Privacy Policy

Operator and scope

Kaisurance is operated by Mendy Douglas, a sole proprietor based in Nevada, operating Kaisurance. Contact support@kaisurance.com for privacy requests. This policy covers information about agents using the service and client information processed for their workspaces.

Agents and agencies choose what client records to maintain and how to use them. We process those records to provide the service on their behalf. If you are an insurance client, contact the agent or agency maintaining your record first; we can help route requests after checking identity and authority.

Information we process

Account information includes name, email, optional phone number, workspace name, insurance types, role, seat count, verification status, trial dates and subscription status. New signup Terms acceptance records contain the account and workspace IDs, accepted version, a fingerprint of the Terms text and a server-recorded timestamp.

Client records may include contact information, optional birth date and address, communication preferences and permission evidence, referrals, notes, tasks, appointments, policy numbers, carriers, products, premiums, statuses, status history and commissions. Agent profiles may include business names, NPNs, state licenses, expiration dates, carrier writing numbers and business support contacts.

We process request metadata, authentication events, delivery identifiers and outcomes, and rate-limit information to operate and protect the service. Medical records, completed health applications and medical details are prohibited. Do not submit payment credentials or sensitive identifiers in CRM records or support messages.

How information is used

We use information to create and protect accounts, separate workspaces, display authorized records, provide requested communications and reminders, manage trials and subscriptions, respond to requests and investigate abuse or errors. The application does not use client records for advertising or cross-site ad targeting.

Verification, password-reset and license-renewal emails are account service messages. Birthday emails require the agent's settings and recorded client permissions and opt-out checks. Accepting the Terms does not enroll you in marketing emails.

Service providers

Vercel hosts the website and server endpoints and processes request information and operational logs. Supabase provides authentication, the application database and configured file storage. Resend processes sender, recipient, message and delivery information for authentication and configured account or birthday emails.

When you use a connected mailbox, Google or Microsoft processes its authorization and email data. When an enabled AI assistant is used, OpenAI receives the reviewed context described below. Stripe is the subscription payment provider; paid checkout is disabled, so the service does not currently accept subscription payments. Payment card details belong in Stripe Checkout, never in CRM client records.

Support requests sent to our Gmail address are processed through Google's email service. Do not include confidential client documents in a request. Providers may process information outside your location. We do not promise exclusive storage in a particular country or zero provider retention.

Connected email

Connecting a mailbox permits metadata inspection to identify conversations with your active, assigned clients. Initial synchronization looks back up to 30 days; later synchronization uses provider change cursors. Google metadata access can cover the mailbox; Microsoft synchronization covers Inbox and Sent Items. This access is broader than the conversations displayed in the CRM.

Unambiguous conversations with one matching client can be copied, including addresses, subject, plain-text body, dates and thread identifiers. Ambiguous and group messages are skipped; attachments are not imported. Matching text is not reliably screened for medical details. Do not synchronize prohibited content.

Stored mailbox credentials are encrypted server-side. Saved mailbox conversations are restricted to their owning agent, including against other workspace members and owners. Disconnecting removes connection credentials and stops CRM access but preserves saved conversations. Deleting an email in the provider mailbox does not automatically delete its CRM copy. Provider access can also be revoked through your Google or Microsoft account.

AI context and usage

For enabled AI requests, the default context uses authorized record references, dates, statuses and outstanding-task categories. Names, email addresses, birth dates, policy numbers, attachments, free-text notes and email content are excluded by default. Connected-mail history is not automatically included.

You may choose to include reviewed free text from notes, conditions, task titles and recorded activities. Redaction cannot guarantee removal of identifiers or medical information. Review the context and do not include prohibited content. The assistant sends a request to the OpenAI API with response storage disabled; that setting does not mean the provider retains no data.

The CRM tracks request status and token usage for workspace limits. It does not automatically save generated answers as client records. A draft becomes a record if you choose to send it or separately save its text. The assistant does not automatically send messages or modify records.

Cookies and tracking

Session cookies support sign-in and session refresh. A short-lived, secure, HTTP-only cookie supports mailbox OAuth-state validation. These cookies support requested service functions rather than advertising.

The public website does not include advertising pixels or third-party analytics scripts. Hosting, authentication and delivery providers still process technical logs and delivery events. We do not use a separate optional-tracking consent banner for the current site.

Retention, access, export and deletion

When an unpaid trial expires or paid access ends, CRM access pauses. You can still sign in to account and billing settings, but cannot view or export CRM records while access is paused. Trial expiration and cancellation do not automatically delete saved records. Contact us for help with access, export or deletion.

Automatic workspace deletion is not enabled. A self-service 30-day read-only export window is not part of the live service. Do not rely on an automatic 30-day deletion deadline. Before closing your account, export the records available to you and contact us about any remaining information you need.

During active access, the Contacts export downloads the permitted contact records selected through that feature; it is not a complete workspace or document export. Ask us for assistance with other records. Archiving preserves related records, and disconnecting a mailbox preserves previously saved messages.

No fixed automatic retention deadline is currently applied to inactive workspaces. Deletion requests require identity and authority checks. Some account, billing, Terms acceptance and security records may need to be retained for legal obligations, dispute handling or abuse prevention; we will explain relevant exceptions when responding to a request. A universal retention period for those records has not been established.

Provider recovery copies and logs may outlast removal from active systems. Their expiry periods have not been verified, and we do not promise immediate removal from backups. Keep independent copies of records you must retain.

Email support@kaisurance.com to request access, correction, export or deletion. Applicable rights depend on your location and circumstances. We may need information to verify your identity and authority, but do not send identity documents or confidential client records until a suitable method has been arranged.

Policy updates

This policy's effective date identifies the current version. Material changes will be communicated through the service or account email. Contact us with questions about processing or this policy.