Privacy policy

Emerald AMS is agency management software for insurance agencies, provided by TODO_LEGAL_ENTITY_NAME ("we", "us"). This policy covers two things:

• Our own data: what we collect from visitors to emeraldams.com and from the agency staff who use Emerald AMS. For this data we decide how it is used.
• Agency data: the client, policy, call and message records an agency stores in Emerald AMS. The agency is in charge of that data. We process it only on the agency's instructions, as its service provider (also called a processor).

If you are a client of an insurance agency that uses Emerald AMS, that agency's privacy notice explains how it uses your information. Contact the agency first; we will help it answer you. You can also write to us at privacy@emeraldams.com.

We collect the categories below about website visitors and agency staff users.

Payment information. Stripe processes card and bank details. We never see or store full card numbers.

Location. We do not collect precise location. We may infer a rough location (city or state) from an IP address for security.

Sensitive information. For our own purposes we collect only account login credentials (stored as a hash) and the two-step sign-in secret. We do not collect health, biometric or precise location data about our users.

Agency data that agencies store in Emerald AMS can include:

• Client and household records: names, addresses, phone numbers, emails, dates of birth, driver's license numbers, Social Security numbers, FEINs and Medicare identifiers (sensitive fields are encrypted one by one and masked on screen)
• Insurance records: policies, coverages, vehicles, properties, drivers, claims, quotes, applications, certificates and loss runs
• Documents your agency uploads or generates, such as dec pages, ID cards, signed applications and certificates
• Calls, recordings, transcripts, AI call summaries and call scores; text messages, emails, web chat and meeting records
• Payments clients make to your agency (processed by Stripe), invoices, premium trust and commission records
• Consent records (texting consent, call-recording notices, Medicare Scope of Appointment), opt-outs and do-not-call status
• Staff records your agency enters: users, roles, licenses, appointments, producer pay and performance reports

Some agency data is sensitive under state law (for example, Social Security numbers, driver's license numbers and Medicare identifiers). We encrypt those fields one by one, mask them on screen, and log every time someone reveals one.

• From you, when you book a demo, sign up, fill in your profile, contact us or use the app.
• Automatically, from our own servers: IP address, browser type, pages and features used, and error logs. We use only first-party cookies that are needed to run the service (see the Cookie notice). We do not use third-party analytics, ad pixels or session recording on our site or in the app.
• From your agency, when an administrator invites you or sets your role and licenses.
• From services you or your agency connect, such as Google or Microsoft sign-in and calendars, carrier downloads, quoting partners, QuickBooks, lead-ad sources and Canopy Connect.

• To provide, run and support Emerald AMS, including sign-in, two-step verification, phones, texting, email, quoting and AI features.
• To set up demos and answer questions.
• To bill subscriptions and usage.
• To keep the service secure, prevent fraud and abuse, and keep audit records.
• To fix problems and improve features, using our own product events, which record IDs and settings only, never client details.
• To send service messages (for example, security alerts and billing notices). We send marketing email only to business contacts who asked for it or who can opt out at any time.
• To follow the law and enforce our Terms.

We use agency data only to provide the service to that agency. We do not use it to market to an agency's clients, and we do not combine one agency's data with another's.

We share personal information only with service providers who help us run Emerald AMS, under contracts that limit them to providing their service to us. The full, current list, with each vendor's role, is on our Sub-processors page. In summary:

• Hosting: Vercel Inc.
• Database hosting: Neon (Databricks, Inc.)
• AI model provider: Anthropic, PBC
• Telephony and texting: Twilio Inc.
• Speech-to-text: Deepgram, Inc.
• Email delivery: Resend (Plus Five Five, Inc.)
• Payments: Stripe, Inc.
• Video meetings: Daily (Daily.co, Inc.)
• Internal notifications: Slack Technologies, LLC
• Email delivery (alternate): Postmark (ActiveCampaign, LLC)

When an agency turns on an integration (for example, Google or Microsoft calendars, quoting partners, carrier downloads, QuickBooks or lead ads), we send that service the data needed for it to work.

We may also share information if the law requires it, to protect people's safety or our rights, or as part of a merger or sale of our business (the buyer would have to honor this policy).

Emerald AMS includes AI features. They send the records needed for each request to our AI providers:

• Anthropic, PBC (Claude): Ivy, the client-facing assistant that answers texts, web chat and email for your agency; Jade, the staff assistant that answers questions about your book and builds reports; Call summaries, call scoring and coaching notes; Inbox and email triage, document reading (for example, dec pages) and commission statement reconciliation; Coverage review suggestions (policy check) for a licensed person to review. Anthropic's commercial API terms do not allow it to train models on our customers' data, and our account is set up for zero data retention, so prompts and outputs are not kept after the request.
• Deepgram, Inc.: Speech-to-text transcription of recorded calls. Used under business API terms; card numbers, Social Security numbers and other numbers are redacted from transcripts.

We do not use your data or your agency's data to train AI models. AI outputs are labeled in the app and logged on the record. AI does not bind coverage, set prices, decide eligibility or handle claims decisions; licensed people at the agency make those decisions. You can always ask for a person: Ivy hands the conversation to agency staff on request. More detail is on our AI disclosure.

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising. We have no ad pixels, retargeting tags or data brokers on our site or in the app. We do not use or disclose sensitive personal information for anything beyond providing the service, so we do not offer a "limit the use" choice. We have not sold or shared personal information in the past 12 months.

Agency data is kept while the agency's account is active and for the periods the agency sets (by default, 7 years after a policy ends, with longer periods for Medicare records). The agency can export everything at any time, free. When an agency closes its account, we delete or de-identify its data, including uploaded files and recordings, within 30 days after the export window ends, unless the law requires us to keep it longer.

Depending on where you live, you may have the right to:

• Know and access the personal information we have about you, and get a copy in a portable format.
• Correct inaccurate information.
• Delete your information.
• Opt out of the sale or sharing of personal information, targeted advertising and profiling that has legal or similar effects. (We don't do these, but you can still send a request.)
• Limit the use of sensitive personal information.
• Appeal if we deny your request.

How to ask: use our privacy request form, email privacy@emeraldams.com, or call TODO_PHONE. We will confirm we got your request within 10 business days and answer within 45 days (we may extend once by another 45 days if we tell you why). We verify your identity by matching details you give us with what we have, and may ask you to confirm from your account email. You can use an authorized agent; we may ask for proof that you gave them permission.

Appeals: if we deny your request, reply to our answer or email privacy@emeraldams.com with "Appeal" in the subject. We will answer within 60 days. If you are not satisfied, you can contact your state attorney general.

We will not treat you differently, charge you more or give you a lower level of service for using your rights.

If your information is in an agency's records (for example, you are a client of an agency), we will pass your request to that agency, which decides how to respond, and we will help it do so.

We honor Global Privacy Control (GPC) and similar opt-out preference signals as a valid request to opt out of the sale or sharing of personal information and targeted advertising, for that browser and, if you are signed in, your account. Because we do not sell, share or run ad tracking, there is nothing extra to switch off, and no tracking runs whether or not the signal is on.

We use only first-party cookies and browser storage that keep you signed in and remember your settings. We do not use advertising or third-party analytics cookies, so we do not show a cookie banner. The full list is in our Cookie notice. Scripts that agencies add to their own websites (web chat, call tracking, lead forms) are covered by each agency's own notice.

We use reasonable safeguards for the kind of information we hold, including two-step sign-in for every account, encryption in transit, field-level encryption of the most sensitive fields, private file storage with short-lived links, role-based permissions, optional IP allowlists, and audit logs. No system is perfectly secure, and we cannot promise that information will never be accessed without permission. If a breach affects your information, we will notify you and the agency as the law requires.

Emerald AMS is a business tool for adults. It is not directed to children, and users must be at least 18. We do not knowingly collect personal information from children under 13 (or under 16 or 18 where state law applies) for our own purposes. If we learn we have, we will delete it. Agencies may store information about clients' family members (for example, drivers on a household policy) as part of their insurance records; that information belongs to the agency's records.

Emerald AMS is offered to agencies in the United States, and we store and process data in the United States. We do not target users in the European Union or United Kingdom.

This section adds details required by California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and other state privacy laws as they take effect. The rights in "Your rights and choices" apply to residents of those states, as each law provides.

California notice at collection and categories (past 12 months). The table shows each category of personal information we collected, why, who we disclosed it to for a business purpose, and how long we keep it. We did not sell or share any category.

Sources: you, your agency, your devices (automatically), and services you connect. Sensitive personal information: account login credentials, used only to provide and secure the service.

Shine the Light. We do not share personal information with third parties for their own direct marketing.

Business contacts and staff users. California rights apply to business contact and employee information too, and we honor them.

Agency client data. For records an agency stores in Emerald AMS, the agency is the "business" or "controller" and we are its "service provider" or "processor". Insurance information may also be covered by the federal Gramm-Leach-Bliley Act and state insurance privacy laws, which the agency follows.

Colorado, Connecticut, Virginia, Texas, Oregon and similar states: we do not process personal data for targeted advertising, sale, or profiling with legal or similarly significant effects. You can appeal a denied request as described above.

Nevada: we do not sell covered information. You can still send an opt-out request to privacy@emeraldams.com.

• TODO_LEGAL_ENTITY_NAME
• TODO_MAILING_ADDRESS
• Privacy email: privacy@emeraldams.com
• Phone: TODO_PHONE
• Web form: privacy request form

If we make a material change, we will tell agency administrators in the app and by email at least 30 days before it takes effect, and update the dates at the top of this page.

• October 18, 2026: rewritten in full, with the sub-processor list, AI disclosure, retention periods and US state privacy rights.
• October 13, 2026: first version.