InsurCore

Privacy Policy

Effective Date: October 20, 2026

Last updated: October 20, 2026

This Privacy Policy explains how Holistic Business Consulting, LLC, a Florida limited liability company, and its affiliates and brands, including InsurCore and Epic Conversions (collectively, “HBC,” “we,” “us” or “our”), collect, use, disclose and protect information in connection with our websites, including insurcore.io and its subdomains (the “Site”), our web, desktop and mobile applications, browser extensions, connectors and agents (the “Platform”), and our data conversion, consulting and related services (the “Services”). It should be read together with our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.

1. Our Two Roles: Business and Service Provider

When we act for ourselves. For information about visitors to our Site, prospective customers, and the individuals who hold accounts on our Platform (such as your name, email address and login activity), HBC decides how the information is used. This Privacy Policy applies to that information.

When we act for our customers. Our customers are businesses, mainly insurance agencies and related organizations. When they use our Services, they give us data from their own systems, which may include information about their clients, insureds, policies, claims, vehicles, drivers, employees and accounting (“Customer Data”). We process Customer Data only on behalf of and under the instructions of the customer, as a “service provider,” “processor” or equivalent term under applicable law. The customer, not HBC, is responsible for that data, for providing any required privacy notices to the individuals it concerns, and for responding to their requests. If you are an insured or client of one of our customers and have a question about your information, please contact that business directly. If you contact us, we will refer your request to the relevant customer where we are able to identify it.

Our handling of Customer Data is governed by our agreements with the customer, including the Master Services Agreement and any data processing terms, which control over this Privacy Policy where they conflict.

2. Information We Collect

2.1 Information you give us

  • Contact and inquiry information, such as your name, agency or company name, job title, email address, phone number, website, city and state, the systems you use, approximate data volume, timeline and any notes you send through our contact or conversion review forms, by email, or by phone.
  • Account information, such as your name, email address, organization, role and password (stored by our authentication provider in hashed form).
  • Transaction and billing information, such as the services you purchase, billing contact details, invoices and payment history. Card and bank details are entered directly with our payment processor, Stripe; we do not store full payment card numbers.
  • Agreement records, such as the version of a legal document or proposal you accepted, the name you typed or the box you checked, the date and time, and your account and device details.
  • Communications and meeting content, such as support messages, emails, chat messages and, where you agree to it, recordings and transcripts of video meetings.
  • Customer Data, as described in Section 1.

2.2 Information collected automatically

  • Site usage. When you browse our Site, we record the pages you view, the referring page, and basic interaction events, linked to a random visitor identifier stored in your browser. We use this first-party data to understand how our Site is used. We do not use third-party advertising or analytics trackers on our Site (see Section 5).
  • Platform session and security data. When you sign in, we record your IP address, browser and device type (user agent), and the times of your sessions. We may derive an approximate location (city, region and country) from your IP address. We use this to keep accounts secure, enforce session limits, detect suspicious activity and maintain audit logs.
  • Logs and diagnostics. Our servers and service providers automatically record technical information such as IP address, request details, error reports and security events.
  • Connector and agent information. If your organization installs one of our connectors or agents (for example, our SQL Connector or backup agent), it reports technical information such as the computer name, operating system version, software version and job status, and transfers the data your organization configures it to transfer.
  • Browser extension. If you install the InsurCore Vault browser extension, it handles the information described in Section 8.

2.3 Information from third parties

  • Connected accounts. If you choose to connect a third-party account (for example, Google Workspace, Zoom or an accounting system), we receive information from that service according to the permissions you grant. See Section 7 for more about Google and Zoom data.
  • Public and business sources. We may collect publicly available business information, such as information from your agency’s website, state insurance department records and industry directories, to understand prospective customers and to support our Services.
  • Service providers, such as our payment processor (payment status) and email provider (delivery status).

3. How We Use Information

We use the information we collect to:

  • provide, operate, maintain and support the Site, Platform and Services, including performing data conversions and migrations;
  • create and manage accounts, authenticate users and enforce security controls;
  • respond to inquiries, prepare proposals, schedule meetings and communicate with you about your project, account, invoices and changes to our terms;
  • process payments and maintain financial records;
  • send you information about our services that we think may interest you, where permitted by law (you can opt out at any time; see Section 10);
  • understand and improve how our Site and Platform are used and develop new features;
  • detect, prevent and investigate fraud, abuse, security incidents and violations of our Terms;
  • keep records of agreements and acknowledgements;
  • comply with legal obligations, respond to lawful requests, and establish, exercise or defend legal claims; and
  • for any other purpose we describe to you when we collect the information, or with your consent.

We use Customer Data only to provide the Services to the customer that supplied it, to secure and support the Services, to comply with law, and as permitted by our agreement with that customer.

4. Artificial Intelligence

Some features of our Platform use artificial intelligence, including large language model and document processing services provided by OpenAI, Anthropic and Google (Vertex AI and Document AI). For example, we may send field names, small samples of records, document text, meeting audio or transcripts, or email text to these providers to suggest data mappings, classify records, transcribe meetings, summarize documents or draft content.

  • We use these providers’ business and API services. Under their published terms for those services, the providers do not use the data we send to train their general-purpose models.
  • We apply automated safeguards designed to remove or block certain sensitive identifiers (such as Social Security numbers, payment card numbers and bank account numbers) and to redact contact details before data is sent to an AI provider for many features. These safeguards reduce but do not eliminate the possibility that personal information is included.
  • To improve our mapping features over time, we may retain records of AI suggestions and the corrections made to them. Where we use that information across customers, we limit it to structural information such as source and destination field names and mapping choices, and not the contents of individual records.
  • Our conversion process is designed so that AI output is reviewed by people before it is relied upon, and we do not use AI to make decisions that produce legal or similarly significant effects about individuals.

5. Cookies, Local Storage and Similar Technologies

We keep tracking to a minimum. Our Site and Platform use your browser’s local storage and a small number of cookies for the following purposes:

  • Strictly necessary: keeping you signed in, remembering the organization you are working in, protecting against fraud and enforcing security settings.
  • Preferences: remembering interface choices, such as whether a sidebar is open.
  • First-party analytics: a random visitor identifier used to measure how our own Site is used, as described in Section 2.2.

We do not use third-party advertising cookies, cross-site tracking pixels, or third-party analytics services, and we do not allow third parties to collect information about your activity on our Site for their own advertising purposes. You can clear or block local storage and cookies in your browser settings; if you block strictly necessary storage, the Platform will not work.

Do Not Track and Global Privacy Control. Because we do not sell personal information or share it for cross-context behavioral advertising, there is nothing for these signals to opt you out of. We nevertheless honor a Global Privacy Control signal as a request to opt out of any such sale or sharing should our practices change.

6. How We Disclose Information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We have not done so in the preceding twelve months. We disclose information only as follows:

  • Service providers and subprocessors that perform services for us under contracts that limit their use of the information, including cloud hosting, database and storage (Supabase, Cloudflare, Amazon Web Services, Google Cloud), email delivery (Resend), payments (Stripe), accounting (Zoho), AI processing (OpenAI, Anthropic, Google), video meetings and transcription (Zoom, Fathom), web automation and research tools, and code hosting. A list of our subprocessors is available on our Subprocessors page.
  • Within your organization. Information in your account, and project activity, may be visible to administrators and other authorized users in your organization.
  • At your direction, for example when you ask us to load converted data into a destination system, connect a third-party account, or share a file with a recipient.
  • Our affiliates, for the purposes described in this Privacy Policy.
  • Legal and safety. When we believe in good faith that disclosure is necessary to comply with law, regulation, subpoena, court order or other legal process; to respond to a lawful request from a government authority; to enforce our agreements; or to protect the rights, property or safety of HBC, our customers, or others.
  • Business transfers. In connection with a merger, acquisition, financing, reorganization, bankruptcy or sale of all or part of our business or assets, in which case information may be transferred to the successor, subject to this Privacy Policy or a policy at least as protective.
  • Aggregated or de-identified information that does not reasonably identify any individual or customer.

7. Connected Google and Zoom Accounts

Google. If you connect a Google account, we access only the data covered by the permissions you approve (which may include Gmail, Calendar, Contacts, Drive, Tasks or Chat) and use it only to provide the features you have enabled, such as drafting and sending email, scheduling and syncing project communications. HBC’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not allow humans to read it except with your consent, for security purposes, to comply with law, or where it has been aggregated and anonymized, and we do not use it to train generalized AI or machine learning models.

Zoom. If you connect a Zoom account, we access meeting details and, where you enable it, recordings and transcripts, in order to store them with your project, generate transcripts and summaries, and draft follow-up communications. You can disconnect at any time from your account settings or from the Zoom App Marketplace; when you do, we stop accessing your Zoom data, and you may ask us to delete the Zoom data we have stored.

You can revoke our access to a connected account at any time through the third-party service’s security settings.

8. InsurCore Vault Browser Extension

The InsurCore Vault extension for Google Chrome (the “Extension”) lets you use your organization’s InsurCore Vault on other websites. This Section describes the information the Extension handles, in addition to the rest of this Privacy Policy.

  • Sign-in. The Extension has no separate password. It uses the sign-in you already have on insurcore.io: while you are signed in there, it reads the short-lived access token that the Site keeps in your browser, together with your user ID and email address. It never receives your InsurCore password or the token used to renew your session, and it never signs in or renews your session on its own.
  • Your Vault. The Extension uses that sign-in to read and save entries in your organization’s InsurCore Vault, with the same permissions you have in the Platform, and to obtain your organization’s Vault key from our servers so that entries can be decrypted and encrypted in your browser.
  • Filling logins. On secure (https) websites, the Extension looks for login fields on the page. When you click into a login field, it shows the names and usernames of the Vault logins saved for that website’s address, and it fills a login only when you click it. It also fills a login when you choose “Sign in” for that login in the Platform, by opening the login’s own website and filling it there. Websites never see your Vault: a page receives only the login you chose, and only for its own address.
  • Saving and updating logins. When you submit a login form on a website, the Extension keeps the username and password you typed in your browser’s memory for up to three minutes, so that after you sign in it can offer to save the login to your Vault or to update a saved password. Nothing is saved or updated unless you click Save or Update password. If you choose “Not now,” the typed login is discarded; if you choose “Never for this site,” the Extension remembers not to offer again for that website.
  • What the Extension does not collect. Apart from the login fields described above, the Extension does not read or collect the content of the pages you visit, and it does not record or send your browsing history or website content to us or to anyone else.
  • What is stored on your computer. Your sign-in, your organization’s Vault keys, the organization you are working in, and any login waiting for you to choose Save are kept only in your browser’s in-memory session storage, and are removed when the Vault locks or when you close Chrome. On your computer’s disk, the Extension stores only whether its offers to fill and save logins are turned on and the list of websites you chose never to save. Passwords are never written to your disk by the Extension.
  • Locking. The Extension locks the Vault, and removes what it kept in memory, after 15 minutes of inactivity, when your computer locks, when you sign out of InsurCore, and when you click Lock.
  • Transmission and encryption. Vault entries are sent only between your browser and InsurCore’s own servers, encrypted in transit, and are stored encrypted. The Extension contains no third-party analytics, advertising or tracking code, and it does not load code from outside its package.
  • Audit log. Each login filled, saved or updated with the Extension, and each entry opened in it, is recorded in your organization’s Vault audit log with your user account, the entry and the time.
  • How we use and share this information. We use the information the Extension handles only to provide the Extension’s features. We do not sell it, use it for advertising, or use it to determine creditworthiness, and we do not transfer it to anyone except the service providers that host the Platform, as described in Section 6. Vault entries are Customer Data, handled as described in Section 1. Our use of information received through the Extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.
  • Your choices. You can turn the Extension’s offers to fill and save logins off and on in the Extension, lock it at any time, and stop it entirely by uninstalling it from Chrome, which removes the information it stored in your browser. Entries already saved in your Vault stay there until you or your organization delete them in the Platform.

9. Data Retention

We keep personal information only as long as reasonably necessary for the purposes in this Privacy Policy, including to provide the Services, maintain business and tax records, resolve disputes and enforce our agreements, and comply with law. In general:

  • account information is kept while the account is active and for a reasonable period afterwards;
  • inquiry and prospect information is kept while we have a business relationship or reasonable expectation of one;
  • agreement acceptance records, invoices and financial records are kept for as long as needed to prove the agreement and meet tax and accounting obligations (typically at least seven years);
  • security and session logs are kept for a limited period for security and audit purposes; and
  • Customer Data is retained and deleted in accordance with our agreement with the customer and the customer’s instructions, and is otherwise deleted after the engagement ends on our standard retention schedule.

Deleted data may persist in backups for a limited period until those backups are overwritten.

10. Your Choices and Rights

  • Marketing emails. You can opt out of marketing emails at any time by replying to the email with “unsubscribe” or by contacting us as described in Section 16. We will still send transactional and account messages.
  • Account information. You can review and update much of your account information in the Platform. Users of the Platform can submit requests to access or export their information from their account privacy settings.
  • Privacy rights requests. Depending on where you live, you may have the right to request access to, correction of, deletion of, or a portable copy of personal information we hold about you; to opt out of the sale or sharing of personal information or of targeted advertising (we do neither); to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. To make a request, contact us as described in Section 16. We will verify your request by matching the information you provide with information we hold, and we may ask for additional information to do so. You may use an authorized agent; we may require proof of the agent’s authority and verify your identity directly. If we deny your request, you may appeal by replying to our decision, and we will respond within the time required by law.
  • Requests about Customer Data. If your request concerns Customer Data that we process for one of our customers, we will forward it to that customer where we can identify them, and we will assist the customer as required by our agreement and applicable law.

We may decline or limit requests where permitted by law, for example where fulfilling them would infringe the rights of others, where we must retain information to comply with law or defend legal claims, or where the request is manifestly unfounded or excessive.

11. Security

We use administrative, technical and physical safeguards designed to protect information, including encryption in transit, encryption at rest provided by our hosting providers, additional application-level encryption of credentials and other secrets, role-based access controls and row-level data isolation between customers, audit logging, and automated safeguards around AI processing. However, no system is completely secure, and we cannot guarantee the security of information. You are responsible for keeping your credentials confidential and for the security of your own systems. If we learn of a security incident affecting personal information in our systems, we will notify affected parties as required by applicable law, including the Florida Information Protection Act (Section 501.171, Florida Statutes). Where the incident affects Customer Data, we will notify the customer so that it can meet its own obligations.

12. Children

Our Site, Platform and Services are intended for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 18 through our Site or Platform. If you believe a child has provided us with personal information, please contact us and we will delete it. This Section does not apply to Customer Data, which is governed by our agreements with our customers.

13. International Users

HBC is based in the United States, and we store and process information in the United States and in other countries where our service providers operate. Our Services are intended for businesses in the United States. If you access the Site or Platform from outside the United States, you understand that your information will be transferred to, stored and processed in the United States, where data protection laws may differ from those in your country.

14. State-Specific Disclosures

California and other U.S. states. Certain state privacy laws apply only to businesses that meet specific thresholds and may not apply to HBC. To the extent they apply, this Section provides additional disclosures. In the preceding twelve months we have collected the following categories of personal information, for the business purposes described in Section 3, from the sources described in Section 2, and disclosed them to the categories of recipients described in Section 6: identifiers (such as name, email address, phone number, IP address and account name); commercial information (such as services purchased); internet or other electronic network activity (such as Site and Platform usage); approximate geolocation derived from IP address; audio and visual information (such as meeting recordings, where enabled); professional or employment-related information (such as job title and employer); and inferences drawn from the above about business interests. We do not use or disclose sensitive personal information for purposes that would require offering a right to limit under California law. We do not sell or share personal information, including that of consumers under 16.

California “Shine the Light.” We do not disclose personal information to third parties for their own direct marketing purposes.

Nevada. We do not sell covered information as defined under Nevada law.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date above. If we make material changes, we will provide additional notice, such as by email or through the Platform, before the change takes effect. Your continued use of the Site, Platform or Services after an update takes effect means you acknowledge the updated Privacy Policy.

16. Contact Us

For privacy questions or to exercise your rights, contact us at:

Holistic Business Consulting, LLC
Attn: Privacy
5900 Hickey Way
The Villages, FL 32163
Email: erik@insurcore.io
Phone: (352) 418-0123