What we keep, and why.
This notice describes the current business onboarding and sandbox experience. A production privacy policy must be approved before real customer orders are processed.
Information used in this sandbox
We store business contact details, business website, platform, order-volume range, and purchase pattern to set up merchant accounts and review applications. The authenticated workspace stores synthetic order data, delivery issue categories, agreement records, and operational audit events.
With an order we also keep the product names, SKUs, variants, quantities and prices the store sends with it, and the items a customer reports as affected. They are shown to the store, to the customer who files a claim (without prices) and to the Post Coverage support team. For a replacement, the items to send again (names, SKUs, variants and quantities, without prices) also go to the store's warehouse or fulfillment partner.
Synthetic conversations and attachments
Test claim messages, outcome records, reward ledger entries, and delivery events are stored with the company workspace. Customer-visible messages and files can be viewed by that company’s owner and the Post Coverage support team. Internal notes, draft decisions, and staff-only files are restricted to the support team.
Synthetic PNG, JPEG, and PDF attachments are stored in private, encrypted, versioned AWS storage. Original filenames are not retained by the application. File access ends seven days after upload initiation; storage lifecycle cleanup can occur later. Attachment metadata and audit events remain during the sandbox review period. File-format checks and a test-data confirmation do not detect all sensitive information or malicious content.
Business bank setup
Stripe has been selected for future payment collection, with Stripe Connect planned for company reimbursements. Post Coverage’s Stripe account is not connected in this release. The manual bank setup below is separate and does not send those details to Stripe.
If you save ACH details, we store the bank name, account type, intended use, and last four account digits. Account-holder name, routing number, and full account number are encrypted before storage. Company owners control their bank details; administrators see masked client summaries. Post Coverage can separately share its receiving instructions with reviewed company owners. Full-detail views and bank changes are logged. Saved details do not verify ownership or authorize a debit.
Why it is used
This information supports account access, merchant review, sandbox integration testing, agreement assignment and acceptance, troubleshooting, and security. We do not ask for customer names, contact details, street addresses or payment details, and uploads of real customer data are not supported.
Where it is processed
The sandbox is hosted on Amazon Web Services in the United States, primarily in US East (Northern Virginia). Static website content is delivered through AWS hosting infrastructure. Business records are stored in DynamoDB and account credentials are managed by Cognito.
Browser storage and analytics
Essential sign-in state and session tokens are kept in the current browser tab’s session storage. There are no advertising pixels or third-party marketing analytics in this release. The dashboard demo uses fictional records and resets when reloaded. Full bank details are not saved in browser storage. Revealed details hide after two minutes or when the browser tab is hidden.
Retention and requests
Application and API metadata logs are retained for 30 days. Business, agreement, and audit records are retained during the sandbox review period; automated deletion of those records is not yet enabled. Removing saved bank details removes the active account record; historical encrypted backups may remain within backup retention. Contact your Post Coverage account representative for access, correction, or removal requests. A formal retention policy and privacy contact must be finalized before public onboarding at scale.
Keep real customer details out of the sandbox
Do not provide real customer names, email addresses, phone numbers, street addresses, or payment details in this sandbox. For a problem with a real order, contact the store you bought from.