1. Introduction

CoverGuard, Inc. (“CoverGuard,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and platform (“Platform”). We process personal information in accordance with applicable privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the “CCPA”), and other applicable U.S. state privacy laws.

2. Information We Collect

We limit the collection of personal information to what is necessary to provide, operate, and improve the Platform. We collect the following categories of information:

Account information

Name, email address, and sign-in credentials (passwords are stored only in hashed form by our authentication provider)
Company name and license number (for agents, lenders and insurance professionals)
Account role, preferences, and the date and version of the legal documents you accepted, with the IP address and browser it was accepted from
Subscription and billing status (payment card details are collected and held by Stripe, not by us)

What you do on the Platform

Property addresses you search and Records you view
Saved properties, notes, checklists and tags
Quote requests you submit, and the notes you add to them
Whether a quote request led to a policy, if you choose to tell us (see “Quote-Request Outcomes You Choose to Share” below)
Current-insurance details you (or a professional working with you) enter for a property, such as carrier, premium and deductible, and documents you upload
Client connections with professionals and the messages exchanged in them
What you type to the CoverGuard Advisor
Feature usage and navigation within the Platform

Technical data

IP address, browser type, and device information
Log data including access times and pages visited
Cookies and similar technologies (see Section 7)

Quote-Request Outcomes You Choose to Share

After you submit a quote request, we may ask whether it led to an insurance policy. Answering is optional, and nothing is recorded unless you submit an answer. If you answer, we collect your answer: that you bound a policy, that you did not, or that you have not decided yet. If you bound a policy, you may also tell us the date you bound it, the annual premium, the carrier's name and any conditions the carrier required. Each of these details is optional. We keep your answer with the quote request it relates to, the property, the date of the request and the carrier you asked about. We also keep the time you answered and the version of this Privacy Policy and of the notice shown with the question. The question is offered to the account that submitted the request, so if a professional submitted a request for you, they may answer it. Only the account holder can submit an answer. Our staff cannot answer on your behalf.

We use these answers to measure how well our risk and insurability estimates, including the CoverGuard Score, match what actually happens when people seek insurance, and to improve those estimates. We do not use them for marketing or advertising, and we do not include them in the ZIP-level market figures described in Section 5. Answering, or not answering, does not change your quote request or any quote. We do not treat a request with no answer as one that did not lead to a policy.

Your answers are not shown to other users or to professionals you connect with. We do not share them with insurers or with the licensed insurance partners our brokerage team works with. Apart from CoverGuard, only the service providers listed in Section 4 that host and process our data on our behalf handle them.

You can edit or remove your answer at any time from the property's Record, under “Your quote requests”, or by emailing privacy@coverguard.io. When you remove an answer, we delete it, and it is left out of any analysis we carry out afterwards. Overall results we have already calculated from many answers are not recalculated. Otherwise we keep your answer until you remove it or delete your account. It has no fixed deletion date, because measuring accuracy depends on comparing outcomes over time. It is not deleted when the quote request itself reaches the end of its record-keeping period in Section 8. When you delete your account, your answers are deleted.

If you bind a policy through the Platform itself, we may record the same kind of details when the bind completes: the carrier, the annual premium, and when the policy was quoted and bound. We use them for the same purposes. These are records of a transaction the Platform carried out, not answers you choose to give, so they are kept as “Decision and outcome records” (Section 8). Your account ID is removed from them if you delete your account.

Pre-Account Inquiry Information

If you submit a demo request, request access, or otherwise contact us before creating a CoverGuard account, we collect the information you provide: name, email, company, phone number, your role, your organization's approximate monthly transaction or policy volume, any message you send us, the property address you reference (if any), standard marketing-attribution data (source, medium and campaign), and any other information you choose to provide. This section applies to you if you have contacted CoverGuard but do not yet have an account. See Section 8 for how long this information is retained.

3. How We Use Your Information — and What We Don't Do

We use the information we collect only for specific, documented purposes:

Provide, maintain, and improve the Platform
Create and manage your account and subscription
Handle quote requests you submit — our brokerage team, which works with licensed insurance partners, uses them to seek coverage for you
Send transactional emails (account confirmation, quote-request updates, alerts you set up)
Produce de-identified ZIP-level market figures (see Section 5)
Measure and improve the accuracy of our risk and insurability estimates, using quote-request outcomes you choose to share (see Section 2)
Understand how the Platform is used so we can improve it
Detect, prevent, and address fraud, abuse, unauthorized access, or security incidents
Maintain audit logs for security monitoring and incident investigation
Comply with legal and regulatory obligations

We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising, as those terms are defined in the CCPA. We do not rent or trade it, and we do not use third-party advertising cookies.

4. Who Receives Your Information

Service providers. We use the following service providers (processors) to run the Platform. Each processes personal information only on our behalf, for the purpose listed, under a written agreement:

Vercel — application hosting and content delivery, plus Vercel Web Analytics and Speed Insights (privacy-preserving page and performance measurement)
Supabase — database, sign-in and file storage
Segment (Twilio) — product analytics, when enabled — the events you trigger in the app and an identifier for your session or account
Stripe — subscription billing and payments (we never see or store your full card number)
Resend — sending account, quote-request and notification emails
Upstash — rate limiting and short-lived caching
Sentry — error and performance monitoring
Google Maps Platform — address lookup, geocoding, maps and imagery for the addresses you search
ATTOM Data Solutions — property records for the addresses you search (we send the address, never your account details)
RentCast — property details and valuation data for the addresses you search (we send the address, never your account details)
Walk Score — walkability and transit scores for the addresses you search (we send the address and its map location, never your account details)
Anthropic — AI processing for the CoverGuard Advisor and our other AI-assisted features
Slack — internal notification to our team when a demo or early-access request arrives
Cloudflare Turnstile — bot protection on our public forms

The same list, with what each provider does, is on our Security page.

We also disclose information to:

Licensed insurance partners and insurers — when you submit a quote request, our brokerage team shares the details needed to seek coverage for that property with the licensed insurance partners it works with and the insurers they approach. Nothing is shared with them unless you request a quote.
Professionals you connect with — if you connect with an agent, lender or other professional on the Platform, they see the information you share through that connection, and your name and email address.
Legal authorities — when required by law, court order, subpoena, or governmental authority, or to protect the rights, property, or safety of CoverGuard, our users, or the public
Business transfers — in connection with a merger, acquisition, or sale of assets, with appropriate prior notice to users. Any successor entity will be bound by this Privacy Policy with respect to your previously collected data

5. ZIP-Level Market Data

When you — or an agent or other professional working with you — enter current-insurance details for a property (such as the carrier, premium and deductible), we combine them, de-identified, with other users' entries from the past year into ZIP-code-level figures, such as a typical premium for the area and the carriers most often reported there. Other users see those figures on properties in the same ZIP code.

A ZIP-level figure is shown only when at least 5 different people have contributed to it.
A carrier is named only when at least 3 different people have reported it.
Your entries are never shown to other users individually or attributed to you.

If you would rather not contribute, don't enter your policy details, or delete them from the property at any time. Deleted details are left out of these figures from their next refresh.

6. AI and the CoverGuard Advisor

The CoverGuard Advisor and some other features use AI models to explain results and suggest next steps. By default these run on models provided by Anthropic. What you type to the CoverGuard Advisor, together with the property information needed to answer it, is sent to our AI provider to generate the response. If you or your company connect your own AI provider account, those requests are processed under that account instead.

The CoverGuard Score itself is not produced by an AI model: it is computed by a deterministic scoring engine from measured data, and the CoverGuard Advisor explains it but never decides it. AI-generated explanations can be wrong; see our Terms of Service and methodology.

7. Cookies, Analytics & Global Privacy Control

We use strictly necessary cookies to keep you signed in and secure your session, and your browser's local storage to remember preferences. We do not use third-party advertising or behavioral-tracking cookies.

To understand how the Platform is used we use privacy-preserving analytics: Vercel Web Analytics and Speed Insights, which measure page views and performance without advertising cookies, and — where enabled — Segment product analytics, which stores a first-party identifier in your browser so related events can be counted together.

We honor Global Privacy Control (GPC). When your browser sends a GPC signal, we do not load Segment, Vercel Web Analytics or Speed Insights for you, we do not record our own first-party events that count how visitors move through our marketing pages and sign-up (we still record page-performance measurements and error reports, which we use only to keep the Platform working), and we treat the signal as a request to opt out of any sale or sharing of your personal information. You can also control cookies through your browser settings, though disabling essential cookies will stop you from signing in.

8. Data Retention & Deletion

We keep personal information only as long as we need it for the purposes in this Policy, or as the law requires. Specifically:

Account data — kept while your account is active, and deleted when you delete your account (see below)
Search history — automatically deleted 24 months after each search
Quote requests — kept for 7 years to meet insurance and financial record-keeping requirements, then automatically deleted
Quote-request outcomes you choose to share — kept until you remove them or delete your account. They have no fixed deletion date and are not deleted when the quote request reaches the end of its 7-year period (see Section 2)
Account activity history (sign-ins, account changes and similar events) — deleted or anonymized after 365 days, and anonymized straight away if you delete your account
Feedback you give on a property Record (your rating and any note you add) — deleted 24 months after you last change it, and deleted straight away if you delete your account
API usage logs — deleted after 90 days, with the IP address removed at 90 days
First-party product analytics events — deleted after 30 days
Webhook, background-job and email delivery logs — deleted after 90 days
CoverGuard Agents and data-connector run logs — deleted after 180 days
API billing usage records — deleted after 400 days
Branded report access logs — deleted about 30 days after the shared report expires
Compliance records — our tamper-evident security audit trail (security and compliance events such as legal-document acceptances and account deletions, identified by an internal account ID rather than your email address) and the record of each deletion request (which includes the account's email address) cannot be edited and are kept for as long as we need them to show that we honored your choices and requests
Decision and outcome records — records of the assessments and transactions the Platform produced cannot be edited and have no fixed deletion date; your account ID is removed from them when you delete your account
Logs held by our providers — sign-in logs at Supabase, error reports at Sentry and request logs at Vercel follow those providers' own retention periods
Access requests and demo enquiries — if you ask for access or request a demo before you have an account, we keep what you send us (see Section 2) for up to 24 months, then delete it. We remove the property address sooner: within 90 days, and for an access request as soon as we act on it. You can ask us to delete it at any time

When you delete your account

You can delete your account at any time in Account settings → Delete Account. Deletion is immediate and permanent: there is no recovery window, and anything that cannot finish at once is completed within 30 days. When you delete your account:

Your profile, saved properties, notes, search history, the current-insurance details you entered, uploaded documents and preferences are deleted.
Your client connections and their messages are deleted — including the other person's messages in those conversations.
Coverage facts you shared to a property stay on the property, without your name or any link to you.
If you connected with a professional, the client record they hold that was created automatically from your account has your name and email address removed wherever they still match yours: the name becomes “Former client” and the email is cleared. Notes and details the professional added themselves stay with them.
Quote requests you submitted are kept for the record-keeping period above, with no link to your account and with your notes removed.
Quote-request outcomes you shared are deleted. Records of policies bound through the Platform are kept with your account ID removed (see Decision and outcome records above).
Account activity and request logs about you are anonymized: who it was is removed, and only the fact that an event happened remains until it ages out.
We cancel any active, trialing or past-due subscription and delete your customer record at Stripe. Stripe keeps its own record of past transactions where the law requires it to.
Where Segment is in use, we instruct Segment to delete the analytics data it holds about you and to stop collecting it.
We keep a record that the deletion was requested and completed, including the email address it was for, so we can show we honored it (see Compliance records above).

When data reaches the end of its retention period, it is securely deleted or irreversibly anonymized.

9. Data Security & Breach Notification

We maintain a comprehensive information security program designed to protect the confidentiality, integrity, and availability of your personal information. Our security measures include:

Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
Secure authentication with support for multi-factor authentication (MFA)
Role-based access controls enforcing least-privilege principles across all systems
Continuous monitoring, intrusion detection, and automated alerting
Automated vulnerability assessments
Documented incident response procedures with defined escalation paths
Formal change management processes for all production systems

No method of electronic transmission or storage is 100% secure. While we maintain rigorous safeguards, we cannot guarantee absolute security.

In the event of a confirmed security breach that compromises your personal information, we will notify affected users without unreasonable delay and in accordance with applicable law. Notification will include a description of the incident, the categories of data involved, the measures taken to address the breach, and steps you can take to protect yourself. We will also notify relevant regulatory authorities as required by applicable law.

10. Your Privacy Rights

Depending on where you live — including under the CCPA if you are a California resident — you have the right to:

Know and access — what personal information we collect, use and disclose, and a copy of it
Correct — inaccurate or incomplete personal information
Delete — your personal information, subject to the record-keeping obligations in Section 8
Portability — a copy in a structured, machine-readable format
Opt out of sale or sharing — we do not sell or share your personal information, but you can opt out at any time and the choice will hold if our practices ever change. We already treat a Global Privacy Control signal as an opt-out (Section 7)
Restrict or object — to certain processing, and withdraw consent where processing is based on consent
Non-discrimination — we will not deny you service, charge you a different price, or give you a lower quality of service for exercising any of these rights

Sensitive personal information. Apart from the email address and password you sign in with — which we use only to authenticate you and keep your account secure — we do not collect sensitive personal information as the CCPA defines it. A property address you search is not your precise geolocation. We do not use any personal information to infer characteristics about you.

How to make a request

Self-service. If you have an account, you can download a machine-readable copy of the personal information we hold about you at any time in Account settings → Legal & Privacy, and delete your account in Account settings → Delete Account.
Everything else — submit a request on our Your Privacy Choices page, or email privacy@coverguard.io.
Verification. We verify your identity by matching the request to your account's email address when you are signed in, or by asking you to confirm the request from your email address.
Authorized agents. Someone you authorize may make a request for you with your written permission. We may ask you to confirm your identity and the permission directly with us.
Timing. We acknowledge requests within 10 business days and respond within 45 days. If we need longer, we may extend that once by up to another 45 days, and we will tell you why before the first 45 days are up.

11. Children's Privacy

The Platform is not intended for users under the age of 18. We do not knowingly collect personal information from children. If we learn that we have inadvertently collected such information, we will delete it promptly and notify any relevant authorities as required by law.

12. Third-Party Links

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies before providing any personal information.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, technologies, legal requirements, or other factors. When we make a material change we update the “Last updated” date and ask you to review and accept the updated policy the next time you sign in. Your continued use of the Platform after the effective date of any changes constitutes acceptance of the updated policy.

14. Contact Us

For privacy-related questions, to exercise your data rights, or to report a concern, contact our Privacy Team at privacy@coverguard.io. Email is how we receive privacy requests: we respond from the same address, and we may ask you to confirm a request from the email address on your account before we act on it.

Privacy Policy