Privacy Policy

01

Who we are

InsurPilot is a software company. We build artificial-intelligence tools for independent insurance agencies — things like quoting support, renewal automation and workflow routing.

We are not an insurance agency, broker, managing general agent or carrier. We do not quote, rate, bind, sell or place insurance, and we do not give insurance advice. This website is a marketing website; it is not a quoting or servicing system.

The full legal entity behind InsurPilot, including any registered trading name, state of formation and registered address, is NEEDS COMPANY CONFIRMATION.

02

What this notice covers

This policy applies to the InsurPilot marketing website and the three forms on it: the Register Your Agency form, the contact form, and the newsletter sign-up. It explains what those forms collect, what happens to that information, and what choices you have.

InsurPilot is pre-launch. There is no logged-in product, there are no customer accounts, and we do not currently hold any agency's book of business, any policy data, or any information about an agency's clients. Nothing on this website connects to a carrier, an agency management system or a rating engine.

When the product launches it will be governed by a separate product privacy notice and, where an agency's own data is involved, a data processing agreement. This notice will not be stretched to cover the product. NEEDS COMPANY CONFIRMATION — leadership should confirm this commitment before it is published, since it is a promise to prospective customers.

03

Insurance data and GLBA

Because we sell to insurance agencies, it is worth being explicit about what we do not handle. Through this website we do not collect:

• Social Security numbers or taxpayer identification numbers
• Driver's licence numbers, motor vehicle records or driving history
• Claims history, loss runs or policy documents
• Credit reports or credit-based insurance scores
• Health, medical or biometric information
• Any information about your clients, insureds or policyholders
• Payment card or bank account details

We are not a "financial institution" under the Gramm-Leach-Bliley Act, and this notice is not a GLBA privacy notice. We are not claiming any exemption available to licensed insurance entities, because we are not one. NEEDS COMPANY CONFIRMATION — counsel should confirm that InsurPilot holds no resident or non-resident producer or agency licence in any state before this paragraph is published.

04

Information we collect

We only collect information you choose to give us - what you type into one of the forms below, or into the chat assistant described in section 7. We do not buy contact lists, and we do not use data brokers, lead vendors or enrichment services to add to what you give us.

Register Your Agency form

This form collects:

• Your full name
• Your agency's name
• Your email address
• Your phone number
• Your country
• Your agency's website (optional)
• Number of employees
• Expected monthly new clients (optional)
• Services offered (optional)
• Free-text notes about your current systems and pain points (optional)

The free-text field is open, so please use your judgement: send us enough to describe your situation, and no confidential client information.

Contact form

Your email address, your phone number, and your message.

Newsletter sign-up

Your email address only.

Each submission is stored with the date and time it was received. Submissions are written to a database that InsurPilot controls.

05

Information collected automatically

The website itself runs no analytics. There is no Google Analytics, no tag manager, no advertising or conversion pixel, no session-recording or heat-mapping tool, and no cross-site tracking of any kind. We do not build profiles of visitors and we do not track you across other websites.

We do not record your IP address with your form submission. Our database has a field capable of storing one, but the form handlers do not write to it, so it is empty for every contact, registration and newsletter submission.

Messages to the chat assistant are the exception: those are stored with your IP address. If you would rather we did not hold that, do not use the assistant — the forms and the email address in section 19 reach us just as well. Section 7 sets out in full what the assistant records.

Like almost every website, ours runs on a web server that may keep standard access logs, which typically record IP addresses, browser user-agent strings, timestamps and the pages requested. These logs are created and controlled by our hosting provider rather than by our application. NEEDS COMPANY CONFIRMATION — what our host actually logs, whether we can access it, and how long it is kept.

06

Cookies and similar technologies

We use no advertising, analytics or tracking cookies. There is no consent banner on this site because there is nothing to consent to.

Our web platform sets one strictly necessary session cookie (PHPSESSID) when you load a page. It contains a random identifier, it is not used to identify or track you across sites or to build any profile of you, and it expires when you close your browser. The chat assistant reads it for two housekeeping jobs: keeping your messages together as one conversation, and counting them so a single visitor cannot flood the service. There is no advertising or measurement purpose behind it.

We use no web beacons and no device fingerprinting, and we store nothing permanently in your browser. The one thing we do keep there is your open chat thread, held in the tab's own temporary storage so the conversation is not lost when you move between pages; your browser discards it when the tab closes, and it is never used to recognise you. Because we do not track visitors across sites, a browser "Do Not Track" or Global Privacy Control signal makes no difference to how this site behaves — there is no cross-site activity for it to switch off.

07

The AI assistant

Every page on this site carries a chat assistant in the bottom corner. It is optional — it does nothing until you open it and type. But if you do use it, two things happen that are worth stating plainly, because neither is obvious from the widget itself.

Your messages are sent to Google

The assistant is not a scripted menu and it does not run on our own hardware. It is powered by Google's Gemini API. When you send a message, that message and the recent part of your conversation are transmitted to Google's servers, which generate the reply. Google's handling of that data is governed by Google's privacy policy and its API terms, not by this notice.

Because of this, please treat the chat box the same way you would treat the free-text field on a form: describe your situation freely, but do not type confidential client information, policy numbers, or anyone's personal or financial details into it.

Your conversation is stored on our side

We keep a transcript. Each exchange is written to our database as a single record containing your message, the assistant's reply, the page you were on when you asked, the date and time, a random session identifier that groups your messages into one thread, and your IP address.

We read these transcripts to understand what visitors actually want to know and to fix answers the assistant gets wrong. Note the difference from our forms: form submissions do not record an IP address, but chat messages do.

Separately, your browser keeps the visible thread for the current tab so the conversation survives moving between pages. It is held in the tab's own temporary storage, never leaves your device, and is discarded when you close the tab. Your browser also holds the session cookie described in section 6, which the assistant uses to count messages and apply a rate limit.

Booking a consultation through the assistant

You can ask the assistant to book a consultation. If you go through with it, it collects your name, email address and phone number, then creates the appointment directly on our company Google Calendar and asks Google to email you a calendar invitation. We store the booking — your name, email, phone, the time slot, and a four-digit reference — in our own database so that you can look it up, move it or cancel it later.

To change or cancel a booking, the assistant asks for both the four-digit reference and the email address it was booked with. It requires both on purpose: the reference alone is short enough to guess, and we do not want anyone able to cancel someone else's meeting.

This is a different route from the "Schedule Meeting" button on our contact page, which hands you over to a Google-hosted booking page instead. Section 8 covers that one.

What the assistant is not

It answers questions about InsurPilot from a fixed set of information we wrote. It has no access to any customer account, any agency's book of business, or any policy data, because this website holds none of that. It cannot give insurance advice, quote a policy, or bind coverage.

NEEDS COMPANY CONFIRMATION — how long chat transcripts should be kept before deletion, who internally may read them, and whether the Google account used for the Gemini API is covered by terms that exclude the content from being used to train Google's models. That last point should be settled before launch, and the answer stated here.

08

Third-party services

We keep the number of outside services this website touches deliberately small. As things stand there are three, and we would rather name them than describe them vaguely.

Google Fonts. Our pages load typefaces from Google's font servers. To deliver a font, Google receives your IP address and browser user-agent string. We receive nothing from Google in return, and no cookie is set by this. Google's handling of that request is governed by Google's privacy policy.

Google Gemini. Our chat assistant runs on Google's Gemini API. Anything you type into it is sent to Google to produce the reply, and we store a copy of the exchange ourselves. This is the most significant transfer on the site, so it has its own section — see section 7.

Google Calendar appointment booking. The "Schedule a meeting" button on our contact page opens a Google-hosted booking page in a new window. If you book a time there, you are giving that information to Google's scheduling service, and its use is governed by Google's privacy policy rather than this one. The chat assistant can also book a consultation, but it does so by a different route — it writes the appointment to our own company calendar and keeps a record in our database. Section 7 describes that path. NEEDS COMPANY CONFIRMATION — confirm which company account this booking page belongs to and what it collects at the point of booking.

Beyond those, we rely on a hosting provider to run the website and the database. NEEDS COMPANY CONFIRMATION — whether to name the hosting provider here, and whether any written data processing terms are in place with them.

09

How we use information

We use what you submit to:

1. Reply to your enquiry or your registration of interest
2. Understand whether InsurPilot is a fit for your agency, and follow up about it
3. Keep you informed about launch timing and product availability, if you asked us to
4. Operate, maintain and secure the website
5. Meet legal obligations and enforce our rights where necessary

We do not use your information for automated decision-making or profiling, and we do not use it to advertise to you elsewhere.

NEEDS COMPANY CONFIRMATION — whether people who submit a form will receive ongoing marketing email in addition to direct replies, and whether anyone will follow up by phone call or SMS. If phone or SMS follow-up is intended, a consent line belongs on the form itself, next to the submit button, not only in this policy.

10

How long we keep information

We keep form submissions for as long as we are in contact with you about InsurPilot, and for a reasonable period afterwards so that we can pick the conversation back up. Newsletter subscriptions are kept until you unsubscribe.

Chat transcripts and consultation bookings are kept on the same basis. Transcripts — including the IP address recorded with them — are retained so we can improve the assistant's answers. Booking records are retained so a meeting can still be found, moved or cancelled by reference afterwards. Cancelling a meeting marks the record cancelled; it does not erase it.

We have not stated a fixed retention period, because no automatic deletion currently runs and we would rather be honest than quote a number nothing enforces. If you want anything we hold about you deleted, ask us using the details in section 19 and we will do it.

NEEDS COMPANY CONFIRMATION — decide actual retention periods for form submissions, chat transcripts, booking records, backups and server logs, then either state them here or implement them. Transcripts are the most sensitive of these, because visitors type freely into a chat box and their IP address is stored alongside; they deserve the shortest period the business can live with.

11

When we disclose information

We may share what you submit in three situations, and no others:

1. Service providers. Companies that host our website and database, or that help us send email, strictly so they can provide that service to us.
2. Legal reasons. Where we are required to by law, subpoena or other legal process, or where we need to establish or defend legal claims, or to protect the safety and rights of others.
3. Business transfer. If InsurPilot is involved in a merger, acquisition, financing or sale of assets, information may transfer as part of that transaction. We would give notice before your information became subject to a materially different policy.

We do not share your information with insurance carriers, wholesalers, rating services, agency management systems or lead marketplaces. No such integrations exist yet, and if that changes, this notice changes first.

12

We do not sell your information

We do not sell personal information. We do not rent, trade or otherwise disclose it to third parties for their own marketing purposes, and we do not share it for cross-context behavioural advertising. We have never done so, and there is no advertising technology on this site that would make it possible.

13

Your choices and rights

Privacy laws in the United States apply differently depending on where you live, the size of the business and what it does with data. Rather than make claims about which statutes reach us, we would rather make you a straightforward offer.

Wherever you live, and whether or not a particular privacy law applies to us, you can email us and ask to:

• See what information you submitted to us
• Correct anything that is wrong
• Have it deleted
• Stop receiving email from us

We will act on those requests. We may need to ask a question or two to confirm you are the person who submitted the information, and we will not treat you differently for asking. Every marketing email we send will also carry an unsubscribe link.

If you think we have got something wrong, reply and tell us and we will look at it again. As InsurPilot grows and the product launches, we will revisit this section and set out any additional statutory rights that then apply. NEEDS COMPANY CONFIRMATION — counsel should confirm whether InsurPilot currently meets the applicability thresholds of any state privacy statute, and whether a state-specific rights section is required.

14

How we protect information

Form submissions go to a database that only InsurPilot can reach, and our forms use parameterised database queries, which is the standard defence against injection attacks. We limit access to submissions to people who need it.

We are deliberately not claiming any certification. InsurPilot does not hold SOC 2, ISO 27001 or any comparable audit, and we do not have a published penetration-testing schedule. We would rather say so than imply otherwise. As we move towards launch we intend to put a formal security programme in place and describe it properly.

NEEDS COMPANY CONFIRMATION — HTTPS redirection is currently switched off in the site configuration, so we cannot yet state that all traffic to this site is encrypted in transit. This should be enabled before the policy is published, and then said plainly here.

No website or database can be guaranteed completely secure, and we cannot promise that. What we can promise is that we will not overstate what we have.

15

Children's privacy

InsurPilot is sold to insurance businesses. This website is intended for business use by adults and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has submitted information to us, contact us and we will delete it.

16

Links to other websites

Our site links out to other places — our social media profiles, the Google booking page described above, and occasionally sources referenced in our blog. Once you follow a link you are on someone else's website, governed by their privacy policy and not this one. We do not control those sites and are not responsible for their practices.

17

Visitors outside the United States

InsurPilot is a United States-facing business and our systems are operated for a US audience. Our forms ask for your country, so we know some enquiries come from elsewhere. If you submit information from outside the United States, understand that it will be handled in the United States, where privacy laws differ from those in your own country.

NEEDS COMPANY CONFIRMATION — whether InsurPilot intends to market to or accept customers in the EU, UK or Canada. If so, this section needs proper treatment of those regimes rather than this general notice.

18

Changes to this policy

We will update this policy when what we do changes — and in particular before the product launches, which will change a great deal. When we do, we will change the effective date at the top. If a change materially affects how we handle information you have already given us, we will make a point of telling you rather than relying on you to notice.

19

How to contact us

For any privacy question, or to make any of the requests in section 12, email us at Insurpilot@gmail.com and put "Privacy" in the subject line so it reaches the right person.

NEEDS COMPANY CONFIRMATION — a dedicated privacy address on the company domain would be better than a shared general inbox, and a postal mailing address is required here: US anti-spam law obliges commercial email to carry a valid physical address, and several state disclosure laws expect one in the policy itself.