Privacy Policy

1. Introduction & Scope

AgencyDesk Technologies, Inc. ("AgencyDesk," "we," "us," or "our") provides an AI-powered agency management and workflow automation platform designed specifically for commercial insurance agencies, brokerages, and managing general agencies (MGAs) specializing in transportation and commercial fleet risk.

This Privacy Policy describes how we collect, store, process, protect, and handle data when your agency subscribes to AgencyDesk ("Services"), interacts with our marketing websites, or forwards inbound carrier communications into our processing pipeline.

2. Data We Process on Behalf of Your Agency (Customer Data)

In delivering our services, AgencyDesk acts as a data processor / service provider on behalf of your agency. Your agency maintains ownership and control over all submitted customer insurance records, which may include:

• Policy Declarations & Schedules: Expiring and renewal declaration pages, policy forms, endorsement documents, and certificate of insurance (COI) records.
• Commercial Fleet Information: Vehicle identification numbers (VINs), vehicle year, make, model, stated values, gross vehicle weight rating (GVWR), and operating radii warranties.
• Motor Carrier Account Identifiers: USDOT numbers, MC/FF docket numbers, state operating authorities, federal employer identification numbers (FEIN), business legal names, and primary terminal addresses.
• Driver & Underwriting Files: Commercial driver license (CDL) numbers, motor vehicle records (MVRs), driver rosters, and prior carrier loss run summaries.
• Inbound Carrier Communications: Email headers, subject lines, body text, and attachments forwarded from insurance carriers, wholesale brokers, or underwriters into your agency's designated intake address.

3. Artificial Intelligence & No Foundation Model Training

AgencyDesk employs artificial intelligence models to assist your agency in extracting structured fields from declaration PDFs, comparing expiring versus renewal terms, and organizing policy folders.

All AI inference operations are executed within isolated, zero-data-retention enterprise compute instances where inputs and outputs are ephemeral and strictly confidential to your agency session.

4. Information Collected Directly (Account & Operational Data)

When you create an account, request a product walkthrough, or communicate with our team, we collect:

• User Profile Information: Authorized broker and CSR names, professional email addresses, job titles, and telephone numbers.
• Agency Information: Agency legal name, principal office location, number of commercial fleets managed, and existing agency management systems (AMS).
• Security & Audit Telemetry: Login timestamps, IP addresses, browser user agent, API access records, and cryptographic SHA-256 hashes of processed files to ensure non-repudiation and compliance.

5. How We Use and Protect Your Information

We use information strictly for the following purposes:

• Provisioning and operating the AgencyDesk software, including vehicle extraction, policy diff generation, and client document filing.
• Routing transactional notifications (such as walkthrough confirmations and lead alerts) via verified delivery providers like Resend.
• Detecting and preventing unauthorized access, credential abuse, or platform security threats.
• Complying with applicable statutory records retention and insurance department audit requirements.

6. Security Architecture & Encryption

We maintain industry-standard physical, organizational, and technical safeguards designed to preserve the confidentiality and integrity of all agency files:

• Encryption in Transit: All HTTP and API traffic is enforced over TLS 1.3 with 256-bit encryption.
• Encryption at Rest: All database records, uploaded PDFs, extracted tables, and audit logs are encrypted using AES-256.
• Role-Based Access Control (RBAC): Granular permissions ensure only authorized agency personnel and assigned CSRs can view specific policy libraries or applicant pipelines.
• SOC 2 Type II Alignment: Our infrastructure controls comply with the Trust Services Criteria for Security, Availability, and Confidentiality.

7. Subprocessors

To provide the Services, we partner with vetted third-party infrastructure providers who adhere to strict data security agreements:

8. Data Retention, Portability & Deletion

We retain Customer Data only for the duration of your agency's active subscription. Upon account termination or written request, your agency may request a full export of all structured records and original document files. Following a 30-day transition grace period, all associated records will be permanently purged from our active databases.

9. Contact Us

If your agency has any questions, security inquiries, or wishes to execute a Data Processing Agreement (DPA), please contact our privacy office: