Trust

How ColdConvert handles your data and your candidates' data.

Operational practices, plain language. Legal text lives on privacy and terms.

Data we collect

· Account info: email, agency name, recruiter role, workspace settings.
· Candidate data you upload: names, contact info, specialty, license state, shift, weekly pay, certs, contract dates.
· Send events: delivery, reply, opt-out, bounce, complaint timestamps.
· Usage telemetry: in-app actions, page views, API calls.
· Never patient data. Never PHI. Our scanner blocks it before send.

Verified domain (SPF / DKIM / DMARC). Warmup gates. Rate caps.

Suppression list. STOP / HELP automatic. Recorded opt-in for SMS.

PHI markers blocked. Required opt-out language. AI content review.

Bounce auto-pause. Complaint auto-pause. Quiet-hours gates.

· Every send is hash-stamped: SHA-256 of the message body, recipient, timestamp.
· Every clickwrap acknowledgement is captured with IP, user-agent, and document version.
· Every consent event (opt-in, STOP, HELP) is logged immutably.
· Available on request for legal defense or audit.

Third-party services that handle data on our behalf:

· Supabase (database + auth)

· Railway (app hosting)

· Resend (email delivery)

· Telnyx (SMS delivery)

· Vapi (AI voice)

· Memberstack (authentication UI)

· Webflow (marketing site)

· Cloudflare (CDN, edge)

Email bgrantom@coldconvert.net. Founder answers personally within one business day.