InsurCore

Privacy Policy

Effective Date: October 5, 2026

Last updated: October 5, 2026

This Privacy Policy explains how Holistic Business Consulting, LLC, a Florida limited liability company, and its affiliates and brands, including InsurCore and Epic Conversions (collectively, “HBC,” “we,” “us” or “our”), collect, use, disclose and protect information in connection with our websites, including insurcore.io and its subdomains (the “Site”), our web, desktop and mobile applications, connectors and agents (the “Platform”), and our data conversion, consulting and related services (the “Services”). It should be read together with our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.

1. Our Two Roles: Business and Service Provider

When we act for ourselves. For information about visitors to our Site, prospective customers, and the individuals who hold accounts on our Platform (such as your name, email address and login activity), HBC decides how the information is used. This Privacy Policy applies to that information.

When we act for our customers. Our customers are businesses, mainly insurance agencies and related organizations. When they use our Services, they give us data from their own systems, which may include information about their clients, insureds, policies, claims, vehicles, drivers, employees and accounting (“Customer Data”). We process Customer Data only on behalf of and under the instructions of the customer, as a “service provider,” “processor” or equivalent term under applicable law. The customer, not HBC, is responsible for that data, for providing any required privacy notices to the individuals it concerns, and for responding to their requests. If you are an insured or client of one of our customers and have a question about your information, please contact that business directly. If you contact us, we will refer your request to the relevant customer where we are able to identify it.

Our handling of Customer Data is governed by our agreements with the customer, including the Master Services Agreement and any data processing terms, which control over this Privacy Policy where they conflict.

2. Information We Collect

2.1 Information you give us

  • Contact and inquiry information, such as your name, agency or company name, job title, email address, phone number, website, city and state, the systems you use, approximate data volume, timeline and any notes you send through our contact or conversion review forms, by email, or by phone.
  • Account information, such as your name, email address, organization, role and password (stored by our authentication provider in hashed form).
  • Transaction and billing information, such as the services you purchase, billing contact details, invoices and payment history. Card and bank details are entered directly with our payment processor, Stripe; we do not store full payment card numbers.
  • Agreement records, such as the version of a legal document or proposal you accepted, the name you typed or the box you checked, the date and time, and your account and device details.
  • Communications and meeting content, such as support messages, emails, chat messages and, where you agree to it, recordings and transcripts of video meetings.
  • Customer Data, as described in Section 1.

2.2 Information collected automatically

  • Site usage. When you browse our Site, we record the pages you view, the referring page, and basic interaction events, linked to a random visitor identifier stored in your browser. We use this first-party data to understand how our Site is used. We do not use third-party advertising or analytics trackers on our Site (see Section 5).
  • Platform session and security data. When you sign in, we record your IP address, browser and device type (user agent), and the times of your sessions. We may derive an approximate location (city, region and country) from your IP address. We use this to keep accounts secure, enforce session limits, detect suspicious activity and maintain audit logs.
  • Logs and diagnostics. Our servers and service providers automatically record technical information such as IP address, request details, error reports and security events.
  • Connector and agent information. If your organization installs one of our connectors or agents (for example, our SQL Connector or backup agent), it reports technical information such as the computer name, operating system version, software version and job status, and transfers the data your organization configures it to transfer.

2.3 Information from third parties

  • Connected accounts. If you choose to connect a third-party account (for example, Google Workspace, Zoom or an accounting system), we receive information from that service according to the permissions you grant. See Section 7 for more about Google and Zoom data.
  • Public and business sources. We may collect publicly available business information, such as information from your agency’s website, state insurance department records and industry directories, to understand prospective customers and to support our Services.
  • Service providers, such as our payment processor (payment status) and email provider (delivery status).

3. How We Use Information

We use the information we collect to:

  • provide, operate, maintain and support the Site, Platform and Services, including performing data conversions and migrations;
  • create and manage accounts, authenticate users and enforce security controls;
  • respond to inquiries, prepare proposals, schedule meetings and communicate with you about your project, account, invoices and changes to our terms;
  • process payments and maintain financial records;
  • send you information about our services that we think may interest you, where permitted by law (you can opt out at any time; see Section 9);
  • understand and improve how our Site and Platform are used and develop new features;
  • detect, prevent and investigate fraud, abuse, security incidents and violations of our Terms;
  • keep records of agreements and acknowledgements;
  • comply with legal obligations, respond to lawful requests, and establish, exercise or defend legal claims; and
  • for any other purpose we describe to you when we collect the information, or with your consent.

We use Customer Data only to provide the Services to the customer that supplied it, to secure and support the Services, to comply with law, and as permitted by our agreement with that customer.

4. Artificial Intelligence

Some features of our Platform use artificial intelligence, including large language model and document processing services provided by OpenAI, Anthropic and Google (Vertex AI and Document AI). For example, we may send field names, small samples of records, document text, meeting audio or transcripts, or email text to these providers to suggest data mappings, classify records, transcribe meetings, summarize documents or draft content.

  • We use these providers’ business and API services. Under their published terms for those services, the providers do not use the data we send to train their general-purpose models.
  • We apply automated safeguards designed to remove or block certain sensitive identifiers (such as Social Security numbers, payment card numbers and bank account numbers) and to redact contact details before data is sent to an AI provider for many features. These safeguards reduce but do not eliminate the possibility that personal information is included.
  • To improve our mapping features over time, we may retain records of AI suggestions and the corrections made to them. Where we use that information across customers, we limit it to structural information such as source and destination field names and mapping choices, and not the contents of individual records.
  • Our conversion process is designed so that AI output is reviewed by people before it is relied upon, and we do not use AI to make decisions that produce legal or similarly significant effects about individuals.

5. Cookies, Local Storage and Similar Technologies

We keep tracking to a minimum. Our Site and Platform use your browser’s local storage and a small number of cookies for the following purposes:

  • Strictly necessary: keeping you signed in, remembering the organization you are working in, protecting against fraud and enforcing security settings.
  • Preferences: remembering interface choices, such as whether a sidebar is open.
  • First-party analytics: a random visitor identifier used to measure how our own Site is used, as described in Section 2.2.

We do not use third-party advertising cookies, cross-site tracking pixels, or third-party analytics services, and we do not allow third parties to collect information about your activity on our Site for their own advertising purposes. You can clear or block local storage and cookies in your browser settings; if you block strictly necessary storage, the Platform will not work.

Do Not Track and Global Privacy Control. Because we do not sell personal information or share it for cross-context behavioral advertising, there is nothing for these signals to opt you out of. We nevertheless honor a Global Privacy Control signal as a request to opt out of any such sale or sharing should our practices change.

6. How We Disclose Information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We have not done so in the preceding twelve months. We disclose information only as follows:

  • Service providers and subprocessors that perform services for us under contracts that limit their use of the information, including cloud hosting, database and storage (Supabase, Cloudflare, Amazon Web Services, Google Cloud), email delivery (Resend), payments (Stripe), accounting (Zoho), AI processing (OpenAI, Anthropic, Google), video meetings and transcription (Zoom, Fathom), web automation and research tools, and code hosting. A list of our subprocessors is available on our Subprocessors page.
  • Within your organization. Information in your account, and project activity, may be visible to administrators and other authorized users in your organization.
  • At your direction, for example when you ask us to load converted data into a destination system, connect a third-party account, or share a file with a recipient.
  • Our affiliates, for the purposes described in this Privacy Policy.
  • Legal and safety. When we believe in good faith that disclosure is necessary to comply with law, regulation, subpoena, court order or other legal process; to respond to a lawful request from a government authority; to enforce our agreements; or to protect the rights, property or safety of HBC, our customers, or others.
  • Business transfers. In connection with a merger, acquisition, financing, reorganization, bankruptcy or sale of all or part of our business or assets, in which case information may be transferred to the successor, subject to this Privacy Policy or a policy at least as protective.
  • Aggregated or de-identified information that does not reasonably identify any individual or customer.

7. Connected Google and Zoom Accounts

Google. If you connect a Google account, we access only the data covered by the permissions you approve (which may include Gmail, Calendar, Contacts, Drive, Tasks or Chat) and use it only to provide the features you have enabled, such as drafting and sending email, scheduling and syncing project communications. HBC’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not allow humans to read it except with your consent, for security purposes, to comply with law, or where it has been aggregated and anonymized, and we do not use it to train generalized AI or machine learning models.

Zoom. If you connect a Zoom account, we access meeting details and, where you enable it, recordings and transcripts, in order to store them with your project, generate transcripts and summaries, and draft follow-up communications. You can disconnect at any time from your account settings or from the Zoom App Marketplace; when you do, we stop accessing your Zoom data, and you may ask us to delete the Zoom data we have stored.

You can revoke our access to a connected account at any time through the third-party service’s security settings.

8. Data Retention

We keep personal information only as long as reasonably necessary for the purposes in this Privacy Policy, including to provide the Services, maintain business and tax records, resolve disputes and enforce our agreements, and comply with law. In general:

  • account information is kept while the account is active and for a reasonable period afterwards;
  • inquiry and prospect information is kept while we have a business relationship or reasonable expectation of one;
  • agreement acceptance records, invoices and financial records are kept for as long as needed to prove the agreement and meet tax and accounting obligations (typically at least seven years);
  • security and session logs are kept for a limited period for security and audit purposes; and
  • Customer Data is retained and deleted in accordance with our agreement with the customer and the customer’s instructions, and is otherwise deleted after the engagement ends on our standard retention schedule.

Deleted data may persist in backups for a limited period until those backups are overwritten.

9. Your Choices and Rights

  • Marketing emails. You can opt out of marketing emails at any time by replying to the email with “unsubscribe” or by contacting us as described in Section 15. We will still send transactional and account messages.
  • Account information. You can review and update much of your account information in the Platform. Users of the Platform can submit requests to access or export their information from their account privacy settings.
  • Privacy rights requests. Depending on where you live, you may have the right to request access to, correction of, deletion of, or a portable copy of personal information we hold about you; to opt out of the sale or sharing of personal information or of targeted advertising (we do neither); to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. To make a request, contact us as described in Section 15. We will verify your request by matching the information you provide with information we hold, and we may ask for additional information to do so. You may use an authorized agent; we may require proof of the agent’s authority and verify your identity directly. If we deny your request, you may appeal by replying to our decision, and we will respond within the time required by law.
  • Requests about Customer Data. If your request concerns Customer Data that we process for one of our customers, we will forward it to that customer where we can identify them, and we will assist the customer as required by our agreement and applicable law.

We may decline or limit requests where permitted by law, for example where fulfilling them would infringe the rights of others, where we must retain information to comply with law or defend legal claims, or where the request is manifestly unfounded or excessive.

10. Security

We use administrative, technical and physical safeguards designed to protect information, including encryption in transit, encryption at rest provided by our hosting providers, additional application-level encryption of credentials and other secrets, role-based access controls and row-level data isolation between customers, audit logging, and automated safeguards around AI processing. However, no system is completely secure, and we cannot guarantee the security of information. You are responsible for keeping your credentials confidential and for the security of your own systems. If we learn of a security incident affecting personal information in our systems, we will notify affected parties as required by applicable law, including the Florida Information Protection Act (Section 501.171, Florida Statutes). Where the incident affects Customer Data, we will notify the customer so that it can meet its own obligations.

11. Children

Our Site, Platform and Services are intended for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 18 through our Site or Platform. If you believe a child has provided us with personal information, please contact us and we will delete it. This Section does not apply to Customer Data, which is governed by our agreements with our customers.

12. International Users

HBC is based in the United States, and we store and process information in the United States and in other countries where our service providers operate. Our Services are intended for businesses in the United States. If you access the Site or Platform from outside the United States, you understand that your information will be transferred to, stored and processed in the United States, where data protection laws may differ from those in your country.

13. State-Specific Disclosures

California and other U.S. states. Certain state privacy laws apply only to businesses that meet specific thresholds and may not apply to HBC. To the extent they apply, this Section provides additional disclosures. In the preceding twelve months we have collected the following categories of personal information, for the business purposes described in Section 3, from the sources described in Section 2, and disclosed them to the categories of recipients described in Section 6: identifiers (such as name, email address, phone number, IP address and account name); commercial information (such as services purchased); internet or other electronic network activity (such as Site and Platform usage); approximate geolocation derived from IP address; audio and visual information (such as meeting recordings, where enabled); professional or employment-related information (such as job title and employer); and inferences drawn from the above about business interests. We do not use or disclose sensitive personal information for purposes that would require offering a right to limit under California law. We do not sell or share personal information, including that of consumers under 16.

California “Shine the Light.” We do not disclose personal information to third parties for their own direct marketing purposes.

Nevada. We do not sell covered information as defined under Nevada law.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date above. If we make material changes, we will provide additional notice, such as by email or through the Platform, before the change takes effect. Your continued use of the Site, Platform or Services after an update takes effect means you acknowledge the updated Privacy Policy.

15. Contact Us

For privacy questions or to exercise your rights, contact us at:

Holistic Business Consulting, LLC
Attn: Privacy
5900 Hickey Way
The Villages, FL 32163
Email: [email protected]
Phone: (352) 418-0123