DRAFT — not legal advice — pending attorney review

Sapiura Privacy Policy

Version 0.1 · Effective {EFFECTIVE_DATE} · Last updated {DATE}

This policy explains what personal information Sapiura Systems LLC ("Sapiura", "we") collects, why, who receives it, and your choices. It covers:

• sapiura.com;
• our free AI check (/ai-check);
• checkout and onboarding;
• our emails;
• the AI Assistant.

It does not cover the websites we build for insurance agencies. Each agency's own privacy notice covers those sites (see Section 9).

The short version:

• We collect only what we need to run our service.
• We don't sell or share your personal information for advertising.
• Our website analytics use no cookies.
• We don't identify anonymous visitors.
• When we ask AI companies questions for the free check, we send only your agency's public business details, never your name or email.

1. Information we collect

1.1 When you browse sapiura.com

• Visit counts (no cookies). We use {ANALYTICS_PROVIDER, e.g., Plausible or Cloudflare Web Analytics}, which counts page views and sources such as referring websites, country and device type in aggregate, without cookies and without building a profile of you. [PA: choose provider]
• Server and security logs. Our hosting and security providers process your IP address, browser type and request details to deliver the site and protect it from attacks. We keep these logs for {N} days. [PA]
• Cookies. We don't use cookies for analytics or advertising. Our payment processor (Stripe) and our anti-bot check (Cloudflare Turnstile) may use strictly necessary cookies or similar technologies on the pages where they appear, for security and fraud prevention. [LAWYER/dev: confirm the exact cookies each one sets.]

1.2 When you use the free AI check

• About your agency: agency name, website, city, state, the lines you write, and optionally a carrier you represent. These are public business details.
• About you: your first name, email, your role (optional), and whether you checked the box to receive marketing emails.
• Anti-bot signals: collected by Cloudflare Turnstile (for example, IP address and browser characteristics) to stop automated abuse.

1.3 When you book a call

"Book 15 minutes" opens Google's appointment scheduling page. Google collects the name, email and any notes you enter, under Google's privacy policy, and shares the booking with us.

1.4 When you buy

• Order details: your name, agency name, work email, optional phone number and current website.
• Payment: handled by Stripe. Stripe collects your card or bank details; we receive only limited information (for example, card brand, last four digits, billing address and payment status). Stripe's privacy policy applies to the data it collects.
• Consent records: the text and version of each checkbox you agree to, with the date, time and IP address, so we can show what you agreed to.

1.5 During onboarding

The agency form asks for business information and may include personal information about your team:

• names, titles, photos, bios, license numbers and work contact details for people shown on the website;
• the Approver's and authorized users' names and emails.

Please share team members' information only with their permission.

1.6 When you use the AI Assistant

• Who sends requests: the names and emails of your authorized users.
• What they ask: the content of each request and our responses.
• Change history: previews, approvals and undo records.
• Your Site's numbers: aggregate, cookie-free visit counts and form-submission counts for your Site.

1.7 When you email us

Your email address and whatever you write.

2. How we use information

We use personal information to:

• deliver our services: build your Site, run the free check, send reports, and operate the AI Assistant;
• process payments;
• send transactional emails (receipts, onboarding, renewal reminders, cancellation confirmations);
• answer questions;
• protect our services against fraud and abuse;
• meet legal obligations, such as tax and records.

Marketing emails are sent only if you opted in (for example, by checking the box on the free check), and every one has a one-click unsubscribe. We also send one help email if you start checkout and don't finish, and nothing else unless you buy or opt in.

3. AI providers: what they receive

We use OpenRouter to reach AI models, including models from OpenAI and Perplexity, for the free AI check and the AI Assistant.

• Free AI check. We send only your agency's public business details (agency name, city, state, lines, and optionally a carrier and website) inside questions like "Who's the best independent insurance agent in {city}?" We never send your name, email or any other personal information to OpenRouter or any AI provider.
• AI Assistant.
  • What we send: the text of each request, plus the website content needed to carry it out.
  • What we don't send: the requester's name or email.
  • What a request may contain: whatever someone types. A request can include personal information (for example, "Add Dana Lee to our team page"). Please don't include sensitive information, such as clients' policy or financial details, in requests.
• Provider settings. We configure our AI providers, where available, so that they don't use our data to train their models and keep it for as short a time as possible. [LAWYER/dev: confirm OpenRouter's and each routed provider's data-retention and training settings (e.g., zero-data-retention routing), and list them accurately here.]

4. Who receives personal information

We don't sell personal information, and we don't "share" it for cross-context behavioral advertising (as those terms are used in California law). We disclose it only to service providers that help us run Sapiura, under contracts that limit their use of it:

We may also disclose information:

• if required by law or valid legal process;
• to protect our rights, users or the public;
• as part of a merger or sale of our business, with notice to you.

[PA: fill in providers; LAWYER: confirm that the contracts with each meet "service provider" requirements.]

5. What we don't do

• We don't identify anonymous visitors, and we don't use tools that try to.
• We don't use advertising pixels, cross-site tracking or session recording on sapiura.com.
• We don't sell or rent personal information.
• We don't use personal information to make decisions that have legal or similarly significant effects on you.

If we ever want to change any of these, we'll update this policy first. We won't apply the change to information we already hold without your consent.

6. How long we keep information

7. Security

We use reasonable administrative, technical and physical safeguards, including:

• encryption in transit (HTTPS);
• access limited to people who need it;
• no password collection from clients;
• reputable providers.

No system is perfectly secure. If a breach affects your personal information, we'll notify you as required by law.

8. Your choices and rights

Everyone. You can, at any time:

• ask what personal information we have about you;
• ask us to correct it or delete it;
• unsubscribe from marketing emails, using the link in any email or by writing to us.

State privacy laws. Depending on where you live, laws such as the California Consumer Privacy Act (CCPA, as amended by the CPRA) and other state privacy laws may give you rights to:

• know or access the personal information we have;
• delete it;
• correct it;
• get a portable copy;
• opt out of sale, sharing or targeted advertising (we don't do these).

You also have the right not to be discriminated against for using these rights. Some of these laws may not apply to a company of our size, but we honor these requests from any US resident. [LAWYER: confirm which state laws apply now; add any required "notice at collection" details, categories of personal information and sources.]

How to make a request.

1. Email info@sapiura.com with the subject "Privacy request".
2. We'll verify your identity by confirming control of the email address we have on file, and we may ask for more information if needed.
3. An authorized agent may make a request on your behalf with proof of authorization.
4. We respond within 45 days, and may extend that once by 45 more days if needed, with notice.

Appeals. If we decline your request, you can appeal by replying to our decision with the subject "Privacy appeal". We'll respond within the time required by your state's law. [LAWYER]

Global Privacy Control and Do Not Track. We don't sell or share personal information or track you across sites, so these signals don't change how we treat you. We honor Global Privacy Control as an opt-out request anyway.

9. Agency websites we build or operate

For quote forms and visit counts on websites we build for insurance agencies:

• The agency is responsible for that information, and the agency's privacy notice applies. Sapiura acts as the agency's service provider.
• What we do with it. We process it only to deliver it to the agency and to keep a backup copy for {N months}. We don't sell it, share it or use it for our own marketing, and we don't contact the agency's visitors or prospects.
• No identification. Agency sites we build use cookie-free visit counts, and we don't install tools that identify anonymous visitors.

If you submitted a form on an agency's website, please contact that agency about your information. We'll help the agency respond. [LAWYER: data processing addendum with agencies; GLBA and state insurance privacy rules.]

10. Children

Our services are for businesses and are not directed to children under 16. We don't knowingly collect their personal information.

11. Where we process information

We're based in the United States and process information in the United States {and other countries where our providers operate}. [PA/LAWYER: confirm server locations; add cross-border language if needed.]

12. Changes to this policy

We'll post any changes here with a new "Last updated" date. If the changes are material, we'll notify active clients by email before they take effect.

13. Contact

Sapiura Systems LLC · {MAILING_ADDRESS} · info@sapiura.com