Privacy Policy

SAYC ("the platform") is a private, access-restricted operations platform built for insurance agents and other personnel who have been specifically authorized to support insurance operations. It is not a public consumer product, a general-purpose CRM open to the public, or a marketing website, and it is not available for public sign-up. SAYC is operated by its individual owner; it is not a company or other separate legal entity.

This Privacy Policy explains what information the platform processes, how it is used, how the platform's calling and text-messaging integration and its companion Chrome extensions ("SAYC — Aloware Companion" and "SAYC — Carrier Workspace") handle data, and — as its own, separate section below — how the platform uses Google APIs and Google user data. The Chrome extensions will be distributed as Unlisted items in the Chrome Web Store: anyone with the listing link can install them, but using them with SAYC requires authorized access to the platform.

Depending on the specific insurance workflow involved, records processed by the platform may include:

• Contact and client information (e.g., names, phone numbers, email addresses)
• Insurance application and policy-related information
• Beneficiary information, where applicable
• Identity/document information required for certain insurance workflows (e.g., government ID information)
• Banking or payment-related information, where required to support commission or policy administration
• Health or intake information, where required for certain insurance products
• Insurance-agent professional information, including licensing and carrier identifiers where applicable
• Operational CRM information (e.g., pipeline stage, tasks, scheduling)
• Communications, activity, and follow-up information related to client interactions
• Text messages (SMS/MMS) and their history, attachments, and delivery status
• Call information (phone numbers, call status, identifiers, and timing) and call recordings
• Files uploaded by authorized users or submitted by clients

Not every record in the platform contains every category above — the categories actually stored for a given client, lead, or agent depend on the specific insurance workflow involved.

Information is processed only to support authorized insurance operations, including:

• Client and lead management
• Insurance application and policy workflows
• Follow-up and retention activities
• Agent-to-client communications, including placing and tracking calls and text messages
• Document management and archival
• Automated extraction of information from documents and images that users upload
• Scheduling and appointment coordination
• General operational administration of the platform

Information is not processed for advertising, public content, or purposes unrelated to these operations, and it is not used to determine creditworthiness or for lending purposes.

Access to the platform requires an individual, authenticated account and is limited to authorized insurance agents and other personnel who have been specifically authorized to support insurance operations. The platform enforces role-based access controls, and certain categories of sensitive information (such as government ID, banking, and health information) are further restricted.

Being granted an account on the platform does not, by itself, grant legal authority over any specific client's information. Each authorized user is responsible for accessing and processing client information only when they have appropriate authorization and a legitimate business purpose for doing so.

Authorized users place calls and send and receive text messages through Aloware, a third-party calling and messaging provider in which each user has their own account. To do so, the platform exchanges contact names and phone numbers, message content and attachments, message history and delivery status, and call status and identifiers with the user's Aloware account. Aloware processes this information under its own terms and privacy policy.

Message text is shown to the user but is not stored in the platform's activity records, which keep identifiers, direction, timing, and status. The text of bulk messages composed by a user is stored with that bulk send. When a call recording is archived, the platform retrieves it from Aloware and stores it in the client's Google Drive folder; the platform's database keeps only a reference to the archived file, not the recording itself or its download link.

Authorized users are responsible for using the calling, recording, and messaging features in accordance with applicable law, including obtaining any consent or permission required before recording a call or sending a text message.

SAYC — Aloware Companion runs only on the Aloware web app (talk.aloware.io) in the user's own browser. Using the user's existing Aloware session, it places and controls calls, sends and reads text messages, reports call status, and retrieves call recordings for the platform. It handles contact names, phone numbers, message content and history, call information, and recording links, and passes them only between the Aloware web app and the platform. It does not read Aloware passwords, cookies, or session tokens, and does not access any other website. It uses sessionStorage in the Aloware tab for temporary operational information, including dial-attempt identifiers and timestamps used to prevent duplicate calls. This information survives reloads of the same tab; the attempt ledger does not store message bodies or credentials.

SAYC — Carrier Workspace receives HTTPS destination links selected in SAYC AgentApp and opens them in a dedicated Chrome workspace window. These links may include a contact’s phone number or email address. Opening a link sends its included information to the selected destination service, such as Gmail or WhatsApp, under that service’s privacy policy. The extension temporarily stores workspace window IDs, tab IDs, and destination keys, which may include phone numbers or email addresses, in chrome.storage.session to reuse workspace tabs. This state is cleared when the browser restarts. It uses tab-creation and navigation-target relationships to keep related tabs together, but does not read page content, message bodies, credentials, or the browser’s history database. It does not send this workspace state to a SAYC server or use it for advertising or analytics.

Both extensions accept requests only from the platform's own website, and all logic ships inside the extension. The use of information received through the extensions adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements: it is used only to provide the features described here, is not sold, and is not used for advertising.

The platform integrates with a small number of Google services, through one dedicated Google account connected specifically for this purpose, to support day-to-day insurance operations. This section describes that integration separately from the client/CRM information described above, because it involves data obtained through Google APIs.

Google Drive. The platform uses Google Drive to store and organize documents related to client files and insurance operations, including archiving supported call recordings and client-submitted documents. Because of how the platform's Google Drive connection was originally set up — to preserve continuity with a pre-existing set of document folders — its Google Drive access is broader than a single-app, files-only connection. This access is used only for the document-management and archival purposes described here; new files created by the platform are organized under a dedicated root folder rather than scattered across the connected account.

Gmail. The platform uses Gmail, through the same dedicated Google account, to send operational emails on behalf of authorized users — for example, appointment confirmations, scheduled reminders, and agent-composed messages to clients. The platform can also read that dedicated account's own email drafts, solely so an authorized user can explicitly import an existing draft as a reusable message template inside the platform. The platform does not generally read, search, or ingest the connected account's inbox or received mail — only that account's own drafts, and only when a user explicitly initiates an import.

Google Calendar. The platform uses Google Calendar, through the same dedicated Google account, to create, update, and delete calendar events that represent scheduled client appointments — for example, when an appointment is booked, rescheduled, or cancelled inside the platform. These calendar events are an operational representation of scheduling activity recorded in the platform; the platform's own records remain the authoritative source for appointment status.

Consistent with the purposes described above, information obtained through Google APIs is used only to provide the features described in this section and is not used for advertising.

Google API credentials (the OAuth client secret and refresh/access tokens used to connect to Drive, Gmail, and Calendar) are stored and used only on the platform's servers and are not exposed to the browser or to individual users. Access tokens obtained from Google are short-lived and held only in server memory while in use; they are not written to the platform's database.

Files stored in Google Drive are not duplicated into the platform's primary database — the database stores only identifiers and metadata needed to reference them. When a document is uploaded for archival to Google Drive, it is held briefly in a private, access-controlled temporary storage location and is deleted, on a best-effort basis, once the archival step completes.

One exception: when an authorized user explicitly imports a Gmail draft as a message template (described above), the text of that draft's subject and body is copied into the platform's database as a reusable template. This is a deliberate, user-initiated action, not an automatic or ongoing sync of Gmail content.

The platform does not sell personal information or share it for advertising. Information may be transmitted to the service providers and integrations described in this Policy, to the extent necessary to operate the platform's features: Supabase (database, authentication, and file storage), Vercel (application hosting), the Google services described above, Aloware (calls and text messages), Google Gemini (automated extraction of information from documents and images that users upload, and drafting of presentation text), Todoist (task management; task text can include a client's name), and Lovable's connector service (transitional access to Google Sheets).

Information is not shared with other parties except where required by law. Authorized users remain responsible for using the platform's own communication and document-sharing features appropriately and only for legitimate business purposes.

The platform does not apply an automatic, time-based deletion schedule. Operational records — including client, lead, policy, and activity records and the call and text-message information described above — are kept until they are removed through an administrative process. Call recordings and documents archived to Google Drive are kept until they are removed from Google Drive. Temporary document uploads used to transfer files into Google Drive are deleted shortly after processing, on a best-effort basis. The Chrome extensions keep no data beyond the current browser session.

The platform does not offer self-service deletion. Removing a record from one part of the platform does not automatically remove every related copy — for example, a document already archived to Google Drive, an email already sent, or information held by Aloware or another provider under its own terms. Requests to access or delete information can be made as described in the Contact section below.

The platform requires individual authenticated accounts and enforces role-based access controls, so access to operational functions and sensitive data categories depends on a user's assigned role. Particularly sensitive client information (such as government ID, banking, and health-related information) is stored separately from routine list views, so it is not returned by default bulk queries. Google API credentials are handled only on the platform's servers and are not exposed to end users' browsers. Data is transmitted over HTTPS, and the Chrome extensions accept requests only from the platform's own website.

These measures reduce risk but do not guarantee absolute security. This Policy does not claim compliance with any specific regulatory framework or security certification (for example, HIPAA, SOC 2, or GDPR) unless separately and explicitly stated in writing.

Questions about this Privacy Policy, and requests to access, correct, or delete information described here, can be sent to: estebanf0609@gmail.com. Each request is reviewed individually. Some information may need to be kept — for example, to meet legal, regulatory, or insurance record-keeping obligations — and information held by third-party providers may be subject to their own processes.