and of certain profiling, none of which we engage in; and
• not to be discriminated or retaliated against for exercising any of these rights.

We extend these rights to every individual whose information we hold in our own capacity, whether or not the law of their state requires it.

To exercise a right, write to info@watchmycover.com. We will verify your request by confirming that you control the email address associated with the information, and may ask for additional information where reasonably necessary. You may authorize an agent to make a request on your behalf; we will ask the agent for proof of that authority. We will respond within 45 days, and will tell you if we need up to 45 further days. If we decline your request, you may appeal by replying to our decision, and we will respond to the appeal within 60 days. If the appeal is denied, you may contact the attorney general of your state.

Notice to California residents. In the preceding twelve months we have collected the following categories of personal information, as described in Section 2: identifiers (such as name, email address, and internet protocol address); commercial information (subscription and plan records); internet or other electronic network activity information (usage and log information); professional or employment-related information (company and role); and account log-in credentials. We collect these categories from the sources, use them for the business purposes, and disclose them to the service providers, described in Sections 2, 3, and 5. We retain each category for the periods described in Section 7. California’s “Shine the Light” law permits residents to ask about disclosures of personal information to third parties for their direct marketing purposes; we make no such disclosures.

10. If a customer holds your information

If you are a subcontractor, or an insurance agent or broker for one, your business contact details and the insurance documents relating to your company may be held in the workspace of a WatchMyCover customer with which you do business. That customer decides what is held and how it is used. To access, correct, or delete that information, or to stop receiving messages about it, please contact that customer directly; a reply to any message you received through the Services goes to that customer. If you write to us instead, we will pass your request to the customer and assist the customer in responding to it.

11. Email communications

We send transactional and relationship messages that are necessary to provide the Services, such as address confirmations, password resets, security notices, and billing notices. These are not marketing messages, and you cannot opt out of them while your account is open.

Messages to subcontractors and their insurance agents are sent on behalf of, and identify, the customer that requested them, and concern the recipient’s existing business relationship with that customer. A recipient may reply to any such message to tell the customer that it has reached the wrong person or should stop. We stop sending to any address that returns a message as undeliverable or reports one as unwanted.

If we send you a marketing message, it will include a way to unsubscribe, and we will honor your request within the time the CAN-SPAM Act requires.

12. Children

The Services are directed to businesses and are not directed to children. We do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided personal information to us, please contact us and we will delete it.

13. Users outside the United States

The Services are operated in the United States and are intended for businesses located there. If you access the Services from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those of your country.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The date at the top of this page shows when it was last revised. If we make a material change, we will notify account owners by email or through the Services before the change takes effect.

15. How to contact us

Questions and requests about this Privacy Policy or our privacy practices may be sent to WatchMyCover at info@watchmycover.com.