Privacy policy

CertsDesk prepares certificates of insurance and evidence of insurance for insurance agencies. CertsDesk is run by Xassure, based in Simi Valley, California. This policy explains what information we handle, why, and how we protect it.

Who this covers

• Agencies that use CertsDesk, and the people at those agencies who sign in or email us.
• The agency's insureds, certificate holders and lenders whose details appear in the requests and documents we work on.
• People who use an agency's request page or contact us through certsdesk.com.

What we collect

• Contact details: names, email addresses and phone numbers of agency staff and of people who send requests.
• Request details: the insured, the holder or lender, addresses, loan or vehicle numbers, contract requirements and any attachments sent to us.
• Policy information the agency gives us access to, such as carriers, policy numbers, coverages, limits, dates and endorsements.
• Access to the agency's management system, using a login the agency creates for us.
• Records of our own work: who worked on a request, when, and what changed.

How we use it

Only to provide the service the agency has engaged us for: preparing, checking and delivering certificates and evidence, answering questions about them, and billing the agency. We don't sell information, and we don't use it for advertising.

Automated tools and human review

We use automated tools to help sort incoming emails and read documents, for example to pull policy details from a declarations page. A member of our team reviews the results before anything is used on a certificate or sent to anyone. Your information is never used to train any models.

Who we share it with

• The agency itself, and the holders, lenders and insureds the agency asks us to deliver documents to.
• Service providers that run parts of CertsDesk for us, such as hosting and database (Lovable Cloud, built on Supabase) and email delivery (Postmark). They may only use the information to provide their service to us.
• Anyone the law requires us to share it with.

How we protect it

• Each agency's information is kept separate from every other agency's.
• Our team sees an agency's information only while they're working on that agency's requests, and supervisors see what they need to assign and check work.
• Management system passwords are stored encrypted, and every time one is viewed, we record who viewed it and why.
• Staff and agency users sign in with a one-time code sent to their email.

How long we keep it

For as long as the agency uses CertsDesk, and afterwards only as long as the agency's agreement or the law requires. An agency can ask us to delete its information at any time, and can remove our access to its management system whenever it chooses.

Your choices

If you're an insured, holder or lender, the agency you work with decides how your information is used, so please contact them first. You can also contact us and we'll help or pass your request to the agency. Emails we send to insureds and holders always include a way to stop further emails.

Contact

Questions about privacy: privacy@certsdesk.net.