Privacy Policy

We collect information you provide directly and information generated through your use of the platform:

• Account Information: Name, email address, phone number, agency name, role, and password when you register or are invited by an administrator.
• Agency & Client Data: Client and lead records, policy details, claims, commission records, carrier information, documents, discovery forms, task and activity data, and all other business data you create within the platform.
• Billing Information: Payment method details processed securely through Stripe. We do not store full card numbers.
• Usage Data: Pages visited, features used, and actions taken within the app to improve product quality.
• Device & Technical Data: IP address, browser type, operating system, and device information for security and performance monitoring.
• Phone & Call Data: If you use the built-in phone system (powered by Twilio), we process call metadata including caller/recipient numbers, call duration, call status, and call recordings if enabled. Call recordings are stored in your agency's account.
• Meeting Recordings & Transcriptions: If you use the AI Meeting Recorder feature, audio recordings are captured via your device microphone, sent to Deepgram for transcription, and sent to Anthropic Claude for AI summarization. Audio files and transcripts are stored in your agency's database with strict access controls.
• AI Processing Data: Content you submit to AI-powered features (AI Assistant, meeting summarization, document parsing, loss run analysis) is sent to Anthropic's Claude API for processing. We do not use your data to train AI models. Deepgram processes audio for speech-to-text transcription and does not store audio after processing.
• Discovery Form Data: Information submitted by prospects through discovery form links, including business details, coverage needs, employee information, loss history, and all coverage module responses.
• Document Data: Files you upload including policy documents, loss runs, certificates of insurance, and other business documents. Documents and meeting recordings are encrypted with AES-256-GCM at the application level before database storage and decrypted only when accessed by an authenticated user within the same agency.
• E-Signature Data: Signature images, IP addresses, timestamps, and document hashes collected during the electronic signature process for audit trail compliance.
• Mobile App Data: Authentication tokens stored securely in iOS Keychain or Android Keystore. Push notification tokens for delivering alerts.

We use collected information to:

• Provide, operate, and improve the Insurstein platform and mobile application
• Process payments and manage your subscription
• Manage multi-tenant agency data with strict isolation between organizations
• Process audio through Deepgram for meeting transcription with automatic speaker diarization
• Process content through Anthropic Claude AI to power AI-assisted features (meeting summaries, document parsing, assistant capabilities) — strictly limited to generating requested outputs
• Facilitate phone calls via Twilio WebRTC and manage call recordings
• Send transactional emails (password resets, invite links, discovery form notifications, claim alerts)
• Send SMS notifications when enabled
• Deliver push notifications to mobile devices for task reminders and alerts
• Generate certificates of insurance, e-signature documents, and commission reports
• Respond to support requests
• Monitor for fraud, abuse, and security threats
• Comply with legal obligations

We do not sell your data. We do not use your data for advertising.

Insurstein is a multi-tenant platform. Each agency's data is strictly isolated:

• Every database query filters by your agency's unique identifier (agencyId)
• Agency A cannot access, view, or modify Agency B's data under any circumstances
• This isolation is enforced at the application layer on every API request, including mobile app requests
• Meeting recordings, documents, client records, and all business data are scoped to your agency
• Audio playback API routes verify agency ownership before serving any data

When you or your insurance agency uses the SMS messaging features of the Service (powered by Twilio), the following applies:

• Consent: SMS messages are sent only to individuals who have provided their phone number to the insurance agency during the course of the business relationship (policy application, client onboarding, claims inquiry, or other direct interaction). By providing a phone number, end users consent to receive SMS communications related to their insurance account.
• Message Types: SMS messages may include policy updates, renewal reminders, claims notifications, appointment confirmations, payment reminders, certificates of insurance notifications, and general account communications.
• Message Frequency: Message frequency varies based on account activity. You may receive up to 10 messages per month related to your insurance account.
• Message and Data Rates: Message and data rates may apply. Contact your wireless carrier for details about your text messaging plan.
• Opt-Out: You can opt out of SMS messages at any time by replying STOP to any message. After opting out, you will receive a single confirmation message and will no longer receive SMS messages from that agency.
• Help: Reply HELP to any message for assistance, or contact support@insurstein.com.
• Opt-In: You can opt back in at any time by replying START to the agency's phone number.
• No Sharing: We do not sell, rent, or share phone numbers or SMS opt-in data with third parties for marketing purposes. Phone numbers are used solely for the purpose of sending SMS messages as described in this policy.
• Carriers: SMS messages are delivered via Twilio through major US carriers including but not limited to AT&T, T-Mobile, and Verizon. Carriers are not responsible for delayed or undelivered messages.

We share data only with the following categories of third-party service providers necessary to operate the platform:

We do not share your data with any other third parties except as required by law.

• Account data: Retained for as long as your account is active.
• Meeting recordings: Stored indefinitely in your agency's database until you delete them. Audio is never cached externally.
• Transcriptions & AI summaries: Stored as part of your activity log. The content sent to AI APIs is not stored beyond the immediate processing request.
• Documents: Stored as long as your account is active. Deleted upon account deletion.
• Call recordings: Stored via Twilio as long as your account is active.
• Discovery form data: Retained as part of your client records.
• Account deletion: If you cancel your subscription and request account deletion, all your data will be permanently deleted within 30 days, except where we are required to retain it for legal or tax compliance purposes.

We implement security measures aligned with industry standards:

• All data transmitted over HTTPS/TLS encryption
• Authentication tokens stored in iOS Keychain / Android Keystore (mobile) or HttpOnly secure cookies (web)
• Passwords hashed with bcrypt (cost factor 12)
• Session tokens validated on every request with agency-level isolation
• Documents and meeting recordings encrypted with AES-256-GCM (random IV per file) at the application level before database storage
• OAuth and integration tokens encrypted with AES-256-GCM before storage
• Meeting recording playback requires authenticated session with matching agencyId
• Audio playback responses include Cache-Control: private, no-store headers
• Phone verification for invite acceptance is rate-limited (5 attempts per 15 minutes)
• Server-side password complexity validation (8+ characters, uppercase, number, special character)
• Role-based access control (RBAC) with ADMIN, PRODUCER, CSR, and VIEWER roles
• All API routes enforce authentication and agency-level authorization
• No sensitive data (passwords, tokens, API keys) is ever returned in API responses or logged

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your account and data
• Export your data in a portable format
• Revoke consent for optional features (meeting recording, phone system)

To exercise any of these rights, contact us at support@insurstein.com.

We use session cookies to keep you logged in and functional cookies necessary for the platform to operate. We use a preview access cookie for beta gating. We do not use advertising or tracking cookies.

Insurstein is a business tool for insurance professionals. It is not directed at children under 13. We do not knowingly collect personal information from children under 13.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland:

Lawful Basis for Processing:

• Contract performance: processing necessary to provide the Insurstein service
• Legitimate interests: security monitoring, fraud prevention, product improvement
• Consent: optional features (meeting recording, phone system, AI features)
• Legal obligation: tax records, legal compliance

Your Additional Rights (EEA/UK): Right to data portability, right to restrict processing, right to object to processing, right to lodge a complaint with your local supervisory authority.

Data Transfers: Your data is stored and processed in the United States (AWS us-east-2 via Supabase). We use Standard Contractual Clauses (SCCs) where required for international data transfers.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice in the app. Continued use after changes constitutes acceptance of the updated policy.

For questions about this Privacy Policy, contact us at:

Ayubzai Business Solutions LLC
Operating as Insurstein
Lincoln, Nebraska, USA
support@insurstein.com