Privacy Policy

1. Who we are

Clearview CRM ("we", "us") is an insurance-agency management platform operated for the sole use of licensed insurance agencies and their invited users. We are not a consumer service and do not sell products or services directly to end consumers.

2. What we collect

• Account data your agency admin provides (name, work email, phone number, role, license number, sub-agency assignment)
• Client-of-agency data your users upload (leads, policies, documents, activity notes, communications)
• Third-party integration tokens (RingCentral, Google, EzLynx, MailerSend) — encrypted at rest and used only for the connected user's actions
• Audit trail: sign-in events, IP address, user-agent, and per-record modification history

We do not collect biometric data, precise location, or advertising identifiers.

3. How we use your data

• Operate the CRM: authenticate users, store their records, and reply to their in-app actions
• Send transactional email/SMS on the agency user's behalf (e.g. welcome messages, policy notifications)
• Route inbound calls / SMS through the connected agent's own RingCentral extension when they've personally connected
• Improve reliability: application logs, error monitoring, and rate-limiting

We do not use agency or client data to train machine-learning models, and we do not sell or share your data with advertisers.

4. Third-party services

When your agency connects an integration, the third-party service becomes a data processor under our contract with your agency. The integrations we support and the data they handle:

• RingCentral — SMS, click-to-dial, and presence events. Tokens are encrypted at rest.
• Google Workspace — SSO sign-in and (optionally) Google Drive backups of the agency's own data
• EzLynx — bidirectional policy and client sync at the agency's request
• MailerSend — transactional email delivery
• Monday.com — one-way import of the agency's carrier list

Each integration is opt-in and can be disconnected at any time from Settings, which wipes stored tokens and revokes upstream permissions where the vendor supports it.

5. Data retention & deletion

We retain agency data for the duration of the agency's subscription plus 90 days for backup rotation. On written request to privacy@ssiacrm.com, an agency admin may request full deletion within 30 days. Users may disconnect any integration from Settings to immediately wipe the associated tokens.

6. Security

• TLS 1.2+ enforced for every request; HSTS enabled
• Passwords stored with bcrypt (cost factor 12)
• Third-party OAuth tokens (RingCentral, Google) encrypted at rest with Fernet (AES-128-CBC + HMAC-SHA256)
• Multi-factor authentication (email or SMS) required for every sign-in
• Least-privilege database access; per-tenant row isolation enforced at the API layer

7. Your choices

• Disconnect any integration from Settings at any time
• Request an account export (JSON) via the agency admin
• Request deletion — see §5

8. Changes to this policy

We'll update the "Last updated" date at the top and notify agency admins in-app when we make substantive changes.