EGEAN InsureTech Inc. (“Egean”, “we”, “us”) provides the Egean platform (the “Service”): software that insurance advisors, agencies and managing general agencies (our “Customers”) use to run their business. This policy has three parts:
- Part 1: information Egean is responsible for (our customers, users and website visitors).
- Part 2: information we handle on behalf of our Customers (their clients’ information).
- Part 3: rules that apply to both.
Part 1: Information we are responsible for
1.1 What we collect
- Account information. Name, work email, phone, role and organisation. Your password is stored only as a salted hash. We also keep your multi-factor authentication settings and the devices you sign in from.
- Billing information. Subscriptions are paid through our payment processor. Card details are entered directly on the processor’s pages and never reach our servers. We keep only the billing contact, the subscription status and reference numbers.
- Support and communications. Messages you send us and our replies.
- Security and activity records. Sign-in events, and an audit log of significant actions: who did what, and when.
- Website. Our website and application use no advertising or analytics trackers. See §3.5.
1.2 How we use it
- To provide, secure and support the Service.
- To authenticate users.
- To bill subscriptions.
- To send service, security and billing messages.
- To meet legal obligations.
We will ask for your consent before using your information for any new purpose.
1.3 Business contact information
Where Canadian privacy law treats business contact information (your name, title and work contact details, used to reach you about your work) differently, we handle it on that basis.
Part 2: Information we handle for our Customers
2.1 Our role
Advisors and firms put information about their own clients into the Service. That includes:
- identity and contact details, household members, policies, applications and beneficiaries;
- notes, tasks, meetings, communications and documents;
- where the advisor collects it for a needs analysis or quote, date of birth, smoking status, health and financial information.
For this “Customer Data”, the Customer is responsible, and decides what is collected and why. Egean acts as the Customer’s service provider. We process Customer Data only to provide the Service to that Customer, under our agreement with them and on their instructions.
If you are the client of an advisor who uses Egean, please contact your advisor or their firm about your information. They control it, and we will help them respond to you.
2.2 What we do not do with Customer Data
- We do not sell or rent it.
- We do not use it for advertising or marketing profiles.
- We do not use it to train artificial-intelligence models, and we do not use it, even in de-identified or combined form, to improve the Service.
- We access it only as needed to operate, secure, support and troubleshoot the Service for that Customer, or where the law requires.
2.3 Artificial intelligence
The Service includes an AI assistant and AI-assisted features.
- We never send client identity from your records to AI models. Names, email addresses, phone numbers, addresses and dates of birth held in the Service are not included in AI requests.
- No open access to your records. AI models cannot browse or search your client records. They receive only what a specific task needs, identified by internal reference numbers rather than by who the client is.
- Sensitive information without identity. For needs analysis and quoting, AI may process risk information such as age, smoking status, health and financial details, without the client’s identity attached.
- Text you type goes to the AI. Text a user types into the AI assistant is sent to the AI model to produce a response. Users should not type client identity details into it.
- Who processes it. AI processing is done by a service provider that may be located outside Canada (see §3.2). It may not use the data to train its models.
- Connected-account content stays out. Content from connected Google or Microsoft accounts is never sent to our AI features.
- AI output is not advice. Advisors remain responsible for what they tell their clients.
2.4 Connected accounts (Google, Microsoft)
Users may choose to connect their own Google or Microsoft 365 account. Each connection is optional and can be removed at any time, in the Service or in the provider’s own settings. Access tokens are stored encrypted.
- Google / Microsoft 365:
- we read calendar events and email to link them to the user’s existing client records;
- we send email and calendar invitations as the user, only when the user asks us to.
- Items that don’t match a client are not kept.
- Google API Services: Egean’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
2.5 When a Customer leaves
When a Customer’s subscription ends, its organisation moves to our free plan and its Customer Data stays in the Service. A Customer may ask us at any time to delete its Customer Data. We delete it within 30 days of confirming the request. Audit and consent records are kept where the law or regulators require, and backups roll off within 14 days. Customers are responsible for keeping the records their own regulatory obligations require, and should export them before asking for deletion.
Part 3: Applies to both
3.1 Where information is stored
Our application servers and databases are located in Toronto, Canada. Documents and files are stored in Amazon Web Services’ Canada (Central) region. Backups are kept in Canada.
3.2 Service providers and transfers outside Canada
We use carefully selected service providers for:
- hosting and file storage;
- email delivery;
- payment processing;
- electronic signatures;
- AI features;
- address lookup;
- insurance quoting;
- text messaging.
We share only what each provider needs for its function. Providers must protect the information and use it only to provide their service to us. A current list of our service providers is available to Customers on request at support@egean.ca.
Some of these providers process limited information outside Canada, mainly in the United States. Information processed in another country is subject to that country’s laws, and may be accessible to its courts, law-enforcement and national-security authorities.
3.3 How long we keep information
- Customer Data: while the Customer’s account is active, and for the periods the Customer sets. Insurance record-keeping rules commonly require client records to be kept at least 7 years after the last activity; Customers decide when eligible records are deleted.
- Deleted records: held in a recycle bin for 30 days, then permanently removed.
- Backups: kept up to 14 days.
- Audit records: 7 years, as part of the compliance record.
- Evidence of consent to commercial electronic messages: at least 3 years, as Canada’s anti-spam law requires.
- Account and billing records: while the account exists, then as tax and corporate law require.
3.4 Security
Our safeguards include:
- encryption in transit (TLS) and at rest, with an extra application-level encryption layer for client identity details, email message bodies, conversations and documents, which we are extending to all client notes and records;
- mandatory multi-factor authentication;
- role-based access, so each user sees only what their role allows;
- a tamper-evident audit log;
- strict separation between Customers.
No system is completely secure. If a breach of security safeguards creates a real risk of significant harm, we will notify the affected Customer, and where the law requires, the Privacy Commissioner and the affected individuals.
3.5 Cookies and browser storage
The application stores a sign-in token in your browser’s local storage so you stay signed in. It is removed when you sign out. We do not use advertising or tracking cookies. Our website does not use them either. Payments are taken on our payment processor’s own pages, which follow its own cookie policy.
3.6 Your rights
You may ask to:
- see the personal information we hold about you;
- correct it;
- withdraw your consent (subject to legal and contractual limits).
How to ask:
- Information in Part 1: write to our Privacy Officer (§3.9).
- Client information in Part 2: ask the advisor or firm. We will assist them.
We respond within 30 days. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner.
3.7 Children
The Service is for businesses and is not directed at children. Customers may record information about clients’ dependants, such as beneficiaries, as part of their insurance work.
3.8 Changes
We will post updates here with a new effective date. For material changes, we will notify Customers’ administrators at least 30 days in advance.
3.9 Privacy Officer
Privacy Officer, EGEAN InsureTech Inc., Toronto, Ontario, Canada. Email: support@egean.ca.