Privacy Policy

CommiFlow (“we,” “us,” or “our”) operates the CommiFlow platform (the “Service”), a SaaS application for independent insurance agents and agencies in the United States that tracks, reconciles, and analyzes commission payments. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By accessing or using the Service, you agree to this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

1Information We Collect

1.1 Account Information

When you create an account, we collect:

• Full name and email address
• Agency name, NPN (National Producer Number), phone number, and business address
• Password (stored securely via Supabase Auth — we never store plaintext passwords)
• User role within the agency (Admin, Producer, or Viewer)

1.2 Commission and Financial Data

To provide the Service, we process:

• Commission statement files you upload (PDF, Excel, CSV formats)
• Parsed commission data including policy numbers, insured names, premium amounts, commission rates, and carrier details
• Policy information including carrier names, policy numbers, effective/expiration dates, and annual premiums
• Producer split rules and commission allocation data
• Reconciliation results and missing payment records

1.3 Payment Information

We use Stripe to process subscription payments. We do not store your credit card numbers, CVV, or full payment card details on our servers. Stripe handles all payment data in accordance with PCI DSS Level 1 compliance. We store only your Stripe customer ID and subscription ID to manage your billing.

1.4 Usage Data

We automatically collect certain information when you use the Service:

• Browser type and version, device type, and operating system
• IP address and approximate geographic location
• Pages visited, features used, and time spent on the Service
• Error logs and performance metrics to improve service reliability

2How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Parse and process uploaded commission statements using AI technology
• Reconcile commission payments against active policies and detect missing or underpaid commissions
• Generate commission reports, producer statements, and dispute exports
• Process subscription payments and manage your billing account
• Send transactional emails (welcome emails, statement-parsed notifications, missing-payment alerts, weekly summaries, renewal reminders, and producer statements)
• Enforce plan-tier limits and manage team access
• Respond to customer support requests and communicate about the Service
• Monitor and analyze usage trends to improve the user experience
• Detect, prevent, and address technical issues and security threats

3Third-Party Service Providers

We share your information with the following trusted third-party service providers strictly to operate and improve the Service. Each provider is contractually bound to protect your data:

4Data Security

We implement industry-standard security measures to protect your information:

• Tenant Isolation: All data is strictly segregated by agency. Every database query is filtered by agency ID, ensuring no agency can access another agency's data.
• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS/SSL (HTTPS).
• Encryption at Rest: Database and file storage are encrypted at rest through our hosting providers' infrastructure.
• Row-Level Security: Database-level security policies enforce data isolation as an additional layer beyond application-level controls.
• Authentication: We use Supabase Auth with secure password hashing (bcrypt). Magic link login is available as a passwordless option.
• Role-Based Access: Three user roles (Admin, Producer, Viewer) limit data access and actions within your agency.
• File Storage Security: Uploaded statement files are stored in agency-specific paths with Row-Level Security policies restricting access.
• Webhook Verification: Stripe webhook payloads are verified using cryptographic signatures to prevent tampering.

While we strive to use commercially acceptable means to protect your information, no method of electronic storage or transmission over the Internet is 100% secure. We cannot guarantee absolute security.

5Data Retention

We retain your data as follows:

• Account Data: Retained for the duration of your active subscription, plus 90 days after cancellation to allow for reactivation.
• Commission Records: Confirmed commission transactions are immutable records retained for the life of your account. This is essential for financial accuracy and audit purposes.
• Uploaded Files: Statement files are retained in secure storage while your account is active. They are deleted within 90 days of account termination.
• Usage Logs: Server and application logs are retained for up to 30 days for debugging and performance monitoring.
• Archived Carriers: Carriers with associated transactions are archived (soft-deleted) rather than permanently removed, preserving historical reporting integrity.

6Your Rights and Choices

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data. You can update your profile and agency information directly in Settings.
• Deletion: Request deletion of your personal data, subject to our retention obligations for financial records.
• Data Portability: You can export your commission ledger and reports in CSV and Excel formats directly from the Service.
• Email Preferences: Manage your notification preferences in Settings → Notifications. You can opt out of weekly summaries, renewal reminders, and other non-essential communications at any time.
• Account Closure: Contact us to close your account. We will delete your data in accordance with our retention policy.

To exercise any of these rights, contact us at privacy@commiflow.com.

7Cookies and Tracking

We use cookies and similar technologies for the following purposes:

• Essential Cookies: Required for authentication and session management (e.g., Supabase auth tokens). These cannot be disabled.
• Functional Cookies: Store your preferences such as notification settings and onboarding state.

We do not use third-party advertising or marketing cookies. We do not sell your data to advertisers.

8Children's Privacy

The Service is intended for use by insurance professionals and business users. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately and we will take steps to delete it.

9Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new Privacy Policy on this page with an updated effective date and, where appropriate, by sending an email notification. We encourage you to review this Privacy Policy periodically.

10Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us: