Privacy Policy

Last Updated: August 2026 | Version 1.2.0

At Insure Assist AI, a software platform owned and operated by CODE4 ENTERPRISES LLC, an Arizona limited liability company ("Company", "Provider", "we", "us", or "our"), we are committed to protecting the privacy, security, and integrity of the data processed on behalf of our subscribing brokerages and agencies (the "Broker", "Agency", or "Customer"). This Privacy Policy describes how we collect, use, store, and protect your information.

1. Scope and Delineation of Roles

Data Processor (Customer Content): For all policyholder Personally Identifiable Information (PII) and Sensitive Personal Information (SPI) uploaded, transmitted, or generated by the Broker (including insurance policies, certificates, client rosters, call recordings, and transcripts), CODE4 ENTERPRISES LLC acts strictly as a Data Processor (or "Service Provider" under the California Consumer Privacy Act). We process this data solely on behalf of, and in accordance with the documented instructions of, the Broker (the Data Controller).

Data Controller (Administrative Data): CODE4 ENTERPRISES LLC acts as a Data Controller only for administrative data collected directly from Customer's authorized users (e.g. login emails, subscription details, billing data, diagnostic telemetry, and usage activity).

Data Processing Terms: The processing of Customer Content is governed by our Master Subscription Agreement and incorporated data processing terms, which mandate strict technical safeguards and confidentiality.

2. Categories of Information Processed

We process the following categories of data in connection with the Services:

• Account and Billing Data: Names, agency email addresses, phone numbers, and encrypted billing tokens (tokenized and processed securely via Stripe).
• Customer Content: All PII and SPI (including government identifiers, tax IDs, addresses, and policy limits) contained within insurance policies, endorsements, or ACORD files uploaded by Customer.
• Telephony and Voice Data: Caller phone numbers, call duration logs, audio recordings of calls, and text transcriptions of voice communications routed through our front-desk assistant features.
• Usage and Diagnostic Data: IP addresses, login timestamps, device operating system details, browser signatures, and application crash reports (tracked securely via Sentry).

3. Cookies and Local Storage Technologies

Essential Storage Only: We utilize cookies and browser local storage (specifically Firebase Authentication local storage tokens) solely to authenticate users, persist login sessions, and maintain secure portal navigation.

No Marketing Tracking: These technologies are strictly functional. We do not use advertising cookies, tracking pixels, or cross-context behavioral tracking technologies inside the authenticated portal.

4. Generative AI Data Privacy Commitments (Vertex AI)

To protect proprietary underwriting data and client privacy:

• Secure Cloud Processing: All document text extraction, OCR parsing, and AI operations are executed within secure Google Cloud Platform boundaries.
• No Foundational Training: CODE4 ENTERPRISES LLC warrants that Customer Content, AI prompts, and extracted policy metadata are NEVER shared with third-party public AI providers, nor are they used to train, retrain, or improve foundational machine learning models.

5. Data Sharing and Trusted Sub-processors

CODE4 ENTERPRISES LLC does not sell, rent, or share Customer Content with third parties for cross-context behavioral advertising. We disclose data to the following categories of sub-processors only to deliver the core Platform services:

• Cloud Infrastructure & Hosting: Google Cloud Platform (GCP) for data storage, Cloud SQL PostgreSQL databases, and Cloud Run server compute in the United States.
• Identity Management: Firebase Authentication for secure, passwordless magic-link sign-ins.
• Payment Processing: Stripe, Inc. for PCI-compliant billing and subscription management.
• Transactional Communications: Loops.so & Resend for transactional emails and onboarding notifications.
• Diagnostics & Monitoring: Sentry for real-time error tracking and system health diagnostics.

6. Data Retention & Storage Lifecycle

• Active Subscription Persistence: Client profiles, active policy limits, endorsement schedules, and Certificate of Insurance issuance histories are securely retained in Google Cloud Platform throughout the duration of Customer's active subscription to power real-time, on-demand certificate generation.
• On-Demand Deletion: Agency administrators can delete individual client accounts, policies, or documents at any time directly through the portal dashboard, which immediately triggers permanent deletion from live storage.
• Account Termination Grace Period: Administrative data is retained as long as the Customer's subscription is active. Upon contract termination or cancellation, Customer data is retained for a thirty (30) day export grace period, after which all associated databases and storage objects are queued for permanent deletion.

7. California-Specific Disclosures & Sensitive Personal Information (SPI)

No Selling or Sharing: We do not "Sell" or "Share" personal information or Sensitive Personal Information as those terms are defined under the CCPA/CPRA.

SPI Processing Restriction: We collect and process government identifiers and financial account information (categorized as Sensitive Personal Information) uploaded in policies solely to perform the Services requested by Customer, in compliance with CCPA regulations. Because our use of SPI is strictly limited to these exempt, service-delivery purposes, we do not offer or require a "Limit the Use of My Sensitive Personal Information" link.

8. Client Self-Service Portal Disclosures

If you are a client or policyholder accessing our Client Self-Service Portal on behalf of a subscribing Brokerage/Agency, we collect and process your contact email, session tokens, IP address, and transaction logs (such as COI request history and document downloads).

We process this information strictly to authenticate your identity, prevent unauthorized data access (BOLA/IDOR prevention), maintain portal session security, and provide transaction audit logs to the subscribing Brokerage/Agency. We do not use client portal telemetry or contact data for any marketing or advertising purposes.

9. Security Safeguards

We implement industry-standard administrative, physical, and technical controls to secure your data, including:

• Encryption in Transit: All traffic is encrypted using TLS 1.3.
• Encryption at Rest: Databases and storage buckets use Google-managed encryption keys (AES-256).
• Access Isolation: Centralized IAM policies, strict Row Level Security (RLS) at the database layer, and secure API header tokens.

10. Data Subject Rights & Requests

B2B Context: Under CCPA/CPRA, GDPR, and other state privacy frameworks, individual policyholders whose data is uploaded by Customer must direct their rights requests (access, deletion, correction) to the Broker (the Data Controller).

If an individual contacts Insure Assist AI directly regarding their personal data, we will forward that request to the Broker within five (5) business days and assist the Broker in fulfilling the request.

11. Data Breach Notification Policy

In the event of a confirmed security incident resulting in unauthorized access, alteration, or deletion of Customer Content, CODE4 ENTERPRISES LLC will notify Customer's designated administrative contact within seventy-two (72) hours of verification.

The notification will describe the nature of the breach, the estimated categories of data affected, and the mitigation measures taken or planned.

12. International Data Transfers

All Services are hosted and processed within Google Cloud Platform data centers located in the United States. Customer is responsible for ensuring compliance with any local regulations regarding international data transfers.

13. Children's Privacy

Our Services are designed strictly for commercial business use and are not directed to individuals under eighteen (18) years of age. We do not knowingly collect personal data from minors.

14. Governing Law & Privacy Contact

This Privacy Policy is governed by the laws of the State of Arizona, USA. For questions or privacy requests, please contact:

• Entity: CODE4 ENTERPRISES LLC (d/b/a Insure Assist AI)
• Email: privacy@insureassistai.com
• Jurisdiction: State of Arizona, United States