Privacy Policy

Effective October 5, 2026

1. Who we are and what this covers

EZ Commissions, LLC provides commission-processing software and related services for insurance agencies. This policy describes how we handle information through our marketing websites, application, demo requests, billing, and support. Our business address is 1445 Woodmont Ln NW, STE 2033, Atlanta, GA 30318. Contact sales@ezcommissions.io for privacy questions or requests.

2. Information we receive

Agency and user information includes agency names, branding, settings, staff names, email addresses, roles, invitations, and account records. Authentication records include password hashes, verification and backup-code hashes, session records, and trusted-device information such as IP addresses and browser details. We do not email users their passwords.

Information uploaded by agencies may concern people who do not have an EZ Commissions account. It can include insureds' and contacts' names, business names, addresses, email addresses, phone numbers, policy numbers, carriers, premiums, policy dates, producer details, statements, declarations, other uploaded documents, commissions, payment records, and reconciliation results.

Billing information includes billing-contact details, subscription and customer identifiers, plan amounts, invoice references, payment status, refund requests, and payment-event records. Full card and bank account details are entered directly with Stripe rather than through our application servers.

Demo and inquiry information includes your name, email, agency, phone number, referral information, messages, request dates, and whether you used the demo. Technical records include IP addresses, browser information, request logs, user and agency identifiers, and records of platform-operator access.

Website visit and advertising measurement information. Our marketing website uses Google Analytics and, when we run advertising on Google Search, Google Ads measurement. These tools use cookies or similar identifiers and receive information such as the pages you view, the page or ad that referred you (including an advertising click identifier), your IP address, browser and device details, and approximate location, and whether you reached our demo-request confirmation page. We do not place your name, email address or other form entries in page addresses, and the demo-request form itself does not use these tools. If you decline cookies, or your browser sends a Global Privacy Control signal, we ask these tools not to set cookies for measurement or advertising; Google may still receive limited information that does not depend on cookies, such as the page address, IP address and browser details.

3. How we use information

We use information to provide statement processing and reconciliation, manage agency accounts and permissions, authenticate users, deliver demos, process subscriptions and refunds, send service messages, provide support, troubleshoot problems, and protect the service. We also use demo-request contact information for our own marketing and follow-up, subject to your opt-out choices and applicable law.

For insured and policy information supplied by an agency, we process the information to provide services to that agency. The agency determines what it uploads and must have authority to provide it. We do not use insureds' policy information to advertise to them. We do not sell personal information. We use website analytics and advertising measurement to understand which pages and ads lead to demo requests and to improve our website and campaigns. We do not use remarketing, audience-building or customer lists with advertising platforms, and we do not upload demo-request or customer contact lists to them.

4. Providers that receive information

Render hosts the application, database, uploaded files, scheduled processing, and logs. The core application and agency data are hosted in Oregon, United States. Marketing pages may be distributed through a global content-delivery network.

Stripe processes payments and provides billing services. It receives subscriber and payment information and sends us billing and payment-event details, which can include the customer's name and email. Stripe's handling of information is also described in its own privacy policy.

Hover (Tucows) delivers transactional email, including invitations, verification codes, password resets, billing notices, and alerts. It receives the recipient address and message contents.

Microsoft Azure AI Document Intelligence processes scanned PDFs submitted through Verify Declarations when text cannot be extracted directly. In that situation, the uploaded document may be sent to Microsoft for optical character recognition and may contain insured names, addresses, policy details, and premiums. This does not mean every uploaded statement is sent to an AI service. A commission statement whose layout our software does not recognise is not sent anywhere automatically: it is kept in your agency's documents and reviewed by one of our operators, who configures the layout so the file can be imported.

Anthropic (Claude) may be used to propose which column of an unrecognised statement layout holds which field. When an operator requests a suggestion, the first rows of that statement — its column headings and a small number of sample rows, which may contain insured names, policy numbers, and amounts — are sent to Anthropic's API. Only those rows are sent, only on that explicit request, and only for a statement our software could not read on its own. The suggestion is reviewed and applied by an operator; nothing is changed automatically. Anthropic's handling of information is subject to its own terms, under which API inputs are not used to train its models. Provider processing and retention are subject to the applicable service arrangements; we do not promise immediate deletion by those providers.

Google provides Google Analytics and Google Ads measurement on our marketing website. Google may set cookies and receive the information described in Section 2, and handles it under its own terms. You can learn how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites, opt out of Google Analytics with Google's browser add-on at tools.google.com/dlpage/gaoptout, and manage ad personalization at adssettings.google.com. After you submit a demo request in our application, you are taken to a confirmation page on our marketing website, which is where Google's measurement counts the request. The address of that page contains none of the information you entered.

The marketing site is hosted through Render and, for the chatgpt.site version, OpenAI's Sites hosting. Visiting those sites involves the hosting provider receiving technical connection information. The marketing site also loads Google Fonts, which causes your browser to contact Google. Hosting and font providers may handle technical information under their own policies. Our application, including the demo-request form, does not include advertising or analytics SDKs; our marketing website does, as described above. This statement does not describe all processing performed by website hosting providers.

5. Agency and staff access

Agency users have permissions within their own agency. Agency administrators manage their agency's users and billing. Agency records are logically separated in a shared database, rather than stored in a separate database for each agency.

Authorized platform operators can access agency information to administer and support the service, including reviewing a statement file our software could not read in order to configure its layout. When a layout is configured from one agency's statement, only the column headings are recorded and shared for the benefit of other agencies that use the same carrier; no line of any agency's statement is shared with another agency. Operator access through the agency-selection feature is logged. Privileged administrative access is restricted to platform staff. Our hosting and other service providers also process information as described above. Agency separation does not mean that authorized support operators and infrastructure providers have no access.

We may disclose information when required by applicable law or valid legal process, or as necessary to investigate security incidents and protect the service and its users.

6. Security and cookies

The application uses HTTPS, authenticated access, mandatory two-factor authentication, role and agency access controls, hashed passwords and verification codes, and expiring links for uploaded documents. Session and trusted-device mechanisms support sign-in and security. Trusted-device features may reduce how often a verification code is requested. No transmission or storage system can be guaranteed completely secure.

The application uses necessary authentication cookies and related session records. It does not include advertising trackers or analytics SDKs. Our marketing website, which is separate from the application, uses cookies or similar technologies from Google Analytics and Google Ads to measure visits and advertising. These are not needed to sign in. When you first visit, a notice lets you accept or decline them. In the European Economic Area, the United Kingdom and Switzerland they set cookies only if you accept; elsewhere they set cookies unless you decline. A Global Privacy Control signal from your browser is treated as a decline. You can change your choice at any time using "Cookie settings" at the bottom of each page, block or delete cookies in your browser settings, or use the opt-out tools in Section 4. None of this affects your use of the application. We do not use these tools for remarketing or ad personalization. Marketing-site hosting and third-party font requests are separate from application authentication. Blocking necessary cookies may prevent sign-in or other account functions.

If a security incident requires notification under applicable law, we will provide the required notice. This policy does not promise a particular notification deadline beyond applicable requirements.

7. Retention and deletion

Demo workspaces use synthetic sample data and expire 48 hours after provisioning. A scheduled process removes the demo workspace, including any files uploaded to it, after expiration. The original demo-request contact record is retained separately, indefinitely unless removed following a request or another applicable requirement, and may be used for marketing. You may opt out of marketing or request removal using the contact below.

For customer accounts, agency data is retained for 30 days after access ends so that a subscription can be restored during that period. After the 30-day retention period, a daily deletion process permanently removes the agency workspace, its users, policy and commission records, uploaded files, and associated Stripe event records from active application storage. The billing contact receives the scheduled deletion date when access ends and a reminder seven days before deletion. This clock starts when access ends, which may be later than the date cancellation is requested, and restarts if a payment restores access. A statement file our software could not read is kept as an ordinary document in the agency's workspace and is deleted with it. Contact us if you need to request an export or earlier deletion.

Stripe retains its own invoices and financial records under its policies and legal obligations. Records that must be preserved under applicable law may be retained separately for that purpose. The separate demo-contact retention policy above is not changed by deletion of a workspace.

Deletion from active systems does not immediately remove copies from backups or snapshots. Those copies age out under the hosting provider's retention schedule. Logs and provider-held records follow their respective retention schedules. Expiration of a document link prevents use of that link; it does not delete the underlying document.

Google Analytics keeps event-level data from our marketing website for 2 months and user-level data for 14 months, as configured in our account.

8. Your choices and requests

Email sales@ezcommissions.io with the subject "Privacy request" to ask about access, correction, export, deletion, or marketing opt-out. Include your agency name and account email where relevant, but do not send passwords, full payment details, or unnecessary insured information. We may verify your identity and authority before acting and will respond as required by applicable law. A marketing opt-out does not stop necessary account, security, or billing messages. You can also change your cookie choice for our marketing website at any time with "Cookie settings" at the bottom of each page.

If your information was supplied by an insurance agency, contact that agency first because it manages the underlying relationship and records. You may also contact us; we will coordinate with the agency as appropriate. Rights and exceptions depend on the applicable law and our role in processing the information.

This policy is linked from the application's sign-in page and Billing page, and from the demo-request form.

9. Changes and contact

We will update this policy when our practices change and identify the effective date. Material changes will be communicated as required by applicable law. For privacy requests, contact EZ Commissions, LLC at sales@ezcommissions.io or 1445 Woodmont Ln NW, STE 2033, Atlanta, GA 30318.