Privacy Policy

This Privacy Policy describes how Commercial Underwriting Assurance ("CUA," "we," "us," or "our"), operated by LifePilot Technologies LLC, collects, uses, stores, and protects information in connection with our commercial underwriting assurance platform (the "Platform").

This Platform is a business-to-business (B2B) product. Our direct customers are insurance carriers, managing general agents (MGAs), and program administrators ("Customers"). Individual users of the Platform (underwriters, managers, administrators) access it on behalf of, and under an agreement with, their employer (the Customer).

Account and identity information: name, work email address, role, and organization affiliation, provided when a Customer administrator invites a user to the Platform.

Submission and underwriting data: documents uploaded by Customers (applications, loss runs, property schedules, inspection reports, and similar underwriting materials), and information extracted from those documents by our system (property characteristics, risk facts, and related underwriting data).

Usage and audit data: actions taken within the Platform (uploads, evidence review decisions, submission decisions, and similar actions), timestamps, and the identity of the user or system component that performed each action. This audit trail is a core function of the Platform and is retained as part of the underwriting record.

Technical information: IP address, browser type, device information, and standard web server logs, collected automatically for security and operational purposes.

We use the information described above to:

• Provide, operate, and maintain the Platform
• Process and extract information from documents uploaded by Customers, using our own systems and third-party AI processing (see Section 5)
• Maintain the audit trail and governance records that are a core feature of the Platform
• Communicate with Customers and their users about their account and the Platform
• Respond to demo requests and sales inquiries submitted through our marketing website
• Improve and maintain the security, reliability, and functionality of the Platform
• Comply with legal obligations

We do not use Customer underwriting data to train AI models, and we do not sell Customer data to third parties.

Customers retain ownership of all submission, evidence, and underwriting data they upload to or generate within the Platform. We process this data solely to provide the Platform's services to that Customer.

We rely on the following categories of third-party service providers to operate the Platform:

• Cloud infrastructure and database hosting (Supabase) — for authentication, database storage, and file storage, with data logically isolated by organization.
• AI processing (Anthropic) — uploaded documents are sent to Anthropic's Claude API for the purpose of extracting specific underwriting facts. Under our commercial terms with Anthropic, data submitted through the API is not used to train Anthropic's models.
• Email delivery (Resend) — for transactional emails including account invitations and, for our marketing site, demo request notifications.

We do not control the privacy practices of these providers independently of our agreements with them, and we select providers based on their security and data-handling commitments.

The Platform is built with the following security measures:

• Row-level security enforced at the database layer, logically isolating each Customer organization's data from every other organization
• Role-based access control within each organization
• A complete, immutable audit trail of material actions taken within the Platform
• Encrypted data transmission (HTTPS/TLS) for all data in transit
• Data at rest is stored using our infrastructure provider's standard encryption practices

No security measure is perfect, and we cannot guarantee absolute security. We continuously work to maintain and improve the security posture of the Platform.

We retain Customer underwriting and audit data for the duration of the Customer's active agreement with us. Upon termination of a Customer's agreement, we will retain data for a reasonable transition period (typically up to 90 days) to allow for export, after which it will be deleted from our production systems, except where retention is required by law or for legitimate backup/disaster-recovery purposes for a limited additional period. Specific retention terms may be adjusted by written agreement with a Customer.

Depending on your jurisdiction, you may have rights regarding your personal information, including the right to access, correct, or request deletion of certain information. Because this Platform is used by individuals on behalf of their employer (our Customer), requests regarding underwriting data should generally be directed to your employer in the first instance, as they control that data. Where applicable law (such as the California Consumer Privacy Act or other state privacy laws) grants you direct rights against us, you may contact us using the information in Section 11 and we will respond consistent with our legal obligations.

The Platform is a business tool not directed at or intended for use by children, and we do not knowingly collect information from children.

We may update this Privacy Policy from time to time. Material changes will be communicated to Customers in a manner appropriate to the nature of the change, and the "Last updated" date above will reflect the most recent revision.

Questions about this Privacy Policy can be directed to commercialunderwritinga1@gmail.com.