Privacy Policy

Effective date. October 12, 2026

Who is responsible

The controller of personal data described in this policy is the administrator of the lossrunreports.com service (the "administrator", "we", "us"). You can reach us about any privacy matter at [email protected].

When an agency, MGA, wholesaler or underwriting team (a "customer") uploads loss runs and client data to the service, the customer decides why and how that data is processed. For that data the customer is the controller, or the financial institution responsible under the Gramm-Leach-Bliley Act, and we act as its processor and service provider under the Data Processing Agreement.

Data we process

• Account data. Name, business email address, agency name, role, password hash, sign-in records and subscription details. Payment card data is entered directly with our payment operator and is not stored by us.
• Customer content. Loss runs, letters of authority, applications, dec pages, schedules and other documents uploaded by customers or sent by carriers to an agency inbound address or upload link. These documents can contain names of insured businesses and their contacts, FEINs, policy numbers, claimant names, dates of loss, injury or damage descriptions and claim amounts.
• Data from insureds and carriers. When an insured signs a letter of authority, we record the signer's name, title, email address, signature, time and IP address. When a carrier replies, we record the sender address and the message metadata.
• Usage logs. IP address, browser type, pages and actions in the service, document views, downloads and exports, recorded for security, the audit log and troubleshooting.
• Anonymous demo. A file uploaded to the public demo on the home page, and the extracted result shown in that browser.

Why we process it and on what basis

• To provide the service a customer subscribed to: sending loss run requests and follow-ups, receiving replies, reading documents, building summaries and submissions. Basis: performance of the contract with the customer, and the customer's instructions for customer content.
• To create and secure accounts, prevent fraud and abuse and keep the audit log. Basis: legitimate interest in a secure service and compliance with the customer's security obligations.
• To bill subscriptions and keep financial records. Basis: contract and legal obligation.
• To send service messages such as sign-in codes, request status, receipts and changes to these terms. Basis: contract.
• To measure and improve the service using aggregated usage statistics collected without cookies. Basis: legitimate interest.

We do not sell personal data, we do not share it for cross-context behavioral advertising, and we do not use customer content to train AI models.

Who receives the data

We share personal data only with service providers that help us run the service, under written contracts that limit their use of the data to providing their service to us. The categories are:

• a hosting provider for servers, encrypted storage and backups in the United States,
• a payment operator for subscription checkout and billing,
• an email delivery provider for outbound requests, follow-ups and service messages and for receiving carrier replies,
• an AI model provider that reads documents and drafts summaries, under terms that do not allow it to train on the data or keep it beyond processing,
• analytics without cookies, receiving only aggregated, non-identifying page statistics.

Customer content is also sent where the customer directs it, for example to a carrier in a loss run request, to an insured for signature, or to the customer's AMS or CRM through an integration. We may disclose data where required by law or to protect the rights and safety of users and the service.

How long we keep it

• Customer content is kept for the retention period the customer sets for its agency, from 30 days to 7 years, and deleted automatically afterwards unless a legal hold is set. Deleted documents leave our backups within the next backup cycle.
• Files uploaded to the anonymous demo are deleted right after they are read. Only the extracted result is kept for that browser session.
• Account data is kept while the account is active and for up to 90 days after it is closed, unless a longer period is required for billing and tax records.
• Usage and audit logs are kept for up to 12 months, or longer where the customer's plan includes audit log retention.

Security

Data is encrypted in transit with TLS 1.2 or higher and at rest. FEINs and claimant names carry an additional field-level encryption layer. Access is limited by role, every view and export is logged, and every record is isolated to one customer. The service is built to support the customer's GLBA Safeguards program. More detail is on the security page. No system is perfectly secure, and we notify affected customers of a personal data breach as described in the DPA.

Your rights

Depending on where you live, you may have the right to know what personal data we hold about you, to access, correct or delete it, to receive it in a portable format, to object to or restrict certain processing, and to withdraw consent where processing is based on consent.

• California residents have rights under the CCPA as amended by the CPRA: to know, delete, correct and opt out of sale or sharing. We do not sell or share personal information and do not use sensitive personal information to infer characteristics. We will not discriminate against you for exercising your rights.
• Residents of the European Economic Area, the United Kingdom and Switzerland have rights under the GDPR and equivalent laws, including the right to lodge a complaint with a supervisory authority. Where data is transferred to the United States, we rely on appropriate safeguards such as standard contractual clauses.
• Insureds and claimants whose data appears in loss runs uploaded by an agency should contact that agency first, because the agency controls that data. We will help the agency respond.

To exercise a right, write to [email protected]. We verify the request using information we already hold and respond within the time the applicable law requires, generally within 30 or 45 days. An authorized agent may submit a request on your behalf with proof of authorization.

Cookies

The service uses only strictly necessary cookies. See the Cookie Policy.

Children

The service is for businesses and is not directed to children under 16. We do not knowingly collect their data as account holders.

Changes

We may update this policy. The effective date at the top shows the latest version. Material changes are announced to account holders by email or in the service before they take effect.

Contact

Administrator of the lossrunreports.com service, [email protected].