Privacy Policy

Carriers send policy, document, commission and claims data about their insureds. Relay processes it only to validate it, route it to the agencies and systems the agency authorized, and keep proof of delivery. For this data, the carrier or agency decides what is collected; we act as their service provider under the Data Processing Addendum.

Insureds with questions about their policy data should contact their insurance agency or carrier. We’ll pass along requests we receive.

Much of the insured data Relay carries is nonpublic personal information under the Gramm-Leach-Bliley Act. We don’t use or disclose it except to provide the service, and we protect it with administrative, technical and physical safeguards, including encryption, field-level encryption of sensitive fields, access controls and audit logging.

• Account data: name, work email, password hash, two-factor settings, organization and role.
• Usage data: sign-ins, IP address, browser, actions in the console and API (for security and audit).
• Billing data for carriers, handled by Stripe. We never see card numbers.
• Contact and demo requests: what you type into those forms.
• Marketing site analytics, which are cookieless. See the Cookie Notice.

To provide and secure Relay, verify organizations, send service email, bill carriers, answer requests, and improve the product using aggregate data. We send product updates only to carrier and partner contacts, with an unsubscribe link in every message.

Only the sub-processors that help us run Relay, the destinations an agency authorizes, and authorities when the law requires it. We don’t sell or share personal information for cross-context advertising.

When an agency uploads a declarations page, the PDF is sent to our AI provider under zero-retention terms to draft the policy details, and a person reviews the result before anything is delivered. See the AI Disclosure.

Raw carrier files and policy objects are kept 13 months; commission statements 25 months; non-personal delivery records 7 years; account data for the life of the account plus 30 days. Deleting an organization revokes access immediately, destroys its encryption key and purges its rows within 30 days.

Depending on where you live you may have the right to access, correct, delete or port your personal information, and to opt out of certain processing. Use the privacy request form or email privacy@emeraldrelay.com. We honor Global Privacy Control signals. We won’t treat you differently for exercising a right.

If we confirm an incident affecting customer data, we notify affected organizations within 48 hours so they can meet their own notice duties.

Relay is a business service and isn’t directed to anyone under 18.

We’ll post changes here with a new version date, and email account owners about material changes.