PolicyUnity Privacy Policy

1. Introduction

This Privacy Policy explains how PolicyUnity handles information within its scope and the choices available to you. In this document, "information" or "personal information" — unless we say otherwise — refers to information that identifies, relates to, or could reasonably be linked to an individual or household.

This Privacy Policy applies wherever we determine the purposes and means of processing your information — specifically, through our websites, emails, phone calls, and any other online service that links to this Privacy Policy (collectively, the "Service"), as well as the additional sources described below. Your use of the Service is also subject to our Terms of Use.

This Privacy Policy does not cover:

• practices of third parties who are outside our control;
• information collected in connection with job applications or employment; or
• information that has been anonymized — or, where law permits, deidentified.

If you live in a state with additional privacy protections, see our U.S. State-Specific Disclosures below.

You can reach us using the details in our Contact Us section.

2. Information We Collect

Our role is to help consumers shopping for insurance connect with companies that run online insurance marketplaces or sell insurance products (our "business customers"). Our revenue comes from referral fees and commissions paid by business customers when policies are bound through their platforms. The categories of information we collect are:

• Characteristics and demographics — such as ZIP code and country of residence.
• Device identifiers — such as your device's IP address.
• Device information — such as operating system, browser type/version/configuration, internet service provider, and regional and language settings.
• Internet and other network activity — such as the pages you visit on the Service, the content you view, the time of day you browse, and the referring and exit pages.
• Non-precise location data — such as approximate location derived from an IP address or generalized to a city or postal code.
• Communications content — anything you share when speaking with us (for example, the content of phone calls).
• Business contact information — name, job title, business email, and phone number of personnel of current or prospective business customers.
• Inferences and insights we develop from any of the above.

We are not an insurance carrier. We do not collect insurance application data, financial account information, Social Security numbers, or other sensitive personal details — please do not provide that type of information to us.

3. How We Collect Information

We obtain information from the following sources:

• Directly from you on the Service. When you use the Service, we may ask you for information so we can connect you with one of our business customers serving your area.
• Automatically from your device. When you interact with the Service, we and our third-party partners automatically collect device identifiers, device information, and internet activity using cookies and similar tracking technologies (see Cookies and Other Technologies).
• From phone calls. If you call our phone number, we may ask for information so we can route you to a business customer that operates in your area. We also collect metadata about the call (such as duration) and the content of the conversation.
• From our business relationships. In dealing with current and prospective business customers, we collect business contact details for their personnel.
• From third parties, including:
  • Vendors and related parties who provide us with analytics, advertising, security, and fraud-prevention services.
  • Social media platforms when you engage with our content or advertisements there.
  • Business customers who engage our services.
• Generated by us — information we create or derive from any of the categories above.

4. Cookies and Other Technologies

This section describes the tracking technologies we use to gather information automatically from your browser or device. See Your Privacy Choices for how to limit them.

• Cookies. Cookies are small text files saved to your browser when you visit a website, open or click an email, or interact with an ad. They come in different flavors: session cookies expire when you close your browser, while persistent cookies remain until they expire or are deleted manually. Cookies can be first-party (placed directly by us) or third-party (placed by partners we work with).
• Pixels. Pixels (also called web beacons) are small pieces of code embedded in a service. They include image pixels (often single transparent images) and JavaScript pixels (which execute code). Pixels are often used in combination with cookies; when you access a page that contains a pixel, the pixel may let us or a partner collect information from your browser or device or read/place cookies.

We use these technologies to operate the Service, personalize your experience, prevent fraud, strengthen security, measure performance, and deliver advertising (including targeted advertising).

5. Why We Collect and Use Information

We collect and use information for these purposes:

• To connect you with a business customer at your request.
• To provide lead-generation services to our business customers.
• To operate and maintain the Service.
• To communicate with you, including sending transactional and marketing messages by email and handling inbound phone calls.
• To understand usage and trends, including through analytics tools (such as Google Analytics) embedded in the Service.
• To improve our products and services.
• For advertising. We work with many advertising partners — including agencies, ad networks, publishers, social platforms, and ad-tech vendors — to deliver and measure ads. For instance, we run ads on third-party websites and platforms that incorporate tracking technologies to serve the ad, measure performance, detect fraud, limit ad frequency, and produce analytics. If you visit the Service after seeing or clicking one of our ads, tracking technologies on the Service help us attribute your visit and gauge ad effectiveness.

Some of the advertising we engage in is "targeted advertising," meaning we show more relevant or personalized ads based on activity across non-affiliated services over time. Targeted advertising typically involves third-party tracking technologies on the Service or sharing (often hashed) identifiers with third parties. Those third parties then combine our data with their own (or their partners') to deliver ads to you or to lookalike audiences. As one example, we use the Meta pixel on our website to serve ads to Meta audiences using the data we share.

We also use audience-modeling services: we and a partner each share (typically hashed) identifiers with a technology provider, which compares them to identify audience overlap and improve campaign performance.

• Security, compliance, and enforcement — preventing, detecting, investigating, and responding to fraud, misuse, legal or policy violations, and threats to safety.
• At your direction — when you specifically ask us to use your information in a particular way or when we notify you and obtain your consent.
• Non-personal information. We may anonymize or deidentify information so it is no longer personal information under applicable law. Where we deidentify information, we will keep and use it only in deidentified form and will not attempt to re-identify it. We may use non-personal information for any lawful purpose.

See Your Privacy Choices for ways to manage how we collect and use your information.

6. How We Share Information

We share information for the purposes described in this Privacy Policy. The categories of recipients include:

Business customers. At your direction, we share your information so we can connect you with one of our customers that serves your area.

Service providers. Many of the third parties we work with are service providers that process information on our behalf — for example, payment processing, data analytics, marketing and advertising support, website hosting, and technical support. To the extent required by law, our contracts with service providers prohibit them from processing information they collect for us for any purpose other than performing services for us (though we may allow them to use non-personal information for any lawful purpose).

Independent third parties. Some of the third parties we work with determine the purposes and means of processing your information independently. Examples include analytics, security, and fraud-prevention vendors; ad networks, technology providers, and other parties that support targeted advertising.

• Affiliates. We share information with our affiliates and related entities — sometimes acting as service providers under this Privacy Policy, and sometimes processing the information under their own policies.
• Merger or acquisition partners. We share information in connection with — or while negotiating — any proposed or actual merger, purchase, sale, financing, acquisition, or other business combination involving all or part of our assets.
• For legal, security, and enforcement reasons. We share information to comply with the law or other legal process, including in response to lawful requests from public authorities (for example, to meet national security or law-enforcement requirements). We also share information to protect the rights, property, safety, life, and health of ourselves, the Service, and others.
• At your direction or with consent. We share information where you tell us to, or where we notify you and obtain your consent.
• Non-personal information. We may share non-personal information for any lawful purpose.

See Your Privacy Choices for ways to control disclosures.

7. Third Parties

The Service may link to — or be integrated with — websites and online services operated by third parties. We may also incorporate third-party technologies (including those described in Cookies and Other Technologies) into the Service. Except when those third parties are acting as our service providers, they (not we) decide how to handle your information.

8. Your Privacy Choices

This section describes the choices available to you.

Region-Specific Choices

Some regions provide additional rights. See our U.S. State-Specific Disclosures for details.

Communications

To stop receiving marketing emails, click the unsubscribe link near the bottom of the email, or email us at the address in Contact Us with "UNSUBSCRIBE" in the subject line. You cannot opt out of transactional emails.

Browser and Device Controls

• Cookies and pixels. Most browsers let you manage cookies through their settings. Pixels that work in conjunction with cookies may be affected when you change cookie settings. Cookie controls apply only to our website and only to the browser you set them on; using a different browser, deleting cookies, or resetting them will require you to redo the configuration. The extent to which you can limit cookies depends on your browser.
• Third-party opt-outs. Some of the third parties we work with offer their own opt-out tools for cookies and pixels. To opt out of Google Analytics specifically, visit tools.google.com/dlpage/gaoptout. We are not responsible for the effectiveness of any third-party tool.
• Industry opt-out tools for targeted advertising. Some of our partners follow the Network Advertising Initiative or the Digital Advertising Alliance's Self-Regulatory Principles for Online Behavioral Advertising, which provide their own opt-out tools. Visit networkadvertising.org/choices and youradchoices.com/control for details. We are not responsible for the effectiveness of these tools.

9. Children

The Service is not intended for children under 16. If you are a parent or guardian and you believe we have collected information from a child in violation of the law, please contact us using the details in Contact Us.

10. Security

We maintain reasonable administrative, physical, and technical safeguards designed to protect information about you from loss, theft, misuse, and unauthorized access, disclosure, alteration, or destruction. Even so, no method of transmission over the internet is fully secure, and we cannot guarantee the security of information about you.

11. Retention

We keep information for as long as is reasonably necessary for the purpose for which it was collected, and as needed to comply with our legal obligations, resolve disputes, prevent fraud, and enforce our agreements.

12. International Transfers

We are based in the United States. Your information may be transferred to and processed in the U.S. or in another country where we operate. Where required by law, we will put appropriate safeguards in place for such transfers.

13. Updates to this Privacy Policy

We may revise and reissue this Privacy Policy from time to time. Updates take effect immediately when posted. By continuing to use the Service after an update is posted, you consent to the Privacy Policy as then in effect. For material changes, we may provide additional notice — for example by email or by posting prominently on the Service.

14. Contact Us

The controller responsible for the information described in this Privacy Policy is:

PolicyUnity ("PolicyUnity," "we," "our," or "us")
1234 Market Street, Suite 500
Wilmington, DE 19801, United States
[email protected]

If you have questions about our practices — or if you are having trouble accessing this Privacy Policy — please reach out using the postal or email address above. To exercise any of the choices available to you, follow the instructions in the relevant section of this Privacy Policy.

15. U.S. State-Specific Disclosures

This section applies to residents of California and any "Consensus State." A "Consensus State," for purposes of this Privacy Policy, is any U.S. state that has enacted a comprehensive privacy law — including, at present, Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia. Unless otherwise stated, this section does not apply to residents of other states.

Notice at Collection

Our practices in summary:

• Collection. Over the past 12 months we have collected the categories of personal information described in the Information We Collect section above.
• Sources. The categories of sources are described in the How We Collect Information section above.
• Purposes. The specific business and commercial purposes for which we collect and use personal information are described in the Why We Collect and Use Information section above.
• Disclosure. The categories of recipients (including service providers acting for business purposes) are described in the How We Share Information section above. We disclose the categories of personal information listed in the Information We Collect section to service providers for business purposes.
• Sales, sharing, and targeted advertising. Some of our disclosures to third parties may be considered "sales" or "shares" for cross-context behavioral advertising under applicable law. We may also process your personal information for purposes of "targeted advertising" as defined under applicable law. The categories of personal information involved in those activities include identifiers, characteristics or demographics, device information, internet activity, non-precise geolocation data, and inferences drawn from any of those categories. The categories of third-party recipients include, where applicable, vendors and other parties involved in cross-context behavioral advertising. We do not sell or share personal information of consumers we know to be under 16.
• Profiling. We do not process personal information for profiling purposes in furtherance of decisions that produce legal or similarly significant effects.
• Sensitive data. We collect, use, and disclose sensitive personal information only for permissible business purposes under applicable law. We do not sell or share sensitive personal information.
• Retention. The criteria we use to determine how long to keep your personal information are described in the Retention section above.

Your Rights

This subsection describes the rights you may have. For how to exercise them, see Exercising Your Rights below.

Verifiable requests.

If you are a California resident, you have the right to:

• Know what personal information we have collected about you — including the categories of sources, the business or commercial purposes for collecting, selling, or sharing, the categories of personal information we sold, shared, or disclosed for a business purpose, the categories of third-party recipients, and the specific pieces of personal information we collected about you.
• Correct personal information about you that is inaccurate.
• Delete personal information that we have collected from you.

If you are a Consensus State resident, you have the right to:

• Confirm whether we are processing your personal information — and, in certain states, the categories we are processing;
• Access your personal information;
• Correct inaccuracies in your personal information;
• Delete your personal information;
• Obtain a copy of personal information you previously provided to us in a portable and readily usable format.

If you live in Minnesota or Oregon, you also have the right to obtain a list of the specific third parties to which we have disclosed personal information.

If you live in Delaware or Maryland, you also have the right to obtain a list of the categories of third parties to which we have disclosed personal information.

If you live in Connecticut, you also have the right to obtain a list of the specific third parties to which we have sold personal information.

• Opt-out of sales, shares, and targeted advertising. You may opt out of our selling or sharing of your personal information for cross-context behavioral advertising and of processing for targeted-advertising purposes.
• Revoke consent. Where we rely on your consent to process personal information, you can withdraw it. Withdrawing consent may limit your ability to use certain features tied to that consent.
• Non-discrimination. We will not discriminate against you for exercising your privacy rights.
• Appeals. You have the right to appeal our decision in response to a request.
• Authorized agents. You may exercise your rights through an authorized agent.

Exercising Your Rights

This subsection explains how to exercise your rights.

• Verifiable requests. To exercise these rights, please submit our Consumer Privacy Request Form (and indicate which right(s) you wish to exercise) or email [email protected]. Verifiable requests require us to confirm your identity before we act. To verify, we may ask you to confirm receipt of an email sent to an address that matches our records, supply details about your history with us, or provide additional information. If we cannot verify your identity, we may deny the request to the extent allowed by law.
• Opting out of sales, shares, and targeted advertising. Generally, we do not associate information collected through tracking technologies on our website with other information in our systems. As a result, you may need to submit one opt-out for tracking-technology data and a separate opt-out for other information (for example, your email address). For tracking-technology data, you can enable a recognized opt-out preference signal such as Global Privacy Control, or adjust your cookie settings through our Consumer Privacy Request Form. That opt-out applies only to the browser on which it is set and will need to be re-applied if you delete cookies or switch browsers. For information in our systems, submit our Consumer Privacy Request Form.
• Consent. To revoke consent, write to us at the email or postal address listed in Contact Us, and specify which consent you are withdrawing. If you withdraw consent, you may lose access to certain related services.
• Authorized agents. Authorized agents must submit requests using the methods identified above. Except where prohibited by law, we will require written, signed proof of the agent's authority.
• Appeals. To appeal, write to us at the email or postal address listed in Contact Us and tell us what you are appealing. We will review and respond as required by applicable law. If we deny your appeal, you may submit a complaint to your state's Attorney General.
• Limitations. Your rights are subject to legal exceptions and our retention practices. To the extent permitted by law, rights requests must be exercised using the designated methods.

Additional California Disclosures

• Shine the Light. If you are a customer, you may ask us to provide (i) a list of the categories of personal information disclosed to third parties during the preceding calendar year for those third parties' direct-marketing purposes, and (ii) a list of the categories of third parties that received that information. To submit a Shine the Light request, write to us at the email or postal address listed in Contact Us and identify your message as a "California Shine the Light Request."
• Do Not Track. We do not currently respond to Do Not Track browser signals.

Disclosures for Nevada

If you are a Nevada resident, you have the right to opt out of any sale of your personal information to third parties. To exercise that right, follow the opt-out process in Exercising Your Rights above. Your rights remain subject to legal exceptions and our retention practices.