Privacy Policy

For your own account information (your name, email, agent IDs, contract level, billing), we are the business / controller and this Policy governs.

For the information you enter about your clients and prospects (their names, contact details, dates of birth, policy and production records), you are the controller. We act only as your service provider / processor: we store and process that information on your behalf, under your instructions, to provide the Service to you. We do not use it for our own purposes.

If you are an insurance client and want to know what your agent holds about you, or want it corrected or deleted, please contact your agent directly — they control that record. If you contact us, we will refer you to them, or act on their instructions.

Account and profile: name, email address, password (stored only as a salted hash by our authentication provider), agency, agent/writing IDs, compensation level, profile photo, invite and upline/downline relationships, and your Terms acceptance (version and timestamp).

Content you enter or import: prospects, clients, policies, carriers, tasks, appointments, notes, commissions, goals, recruiting records, and uploaded documents (for example carrier statements and book-of-business exports). This can include third parties' names, phone numbers, email addresses, dates of birth, and policy numbers that you choose to enter.

Voice and scanned content: if you use voice debrief or document scanning, the audio, transcript, or image you submit, and the structured result.

Technical and usage data: log and device data needed to operate, secure, and debug the Service (IP address, timestamps, browser/OS, error traces), and push-notification tokens if you enable notifications.

Billing: if you subscribe, our payment processor handles your card details. We receive only subscription status and limited transaction metadata — we never see or store full card numbers.

What we ask you not to enter: please do not put Social Security numbers, government ID numbers, full payment card numbers, or medical records into free-text fields. The Service is not designed for them.

To provide, secure, maintain, and support the Service; to authenticate you; to calculate and display your production, points, commission, and goal figures from data you supply; to send notifications you enable; to process subscriptions; to detect and prevent fraud, abuse, and security incidents; to troubleshoot and improve reliability; and to comply with law.

We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not use your clients' information for advertising, profiling, or any purpose other than operating the Service for you. We do not use your content to train third-party AI models.

We share information only with vendors that help us run the Service, each bound to protect it and to use it only for that purpose:

Supabase — database, authentication, and file storage (United States). Vercel — application hosting and delivery (United States). Anthropic — AI processing for voice debrief and document scanning, when you use those features. Web-push services (Apple, Google, Mozilla) — delivery of notifications you enable. A payment processor — subscription billing, once paid plans are live.

We may also disclose information if required by law, subpoena, or legal process; to protect our rights, safety, or property or that of others; or in connection with a merger, acquisition, financing, or sale of assets — in which case we will require the recipient to honor this Policy or give you notice and a chance to delete your data.

Your records are scoped to your account and protected by database-level row security, so other agents on the platform cannot query your data. If you join a team using an upline invite, limited production totals may be visible to your upline as described in the app. A small number of our administrators can access production data strictly for support, security, or legal compliance.

Data is encrypted in transit (TLS) and at rest by our hosting providers. Uploaded documents live in private storage and are served only through short-lived signed links. Access is limited by row-level security policies and least-privilege credentials. We take daily database backups.

No system is perfectly secure, and we cannot guarantee absolute security. Keep your password confidential, use a unique one, and tell us immediately if you suspect unauthorized access. If a breach affects your personal information, we will notify you as required by applicable law.

These windows match Section 9 of our Terms:

Individual records: delete them in the app at any time. Deleted records may persist in encrypted backups for up to 90 days before being overwritten.

Closing your account: you may export your content for 30 days; after that window we delete or irreversibly anonymize it from active systems within 30 days; residual backup copies are purged within 90 days of that.

Inactive accounts: we may delete data for accounts closed, unpaid, or inactive more than 12 months, after reasonable notice to your account email.

What we may keep: records required by law, or reasonably necessary to resolve disputes, prevent fraud, enforce our Terms, or maintain billing and tax records; plus aggregated or de-identified data that cannot reasonably identify anyone.

We are a California business and extend the following rights to California residents whose personal information we hold as a business (principally our account holders). Depending on our size we may not be a “business” under the CCPA/CPRA in a given year; we honor these rights regardless.

Right to know / access the categories and specific pieces of personal information we collected, the sources, our purposes, and the categories of recipients. Right to delete personal information we hold about you. Right to correct inaccurate personal information. Right to portability — a copy in a readily usable format. Right to opt out of sale or sharing — we do not sell or share personal information, so there is nothing to opt out of. Right to limit use of sensitive personal information — we do not use it for purposes requiring that right. Right to non-discrimination — we will not deny service, charge different prices, or reduce quality because you exercised a privacy right.

How to exercise: email support@legacypipeline.app from your account email, or write to AJJ Vela Inc., Los Angeles County, California. We verify requests by confirming control of the account email and may ask for additional information for sensitive requests. We respond within 45 days, extendable once by another 45 days with notice. An authorized agent may submit a request with written permission and verification.

Requests about an agent's clients are directed to that agent, who is the controller of those records; we assist them in responding as their service provider.

Information you handle as a licensed producer may be “nonpublic personal information” under the Gramm-Leach-Bliley Act and state insurance privacy and data-security laws. You are responsible for your own obligations under those laws, including any notices to your clients and any required information-security program. We support you as your service provider but do not assume your regulatory duties. See Section 5 of the Terms.

When you use voice debrief or document scanning, the content you submit is sent to our AI provider to produce a draft result that is returned to you. Do not submit content you are not permitted to disclose to a third-party processor. AI output can be inaccurate — review it before saving or acting on it.

We use only what is necessary to run the Service: a session cookie or local storage entry to keep you signed in, and local preferences (such as theme and view choices). We do not use advertising cookies, third-party trackers, or cross-site analytics.

The Service is for licensed insurance professionals and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child's information has been provided to us, contact us and we will delete it.

The Service is operated in and intended for the United States, and information is stored in United States regions. If you access it from elsewhere, you understand your information will be transferred to and processed in the United States.

We may update this Policy. Material changes will be announced in the app or by email at least 30 days before taking effect, except where a shorter period is needed for legal or security reasons. The “Effective” date above always reflects the current version.

Privacy questions or requests: support@legacypipeline.app — AJJ Vela Inc., Los Angeles County, California.