Privacy Policy

This policy is a working draft. It has not been reviewed by a lawyer and is not final. It is here so the acceptance machinery can be built and tested against real text rather than placeholder filler. Replace it by publishing version 2 before any real customer is asked to agree to it.

1. What this covers

This policy describes what we do with personal data when you use Insurvas. It covers data about you and your staff. Data about your own clients is data you control and we process on your behalf, under the agreement between us.

2. What we collect

• Account data: name, work email, phone number, and the password you set (stored only as a hash, never in a form we can read).
• Business data: your agency name, licence number, states you operate in, and the products you sell.
• Usage data: when you sign in, from what IP address, and what you did in the product. We record failed sign-in attempts too, because that is how account takeover is detected.
• Billing data: we do not store card numbers. Our payment provider holds those; we hold a customer reference, and a record of what was charged.

3. Why we use it

To provide the service, to bill you, to keep the service secure, to support you when you ask, and to tell you about things that affect your account — such as a trial ending or a change to these documents.

4. What we share

• Our payment provider, to take payment.
• Our infrastructure providers, who host the service.
• Anyone we are legally required to disclose to.

We do not sell personal data and we do not share it for advertising.

5. How long we keep it

For as long as you have an account, and for a reasonable period afterwards to meet legal and accounting obligations. Records of what you agreed to, and when, are kept for as long as they might be needed as evidence.

6. Your rights

You can ask for a copy of your personal data, ask us to correct it, or ask us to delete it. Some records we must keep — billing history, and acceptance records — and we will tell you if that applies.

7. Security

Access to production data is limited to people who need it. The two halves of the system are separated so that a session for one cannot be used for the other. Sensitive records such as invoices, payments and acceptance records cannot be edited or deleted by anyone, including us.

8. Contact

To be completed with a real contact address before this policy is finalised.