Privacy policy

Recoupa helps you find and reclaim unclaimed property held by state and institutional databases. To do that we need some of your information — your name, contact details, and (when you file a claim) the documents the state requires to verify you are the rightful recipient. We don't sell your information. We share it only with the state offices we're helping you file with, the vendors we use to run the service (listed below), and our team.

From a search

When you search the unclaimed-property database on /search we send the name(s) and state(s) you typed to our backend. Search activity is logged for product analytics (see "Analytics" below) — we don't tie your search to your identity unless you also create an account.

When you sign up or file a claim

• Your name, mailing address, phone number, and email address.
• The unclaimed-property records you select for filing — the holder name, amount, NAUPA category, and the state-issued property identifier.
• Identification documents you upload (typically government-issued photo ID and proof of address — driver's license, utility bill, passport, etc.).
• For estate or beneficiary claims, additional documentation the state requires (death certificate, letters testamentary, etc.).
• Your electronic signature on the engagement letter that authorizes Recoupa to file the claim on your behalf.

Automatically

• Page-view events on /p/<slug> claim-package pages. We log one row per render with a session identifier (a random ID held in browser sessionStorage), the IP-derived country header from our CDN, your user-agent string, and a SHA-256 hash of your IP address. We do not store raw IP addresses.
• Slug-404 attempts — when someone reaches/p/<wrong-slug>, we log the attempt with the same envelope so we can spot typo patterns in outbound mailings.
• Error reports via Sentry when something breaks. Sentry events include a stack trace and the page URL.
• Product analytics via PostHog (page views, feature usage, claim funnel progression). PostHog is configured to not capture form field contents.

• File claims with state offices on your behalf. This is the core service. The state requires the information above to verify your identity and process the claim.
• Communicate with you. We send transactional email (claim confirmations, status updates, requests for additional documentation) via Resend from claims@mail.recoupa.co. If you opt in to marketing communications, we may also send periodic updates about the service.
• Operate the product. Analytics + error tracking help us debug, improve search relevance, and spot bottlenecks in the claim funnel.
• Detect fraud. If we see patterns suggesting someone is trying to claim property that isn't theirs, we will refuse to file and may contact law enforcement.

We don't sell your personal information. We do share it with these categories:

• State unclaimed-property offices — every claim filing must include the documentation the state requires. Each state's office has its own privacy practices, governed by that state's law.
• Service providers we use:
  • Supabase (authentication and account database) — US region.
  • Vercel (frontend hosting) — global edge CDN, US primary region.
  • Render (FastAPI backend, US region).
  • Cloudflare R2 (Parquet snapshot storage of public unclaimed-property records — note: this database is derived from public state records, not from identifying information you provide).
  • Resend (transactional email).
  • DocuSign (electronic signature).
  • Sentry (error reporting). Sentry is configured to scrub identifying form fields before storage.
  • PostHog (product analytics).
  Each is bound by a data processing agreement requiring them to use your information only to provide their service to us.
• Legal compliance — if compelled by a valid subpoena, court order, or government investigation.
• Successors — if Recoupa is acquired or undergoes a corporate reorganization, your information would be transferred to the successor under the same privacy commitments.

Claim records and the supporting documents are retained for the longer of (a) the statutory retention period required by the state we filed with (typically 7 years) or (b) the duration of an open dispute or audit.

Account data is retained while your account is active. If you close your account, we retain a minimal record of filed claims for the period above and delete everything else within 30 days.

Analytics and error-tracking events have shorter retention (Sentry: 90 days; PostHog: 1 year on the free tier — we may extend later).

For everyone

• Access. You can request a copy of the personal information we hold about you by emailing legal@recoupa.co. We'll respond within 30 days.
• Correction. If anything we have about you is wrong, ask us to fix it.
• Deletion. You can ask us to delete your account and supporting information, subject to the retention rules above for filed claims.
• Opt out of marketing. Every marketing email has an unsubscribe link. Transactional email (claim updates) is part of the service and cannot be opted out of without closing your account.

California residents (CCPA / CPRA)

California gives you additional rights: to know what categories of personal information we collect, to request deletion, to opt out of any "sale" or "sharing" of personal information (we don't do either), and to be free from discrimination for exercising these rights. Email legal@recoupa.co to exercise any of these rights. You can authorize an agent to make the request on your behalf.

We use cookies for two purposes: (1) keeping you signed in to your account, and (2) measuring whether the site is working (PostHog session cookie, Sentry session cookie). We do not use third-party advertising cookies. If you block cookies in your browser, the site will still work but you'll need to sign in more often.

When you provide your contact details while creating a claim on our site (the contact step at /claim), you can choose to opt in to SMS updates about your claim by entering your mobile number and checking the consent box. We do not send SMS to anyone who hasn't completed this opt-in step — there is no pre-checked box, no carry-over consent from another channel, and no purchased lists.

What we collect

• The mobile phone number you provide on the opt-in form.
• The timestamp of your opt-in consent and the IP address it came from, stored on your claim record as the audit trail.
• Message-delivery metadata returned by our messaging provider — delivered / failed status, carrier code, and timestamps. We don't store the body of incoming replies beyond what's needed to recognize the STOP and HELP keywords.
• Opt-out events (a Reply STOP, or a request to legal that we stop messaging you).

Who we share it with

We use Telnyx as our 10DLC-registered messaging platform; Telnyx routes the message through the recipient's US mobile carrier (AT&T, Verizon, T-Mobile, etc.). Telnyx and the carriers process your phone number only for the purpose of delivering the message. We do not share your SMS information with anyone else for marketing purposes, and we do not sell it.

How long we keep it

Your phone number and the related delivery metadata are retained for the same period as the underlying claim package (see "How long we keep it" above — typically 7 years to match the state retention requirement). Opt-out records (Reply STOP events and the resulting suppression-list entry) are kept indefinitely as a compliance audit trail, so we can prove we honored your opt-out if the question ever comes up.

Your right to opt out

You can opt out of SMS at any time by replying STOP to any message you receive from us. The opt-out is processed immediately and is permanent for that number — we won't message you again unless you actively re-opt-in on your claim page. Reply HELP for contact information. Message and data rates may apply, and message frequency varies based on the activity on your claim.

We use HTTPS everywhere. Authentication uses one-time magic-link email (via Supabase Auth) — we don't store passwords. Uploaded documents are encrypted at rest. We limit internal access to your information on a need-to-know basis. We're honest that no system is perfectly secure — if a breach happens we will notify affected users within the timeframe required by applicable law.

Recoupa is intended for adults. We don't knowingly collect personal information from anyone under 18. If you believe we have, email legal@recoupa.co and we will delete it.

Recoupa serves residents of US states only. If you're outside the US, the unclaimed-property records we search may not be relevant to you, and we don't currently support cross-border claims.

If we materially change how we handle your information, we'll update this page and notify account holders by email. The effective date at the top reflects when this version was published. We'll keep older versions available on request.

Email: legal@recoupa.co