Privacy Policy

We collect account and contact details, authentication and security records, billing status, device and network information, and the client or policy information users choose to enter or upload.

Insurance workflows may contain sensitive personal, financial, health, beneficiary, and policy information. Users must collect and submit that information only with proper authority and consent.

We use information to provide secure intake, client management, calling, policy, compensation, document, support, fraud-prevention, and account-security functions. We do not sell personal or health information.

InsureFlow uses encryption, private file access, account-level permissions, session controls, activity monitoring, rate limits, and restricted administrative access. Sensitive temporary intake fields are designed for limited retention.

No online service can guarantee absolute security. Users must protect their credentials, use authorized devices, promptly report suspected access, and follow their agency's security policies.

InsureFlow provides technical safeguards intended to support secure handling of health-related information. HIPAA compliance depends on the service configuration, the customer's policies and practices, and the legal relationship between the parties.

Before using InsureFlow for protected health information, a covered entity or business associate must determine whether HIPAA applies, confirm that required safeguards are enabled, and execute a Business Associate Agreement with InsureFlow when legally required. This policy is not a Business Associate Agreement.

Information is disclosed only as needed to operate the service, follow user instructions, protect rights and safety, or comply with law. Carriers and other recipients process information under their own policies. We do not sell personal or health information.

The service currently relies on these categories of providers:

• Cloud hosting, database, authentication, and file storage — Lovable Cloud, which stores account, client, and encrypted document data.
• Calling and phone numbers — Twilio, which processes phone numbers and call metadata to place and receive calls.
• Text messaging to clients — GoHighLevel, which sends the messages agents configure (intake links, reminders, birthday and holiday texts) to the phone numbers agents provide.
• Subscription billing — Stripe, which processes payment cards for platform subscriptions. Card numbers go to Stripe, not to InsureFlow.
• Operational alerts — Discord and SMS, used for security and failure alerts that contain event references only, never client personal information.

Sensitive intake details (Social Security and banking numbers): encrypted, then permanently erased about ten minutes after submission, or sooner when the agent opens or downloads them. A scheduled cleanup runs every few minutes as a backstop.

Intake links and client access codes: links expire 72 hours after they are sent; one-time codes are stored only as scrambled hashes and stop working after a single submission.

Book of Business records and policy-packet PDFs: kept until an authorized user deletes them. Saved packets can contain full Social Security and banking numbers and are not part of the ten-minute intake deletion.

Consent, signature, security, and billing records: retained as needed for legal, accounting, and fraud-prevention purposes. Encrypted backups may retain data for a limited additional period; deletion rules are re-applied before any restored backup is served.

If we confirm a security incident affecting personal information, we investigate, contain it, and notify affected users and authorities as required by applicable law. Operational and security alerts are monitored independently of the main application so that a failure of the application itself does not silence alerting. Alerts never include client personal information.

Privacy, access, deletion, or security requests may be submitted through the support channel shown in your account. We may verify identity and authority before acting. The legal name and mailing address of the platform operator will be listed here once provided by the operator.

Authorized users may review, correct, export, or delete supported account records through the product. Privacy, access, deletion, or security requests may be submitted through the support channel shown in the account. We may verify identity and authority before acting.

We may update this policy as the service or law changes. Material changes will be reflected by a new effective date and, when appropriate, an in-product notice.