Privacy Policy

Structure of this Privacy Policy

This Privacy Policy explains how SimplePin Inc. and its applicable affiliates (“SimplePin,” “we,” “us,” or “our”) collect, use, disclose, retain and protect Personal Information in connection with our websites, enterprise platform, payment experiences, integrations, support services, onboarding processes and related products and services (collectively, the “Services”).

• Part I — Scope, roles and core privacy principles
• Part II — Direct Customer representatives (U.S. and Canada)
• Part III — End Users and payment users (U.S. and Canada)
• Part IV — Information we collect, sources, uses and disclosures
• Part V — Cookies, analytics, AI/automation, retention and security
• Part VI — United States privacy rights and California notice
• Part VII — Canadian privacy rights and provincial notices
• Part VIII — General provisions and contact information
• Schedule 1 — California / U.S. Notice at Collection
• Schedule 2 — Data-role matrix

PART I — SCOPE, ROLES AND CORE PRIVACY PRINCIPLES

1. Scope

1.1 This Policy applies to Personal Information processed through the Services, including information relating to Direct Customer personnel, insureds, policyholders, premium payers, payees, producers, vendors, business contacts and other individuals whose information is submitted to or generated through the Services.

1.2 This Policy does not govern the privacy practices of a Direct Customer, insurance carrier, bank, payment network, agency management system, website linked from the Services, or other third party that determines its own purposes and means of processing. Those parties maintain their own privacy notices and legal obligations.

1.3 Employment applicant and workforce information may be governed by separate notices where required. This Policy may apply to ordinary business-contact information associated with employees of our customers, vendors and partners.

2. Our Privacy Roles

2.1 SimplePin may act in different legal roles depending on the information and activity involved. The role determines which party is primarily responsible for providing notices, establishing the lawful basis or consent for processing, and responding to certain privacy requests.

2.2 When a Direct Customer submits or makes available Personal Information about its insureds, policyholders, payers, producers, employees or other individuals and SimplePin processes that information solely to provide the contracted Services under the Direct Customer’s instructions, the Direct Customer generally determines the purposes of processing and SimplePin generally acts as a service provider, contractor or processor, as those concepts are defined under applicable privacy law.

2.3 SimplePin may independently determine the purposes and means of processing and therefore act as a business, controller or organization for information used for account administration, Direct Customer onboarding/KYB, fraud prevention, security, regulatory compliance, payment records, billing, legal claims, service integrity, corporate governance and other purposes described in this Policy.

2.4 If you are an End User whose information SimplePin processes solely on behalf of an insurance broker, agency, carrier, MGA/MGU or other Direct Customer, privacy requests concerning that Customer-controlled information may need to be submitted to the Direct Customer. SimplePin will support the Direct Customer as required by law and contract.

3. Core Privacy Principles

SimplePin seeks to apply the following principles across the Services: transparency; purpose limitation; data minimization; appropriate accuracy; role-based access; reasonable security; retention only for as long as needed; documented accountability; lawful disclosure; and respect for applicable rights of access, correction, deletion, portability, consent withdrawal and complaint.

4. Definitions

“Direct Customer” means an insurance broker, agency, carrier, MGA/MGU, program administrator, TPA or other approved business customer that contracts directly with SimplePin.

“End User” means an insured, policyholder, premium payer, payee or other individual who interacts with a SimplePin-powered payment, invoice, portal or other experience in connection with a Direct Customer.

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or can reasonably be linked to an identifiable individual, and includes analogous terms such as “personal data” and “personal information” under applicable law.

“Sensitive Personal Information” means information treated as sensitive under applicable law, which may include financial account information, authentication credentials, government identifiers, precise geolocation, biometric information, health information and other information that carries a heightened privacy risk.

“Customer Data” means data submitted to, generated through, or made available to SimplePin by or for a Direct Customer in connection with the Services.

PART II — DIRECT CUSTOMER REPRESENTATIVES

5. Information About Direct Customer Representatives

When a Direct Customer evaluates, purchases, implements, administers or receives support for the Services, SimplePin may collect Personal Information about its employees, officers, directors, owners, authorized signers, administrators, finance personnel, compliance personnel, technical contacts and other representatives.

• name, title, employer, department and professional contact information;
• account identifiers, login credentials, authentication factors and access logs;
• communications, meeting notes, support tickets, training records and implementation information;
• billing contacts, invoice details and business payment information;
• corporate authority, signatory and administrator information;
• KYB, ownership, director, beneficial-owner, sanctions, PEP/HIO, identity-verification or regulatory information where required for payment or regulated services;
• device, browser, IP address, session, security, audit and usage information;
• preferences, product usage, feature adoption and feedback.

6. United States Direct Customer Representatives

For representatives of U.S. Direct Customers, SimplePin generally processes business-contact and account-administration information to establish and manage the commercial relationship, provide Services, authenticate users, administer billing, protect systems, support integrations, conduct compliance and risk reviews, communicate about products and legal matters, and satisfy legal obligations.

Where a U.S. state privacy law applies to business-contact information, eligible individuals may have rights described in Part VI. Certain information or processing may be exempt or subject to different obligations when governed by financial-services, insurance, employment, fraud-prevention, legal-compliance or other sector-specific laws.

7. Canada Direct Customer Representatives

For representatives of Canadian Direct Customers, SimplePin collects, uses and discloses Personal Information for identified and reasonable business purposes associated with evaluating, establishing, administering, securing and complying with the Direct Customer relationship. Where consent is required, SimplePin will seek consent in a form appropriate to the sensitivity of the information and the circumstances.

Canadian representatives may have rights of access and correction and may challenge compliance or withdraw consent where applicable, subject to legal and contractual limits. Additional provincial information appears in Part VII.

PART III — END USERS AND PAYMENT USERS

8. Information About End Users

When an End User receives an invoice, accesses a payment page, makes or receives a payment, requests a refund, communicates with support, or otherwise interacts with a SimplePin-powered experience, SimplePin may process information provided by the End User, the Direct Customer, financial institutions, payment networks, identity/fraud providers and integrated systems.

• name, email address, telephone number and mailing or billing address;
• customer, account, invoice, policy or transaction identifiers assigned by the Direct Customer;
• payment amount, currency, payment method, transaction status, timestamps, refunds, returns and chargeback information;
• bank or tokenized payment-account information needed for the selected payment method, masked or tokenized account/card information where applicable;
• authentication, fraud, security, device, IP address, browser, session and risk information;
• communications with SimplePin or the Direct Customer concerning the transaction;
• information returned by a bank, payment processor, payment network or other payment partner concerning a transaction;
• other information necessary to complete, reconcile, investigate or support the requested transaction.

SimplePin does not require End Users to provide more Personal Information than reasonably necessary for the applicable payment or service flow. Full payment-card credentials may be collected directly by a payment processor, acquirer, gateway or tokenization provider rather than by SimplePin, depending on the payment method and implementation.

9. United States End Users

For U.S. End Users, SimplePin may process Personal Information both on behalf of the Direct Customer that offered the payment experience and for SimplePin’s own purposes where necessary to process and document transactions, prevent fraud, protect the Services, comply with payment-network and legal requirements, investigate disputes and maintain required records.

If SimplePin is acting only as a service provider/processor for a Direct Customer, the Direct Customer may be the appropriate party to respond to certain state privacy requests. Where SimplePin independently controls the relevant information and a state privacy law applies, SimplePin will process eligible requests as described in Part VI.

10. Canada End Users

For Canadian End Users, SimplePin may collect and process Personal Information to facilitate payments, provide transaction status, prevent fraud, verify information, support customer service, comply with applicable payment-network and financial-crime requirements, maintain records, and support the Direct Customer’s insurance payment and reconciliation workflows.

Where SimplePin processes information on behalf of a Canadian Direct Customer, the Direct Customer remains responsible for its own notices, consent and legal authority for the information it controls. SimplePin remains accountable for Personal Information under its own control and for safeguards and contractual protections applicable to service-provider processing.

PART IV — INFORMATION WE COLLECT, SOURCES, USES AND DISCLOSURES

11. Categories of Personal Information

12. Sources of Personal Information

• directly from you when you register, pay, communicate, request support, complete onboarding or otherwise interact with the Services;
• from a Direct Customer, including an insurance broker, agency, carrier, MGA/MGU or other organization using SimplePin;
• from agency management systems, ERP/CRM platforms, carrier systems, bank statements, commission statements and other integrated business systems;
• from banks, financial institutions, payment processors, acquirers, card networks, ACH/EFT/Interac participants, gateways and other payment partners;
• from fraud-prevention, identity-verification, sanctions, compliance and security providers;
• from cookies, pixels, logs and other technologies used on our websites and platform;
• from publicly available corporate, professional, regulatory or government records where appropriate for business verification or compliance;
• from affiliates, vendors and professional advisors involved in providing or protecting the Services.

13. How We Use Personal Information

• provide, configure, operate and support the Services;
• present invoices and payment options and initiate, route, reconcile, settle, refund or otherwise support transactions;
• connect to and synchronize with agency management, ERP/CRM, carrier, banking and other third-party systems;
• capture, normalize, classify, match and reconcile carrier statements, receivables, commissions, payments and related records;
• authenticate users, manage accounts, permissions and security controls;
• perform Direct Customer onboarding, KYB/KYC, sanctions, fraud, risk and compliance activities where required;
• detect, prevent, investigate and respond to fraud, abuse, security incidents, disputes, chargebacks and unauthorized activity;
• communicate about transactions, support, implementation, service notices, legal notices and account administration;
• invoice Direct Customers, collect fees and maintain financial and tax records;
• monitor, troubleshoot, maintain and improve the reliability, security and performance of the Services;
• conduct analytics, capacity planning, product development, quality assurance and service improvement using information appropriate for those purposes;
• protect our rights, users, Direct Customers, payment partners and the public; establish, exercise or defend legal claims; and comply with law, regulation, court process, regulatory requests and contractual obligations;
• send business marketing communications to Direct Customer representatives where permitted, subject to applicable opt-out rights.

14. AI, OCR and Automated Processing

SimplePin may use optical character recognition, rules-based systems, machine learning and artificial intelligence to extract information from documents, normalize data, identify potential matches, classify transactions, detect anomalies, generate reconciliation suggestions, prioritize support or risk review, and improve operational workflows.

Automated outputs may be probabilistic and are not intended to replace required human or business review for material insurance, accounting, legal, coverage or financial decisions. Direct Customers remain responsible for validating outputs before using them for production accounting, carrier settlement, producer compensation or other material actions.

Unless otherwise agreed in writing, SimplePin does not use identifiable Customer Data or End User Personal Information to train generalized models for unrelated third parties. SimplePin may use aggregated or de-identified information to operate, secure, analyze and improve the Services, provided it does not reasonably identify an individual or Direct Customer.

Where applicable law provides rights relating to decisions based solely on automated processing, SimplePin and the relevant Direct Customer will provide information or review mechanisms as required based on their respective legal roles.

15. When We Disclose Personal Information

SimplePin may disclose Personal Information as reasonably necessary to the following categories of recipients:

• Direct Customers and their authorized users, when the information relates to their account, customer, payment or requested service;
• financial institutions, payment processors, acquirers, card networks, ACH/EFT/Interac participants, gateways, tokenization providers and other payment partners;
• insurance carriers, agency management systems, ERP/CRM providers and other integrated platforms as directed by the Direct Customer or necessary to provide the Services;
• cloud hosting, security, fraud, identity-verification, sanctions screening, customer-support, communications, analytics, document-processing and other service providers that process information for SimplePin under contractual restrictions;
• professional advisors, auditors, insurers, financing sources and other parties supporting our legal, accounting, compliance, risk or corporate functions;
• regulators, government agencies, law enforcement, courts, networks, banks or other parties when required or permitted by law, regulation, legal process, payment rules or to protect rights and safety;
• a buyer, investor, lender, successor or other party involved in an actual or proposed merger, financing, acquisition, reorganization, sale of assets or similar corporate transaction, subject to appropriate safeguards;
• other parties with your direction, consent or as otherwise disclosed at the point of collection.

SimplePin does not disclose Personal Information to Direct Customers for unrelated advertising or permit a Direct Customer to use Personal Information obtained through the Services for purposes inconsistent with applicable law and the parties’ agreement.

16. Sale, Sharing and Targeted Advertising

SimplePin does not sell payment-account information or Customer Data for money. SimplePin does not use End User transaction information for unrelated cross-context behavioral advertising.

Our public marketing website may use analytics, measurement and advertising technologies. Depending on the technology, jurisdiction and configuration, certain disclosures of cookie or device identifiers may be treated as a “sale,” “sharing,” or targeted advertising under state privacy laws even when no money changes hands. Where required, SimplePin will provide applicable notices, consent controls, opt-out mechanisms and support for recognized browser-based signals such as Global Privacy Control.

PART V — COOKIES, RETENTION, SECURITY AND CROSS-BORDER PROCESSING

17. Cookies and Similar Technologies

SimplePin websites and Services may use cookies, local storage, SDKs, pixels and similar technologies to keep users signed in, remember preferences, protect sessions, measure performance, understand usage and, on public marketing pages, support analytics or advertising where permitted.

• Strictly necessary technologies — authentication, session management, load balancing, fraud prevention, security and core functionality;
• Functional technologies — preferences, language and convenience features;
• Analytics technologies — service usage, diagnostics, performance and product improvement;
• Advertising/measurement technologies — only where used on public marketing pages and permitted by applicable law and user choices.

Where required, users can manage non-essential technologies through a cookie preference tool or browser/device settings. Blocking certain technologies may affect functionality. SimplePin will honor legally required opt-out preference signals where applicable to its role and systems.

18. Data Retention

SimplePin retains Personal Information for no longer than reasonably necessary for the purposes described in this Policy, including to provide the Services, maintain transaction and reconciliation history, support Direct Customer instructions, comply with accounting, tax, payment, anti-money-laundering and other legal obligations, prevent fraud, maintain security logs, resolve disputes and establish or defend legal claims.

Retention periods vary by data type, jurisdiction, payment method, customer contract and regulatory obligation. When information is no longer required, SimplePin will delete, destroy, anonymize or otherwise render it non-identifiable in accordance with applicable law and internal retention procedures, subject to backup cycles, legal holds and technical limitations.

A Direct Customer may have independent retention obligations for insurance, accounting, premium, policy and customer records. Termination of a Direct Customer relationship does not necessarily require immediate deletion of information that SimplePin or the Direct Customer is legally required to retain.

19. Security

SimplePin maintains administrative, technical and organizational safeguards designed to protect Personal Information against unauthorized access, acquisition, use, disclosure, alteration, loss and destruction. Safeguards are selected based on factors such as sensitivity, volume, use, storage environment and risk.

• role-based and least-privilege access controls;
• authentication and session-security controls;
• encryption in transit and, where appropriate, at rest;
• logging, monitoring, vulnerability management and security testing;
• security policies, incident response and employee confidentiality/training measures;
• vendor and service-provider diligence and contractual security obligations;
• business continuity, backup and disaster-recovery practices appropriate to the Services.

No security program can eliminate all risk. Users and Direct Customers are responsible for protecting credentials, devices and authorized-user access and for promptly notifying SimplePin of suspected compromise.

20. Privacy and Security Incidents

SimplePin maintains processes to investigate suspected unauthorized access, use, disclosure, loss or other compromise of Personal Information. We will take reasonable steps to contain and remediate confirmed incidents and will provide notices to affected Direct Customers, individuals or regulators when required by applicable law or contract.

Where SimplePin processes Personal Information solely on behalf of a Direct Customer, SimplePin will provide the Direct Customer with information reasonably necessary for the Direct Customer to meet its own notification obligations, subject to applicable law, security considerations and law-enforcement restrictions.

21. Cross-Border Processing and Service Providers

SimplePin and its service providers may process Personal Information in the United States, Canada and other jurisdictions where we or our approved providers operate. Laws in those jurisdictions may differ from the laws where you live, and information may be accessible to courts, law enforcement, regulators or national-security authorities in accordance with local law.

For Canadian Personal Information under SimplePin’s control, SimplePin remains accountable for information transferred to service providers and uses contractual, diligence and security measures intended to provide appropriate protection. Where required by Quebec law, applicable privacy-impact and cross-border assessments will be completed before communicating Personal Information outside Quebec.

22. Data Accuracy and Minimization

SimplePin takes reasonable steps appropriate to its role to maintain information that is accurate, complete and current for the purposes for which it is used. Direct Customers are responsible for the accuracy of source-system and Customer Data they provide. Individuals may request correction where provided by law.

Direct Customers should not submit Social Security Numbers, Social Insurance Numbers, medical information, biometric information or other highly sensitive information unless it is necessary for an approved Service, legally permitted, and covered by the parties’ contractual and security arrangements.

PART VI — UNITED STATES PRIVACY RIGHTS

23. U.S. State Privacy Rights

Residents of certain U.S. states may have privacy rights under comprehensive state privacy laws, subject to applicability thresholds, exemptions and SimplePin’s role in relation to the information. Depending on the law, eligible rights may include:

• confirming whether Personal Information is processed and accessing or obtaining a copy;
• correcting inaccuracies;
• deleting Personal Information, subject to exceptions;
• obtaining Personal Information in a portable format;
• opting out of sale, sharing, targeted advertising or certain profiling where applicable;
• limiting certain uses or disclosures of Sensitive Personal Information where applicable;
• appealing a denied privacy request where required;
• receiving equal service and not being unlawfully discriminated against for exercising privacy rights.

These rights do not apply to every person, every state or every category of information. Financial, insurance, employment, business-to-business, fraud, security, legal-compliance and other exemptions may apply. When SimplePin acts only as a processor/service provider for a Direct Customer, the Direct Customer may be responsible for responding to the request.

24. How to Submit a U.S. Privacy Request

Where applicable, you may submit a request by emailing privacy@simplepin.com or calling 1-800-727-4136. If a web privacy-request form is made available, it may also be used. We may take reasonable steps to verify identity and authority before completing a request. Verification information will be used only as permitted for that purpose.

An authorized agent may submit a request where permitted by law. SimplePin may require evidence of the agent’s authority and may request direct verification from the individual unless applicable law provides otherwise.

SimplePin will respond within the period required by applicable law and may extend the response period where legally permitted. If we deny a request in whole or in part, we will provide the explanation and appeal information required by applicable law.

25. California Privacy Notice

If the California Consumer Privacy Act, as amended (“CCPA”), applies to SimplePin with respect to your Personal Information, this section supplements the rest of this Policy. The categories of Personal Information SimplePin may collect, the sources, business/commercial purposes and categories of recipients are described in Parts IV and Schedule 1.

California residents may have rights to know/access, delete, correct, opt out of sale or sharing, limit certain uses/disclosures of Sensitive Personal Information, and receive non-discriminatory treatment, subject to statutory exceptions.

SimplePin does not use Sensitive Personal Information to infer characteristics about an individual for unrelated advertising. SimplePin does not sell payment-account information or Customer Data for money. If SimplePin uses website technologies that constitute “sharing” for cross-context behavioral advertising under the CCPA, SimplePin will provide a “Do Not Sell or Share My Personal Information” mechanism and honor Global Privacy Control as required.

SimplePin does not offer financial incentives or price/service differences in exchange for Personal Information unless a separate notice describing the material terms is provided as required by law.

PART VII — CANADIAN PRIVACY RIGHTS AND PROVINCIAL NOTICES

26. Canada — General Rights and Accountability

Where Canadian private-sector privacy law applies, SimplePin is accountable for Personal Information under its control and designates a Privacy Officer or other responsible person to oversee applicable privacy obligations. SimplePin maintains policies and practices concerning collection, use, disclosure, safeguards, access, correction, retention, service providers and complaints.

Subject to applicable exceptions, individuals may request access to Personal Information under SimplePin’s control and request correction of inaccurate or incomplete information. Individuals may also withdraw consent to optional processing where consent is the applicable legal basis, subject to reasonable notice and legal or contractual restrictions. Withdrawal may affect the availability of optional features or, where the processing is necessary to provide a requested service, the ability to provide that service.

Canadian privacy requests or complaints may be sent to privacy@simplepin.com. We may request information necessary to verify identity and locate responsive records. If SimplePin processes the information only for a Direct Customer, we may refer the request to that Direct Customer and assist as required.

27. Quebec

For individuals in Quebec, the Act respecting the protection of personal information in the private sector may provide additional rights and obligations. SimplePin will publish the title and contact information of the person responsible for the protection of Personal Information and will provide privacy information in clear terms at or before collection as required.

Depending on the circumstances and applicable law, Quebec residents may have rights of access, rectification, withdrawal of consent, cessation of dissemination or de-indexation in specified circumstances, and portability of computerized Personal Information in a structured, commonly used technological format where the statutory conditions are met.

SimplePin may communicate Personal Information outside Quebec. Where required, SimplePin will conduct a privacy impact assessment considering the sensitivity, purpose, safeguards and legal framework of the destination before such communication.

If SimplePin makes a decision based exclusively on automated processing of Personal Information and Quebec law requires notice, the affected individual will be informed of the automated nature of the decision and provided the additional information and opportunity to submit observations required by law.

28. Alberta

Where Alberta’s Personal Information Protection Act applies, eligible individuals may request access to their Personal Information under SimplePin’s control and correction of information that is inaccurate or incomplete, subject to statutory exceptions. SimplePin will protect Personal Information using safeguards reasonable in the circumstances and will provide required breach notifications where a breach creates a real risk of significant harm or as otherwise required by law.

29. British Columbia

Where British Columbia’s Personal Information Protection Act applies, eligible individuals may request access to and correction of their Personal Information, subject to statutory exceptions. SimplePin will limit collection, use and disclosure to purposes permitted by law and maintain reasonable security arrangements appropriate to the sensitivity of the information.

30. Privacy Complaints in Canada

We encourage individuals to contact SimplePin first so we can investigate and respond to privacy concerns. Depending on the applicable law and province, individuals may also have the right to complain to the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator.

PART VIII — GENERAL PROVISIONS

31. Communications and Marketing Choices

Direct Customer representatives may receive administrative, transactional, security, product and legal communications that are necessary to manage the relationship. Marketing communications will be sent as permitted by applicable law and may be unsubscribed from using the mechanism provided in the message. Transactional or legally required communications may continue after a marketing opt-out.

32. Children and Minors

The Services are intended for businesses and individuals who are legally able to authorize the applicable transaction. SimplePin’s public website and Services are not directed to children under 13 in the United States, and SimplePin does not knowingly collect Personal Information from children for independent marketing purposes. Direct Customers should not submit Personal Information about minors unless it is necessary for a lawful insurance or payment purpose and they have the legal authority to do so.

If you believe a child’s Personal Information has been submitted improperly, contact privacy@simplepin.com so the matter can be reviewed.

33. Third-Party Services and Links

The Services may contain links to or integrate with third-party sites, banks, carrier systems, agency management systems, processors or other services. Their privacy practices are governed by their own notices when they independently determine how Personal Information is processed. SimplePin is not responsible for the independent privacy practices of third parties.

34. Corporate Transactions and Legal Requirements

SimplePin may disclose or transfer Personal Information in connection with an actual or proposed financing, merger, acquisition, reorganization, sale of assets or similar transaction, subject to appropriate confidentiality and legal safeguards. Personal Information may also be disclosed where required or permitted by law, court order, subpoena, regulatory request, payment-network rule, fraud investigation or to protect rights, safety and security.

35. Changes to this Privacy Policy

SimplePin may update this Privacy Policy from time to time to reflect changes in law, technology, Services or privacy practices. The effective date will be updated when the Policy changes. Where required by law, SimplePin will provide additional notice or obtain consent before a material new collection, use or disclosure becomes effective.

For Personal Information previously collected, SimplePin will not materially expand use or disclosure in a manner that requires additional consent without taking the steps required by applicable law.

36. Contact Information

Questions, privacy requests and complaints may be directed to:

SCHEDULE 1 — U.S. / CALIFORNIA NOTICE AT COLLECTION

This Schedule is designed to support a layered Notice at Collection. It should be shortened and surfaced at or before collection on the applicable webpage, form or payment experience if the CCPA or another state law requires such notice.

Retention: as described in Section 18. Sale/sharing: SimplePin does not sell payment-account information or Customer Data for money. Website cookie-based “sharing” or targeted advertising, if any, will be disclosed through the applicable preference/opt-out mechanism.

Privacy requests: privacy@simplepin.com or 1-800-727-4136. Where SimplePin is only a service provider/processor, the request may need to be directed to the relevant Direct Customer.

SCHEDULE 2 — DATA-ROLE MATRIX