Agent Vault — Secure intake links for licensed insurance agents

# Agent Vault Privacy Policy

**Effective date:** [DATE]
**Last updated:** [DATE]

> **Plain-English summary:** Agent Vault does not store your Social Security number, bank account number, or routing number. We hold them in an encrypted, temporary cache that expires within 60 minutes — and is destroyed the moment the insurance agent reveals them, whichever comes first. We retain only operational metadata: timestamps, IP addresses, agent emails, and link IDs. Read the rest if you want the details.

---

## 1. Who we are

Agent Vault is a service operated by **[Agent Vault LLC]** ("Agent Vault", "we", "us"), [Florida LLC], based in [Largo, FL]. We provide a secure intake tool for licensed U.S. insurance agents to collect client information without storing it.

Contact: privacy@agentvault.io

## 2. What this policy covers

This policy describes how Agent Vault handles personal information when:
- A **client** submits information through a Agent Vault secure link
- An **agent** signs up for, pays for, or uses the Agent Vault service
- A **visitor** browses agentvault.io

For client-side data submitted through a link, this policy describes **Agent Vault's processing only**. Your agent maintains their own privacy practices for data they receive from you outside of Agent Vault.

## 3. Information we collect

### 3.1 From clients submitting through a link

When you submit information via a Agent Vault intake link, we collect:

**Sensitive content (encrypted, ephemeral — NEVER stored at rest):**
- Social Security number (if requested by your agent)
- Bank account number (if requested)
- Bank routing number (if requested)

This data is encrypted in your browser, transmitted via TLS 1.3, encrypted again at rest in a temporary cache, and destroyed at the earlier of:
- The 90-second reveal window closing in your agent's dashboard, OR
- 60 minutes after submission

**Metadata (retained):**
- IP address
- User-agent (browser type)
- Submission timestamp
- The agent's account ID (so the right agent receives the reveal)
- The link ID
- Outcome (revealed / expired / revoked)

### 3.2 From agents using the service

- Name, email address, mobile phone
- Hashed password (bcrypt — we cannot recover or read it)
- NPN (National Producer Number) and verified license details from NIPR
- Profile information you provide (photo, agency, states licensed)
- Stripe customer ID and subscription status (no payment card data — Stripe handles that)
- Audit log of your account actions

### 3.3 From visitors to agentvault.io

- Standard server logs (IP, browser, pages visited)
- Cookies for session management and analytics (privacy-friendly analytics; no third-party trackers)

## 4. How we use it

| Purpose | Legal basis | Data used |
|---|---|---|
| Provide the secure intake service | Contract performance | Ephemeral payload + metadata |
| Verify your insurance license | Legitimate interest / contract | NPN + license records |
| Bill your subscription | Contract performance | Stripe customer ID + email |
| Send transactional emails (receipts, security alerts) | Contract performance | Email + name |
| Provide an audit log for your compliance | Legitimate interest / regulatory requirement | Metadata only |
| Detect and prevent abuse, fraud, security incidents | Legitimate interest | IPs, timestamps, anomaly signals |
| Improve the product (privacy-friendly analytics, aggregated only) | Legitimate interest | Aggregated, non-identifying usage data |

## 5. Who we share it with

We share data only with the subprocessors below, who help us operate the Service:

| Subprocessor | Purpose | Where |
|---|---|---|
| Vercel | Hosting (web app) | USA |
| Render / Railway | Hosting (API) | USA |
| Neon | Postgres database (metadata only) | USA |
| Upstash | Redis (ephemeral encrypted payloads) | USA |
| Stripe | Subscription billing | USA |
| Resend | Transactional email | USA |
| Twilio | SMS link delivery (only if you opt in) | USA |
| Cloudflare | DNS, CDN, WAF | USA |
| Sentry | Error monitoring (PII redacted) | USA |
| NIPR (NAIC) | Agent license verification | USA |

We do **not** sell your information. We do **not** share it for advertising. We do **not** use it to train AI models.

We may disclose information if required by a valid legal process (subpoena, court order). When we can, we'll notify you first.

## 6. International users

Agent Vault is operated in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S.

## 7. Retention

| Data category | Retention period |
|---|---|
| Sensitive client content (SSN, bank info) | ≤ 60 minutes; destroyed at first reveal |
| Link metadata | 7 years (insurance industry retention norm) |
| Audit logs | 7 years |
| Agent account data | For the life of your account + 7 years post-termination |
| Server logs | 90 days |
| Backups | 30 days, rolling |

You can request earlier deletion at any time via privacy@agentvault.io.

## 8. Your rights

Depending on your state, you may have rights to:

- **Access** the information we hold about you
- **Correct** inaccurate information
- **Delete** your information (subject to retention obligations)
- **Restrict or object** to certain processing
- **Portability** of your data
- **Opt out of "sale" or "sharing"** — we do neither, so this is automatic
- **Non-discrimination** for exercising these rights

To exercise any of these, email privacy@agentvault.io with your request. We'll respond within 45 days.

California residents: this policy is your CCPA/CPRA notice. We do not sell or share personal information for cross-context behavioral advertising.

## 9. Security

We implement administrative, technical, and physical safeguards aligned with the FTC Safeguards Rule:

- TLS 1.3 for all data in transit
- AES-256-GCM for ephemeral storage of sensitive content
- bcrypt password hashing (cost factor 12)
- Optional 2FA for agent accounts
- Role-based access controls + least privilege
- Quarterly security review
- Annual penetration testing (post-MVP)
- Cyber liability insurance coverage

If we detect a breach affecting your information, we will notify you within 72 hours, or sooner where state law requires.

## 10. Children's privacy

Agent Vault is not directed to anyone under 18. We do not knowingly collect information from children. If you believe we have, email privacy@agentvault.io and we will delete it.

## 11. Cookies and tracking

We use:
- **Essential cookies** for session management (you can't opt out — the site won't work)
- **Privacy-friendly analytics** (no third-party trackers, no cross-site tracking) — opt out via your browser's "Do Not Track" or our cookie banner

We do not use Google Analytics, Facebook Pixel, or any ad-tech tracker.

## 12. Changes to this policy

Material changes will be emailed to agent account holders 30 days before they take effect. Updates are also posted at agentvault.io/privacy with a revised "Last updated" date.

## 13. Contact

- General privacy questions: privacy@agentvault.io
- Data subject requests: privacy@agentvault.io with subject line "DATA REQUEST"
- Security disclosures: security@agentvault.io
- Mail: [Agent Vault LLC, Address, City, FL ZIP]

---

*If anything in this policy is unclear, email us. We'll explain in plain English.*