Privacy Notice

A document you upload is processed to produce your read. The file itself is never stored — it leaves with you when your session ends. Names, addresses, and policy numbers are scrubbed before the text is sent to our AI providers.

To quote a clause back to you, and to make a repeat read of the same form faster, we keep the clause wording Poli extracted along with the structure it derived from it. Those records are filed against a content fingerprint (a one-way hash) of the document, not against you: they carry no name, email, account, or IP, and we cannot tell from them who uploaded the document. If you sign in and choose to save a read, that read is additionally linked to your account until you delete it.

Photographs you submit to PoliVision are sent to the model, used to produce the item list, and discarded when the response returns. They are never stored.

Premium comparison records, if you opt in, are stored as anonymous bands only (state, ZIP prefix, coverage bands, premium) with no name, address, or policy number, and with a delete code you control.

Agencies and brokers use PoliSays to understand their clients' policies. The agency already has its clients' permission to hold their details, so the agency account keeps what it needs to file each policy under the right client: the client's name, address, carrier, and renewal date. These are the agency's records. We hold them for the agency and use them only to run its account.

• Only your team can see them. Client records are visible only to the staff the agency invites. Other agencies, PoliSays consumers, and the public site can't see them. The account owner decides which staff see all clients.
• We don't keep the files. Each uploaded PDF is read and then discarded. We keep Poli's explanation and the policy wording it quotes.
• The AI never sees who the client is. Names, addresses, emails, phone numbers, and policy numbers are removed from the text before it goes to an AI provider.
• You control deleting. Deleting a client deletes that client's policies and notes. The agency can export its client list at any time.
• Nothing is sold or shared. We never sell agency or client data, never use it for advertising, and never contact an agency's clients.

For agency accounts, the agency decides why and how its client data is used, and PoliSays handles it on the agency's behalf. Questions or a request to delete everything: privacy@polisays.com.

• Account data (name, email, avatar from Google sign-in) — to create and secure your account and attach saved reads to you. Legal basis: performance of our contract with you.
• Documents and saved reads — to produce and re-open your explanation. Legal basis: contract performance.
• Usage and technical data (masked IP, approximate country/region, timestamps, page and feature events, model usage counts) — to enforce free-tier limits, prevent abuse, keep the service reliable, and improve accuracy. Legal basis: legitimate interests.
• Support messages — to answer you. Legal basis: legitimate interests.
• Subscription records (plan, status, renewal dates, provider identifiers) — to give you the access you paid for. Legal basis: contract performance. Credit card details never reach us; Stripe handles them.

• Hosting, database, and authentication providers that run the service on our behalf.
• AI model providers, which receive redacted document text to generate explanations. They do not receive your identity.
• Stripe Payments, our payment processor, for credit card processing, subscription billing, invoicing, and tax calculation.
• Professional advisers (legal, accounting) and authorities where required by law.

Uploaded files and photographs are discarded as soon as your read is produced. Saved reads are kept until you delete them or your account is closed, plus a short 30-day export window. The fingerprint-keyed clause records described above hold no identifier of any kind, so they are retained as anonymous reference data. Usage and abuse-prevention logs are kept in aggregated or pseudonymised form and deleted or anonymised when no longer needed. Billing records are kept as long as tax and accounting law requires.

Subject to the law where you live, you can ask us to access, correct, delete, export, or restrict the personal data we hold about you, object to processing based on legitimate interests, or withdraw consent. Email privacy@polisays.com and we will respond within one month. If you are in the UK or EEA you may also complain to your supervisory authority. Data may be processed in the United States; where required we rely on Standard Contractual Clauses or an adequacy decision.

We use appropriate technical and organisational measures, including encryption in transit, encrypted storage, row-level access controls, and redaction of identifying details before documents reach any model provider. No system is perfectly secure, but we treat your paperwork as sensitive by default.

We use essential cookies and local storage to keep you signed in, remember your session, and enforce free-tier limits. You can clear cookies in your browser, though signing in will not work without the essential ones.

Ad measurement (Google Ads). When you upload a policy or set up an agency book, we tell Google Ads that it happened, so we can see which of our ads led to it. Google receives your device and browser details, the page address, and its advertising cookie — never your policy, name, email or answers. We use this only to measure and improve our ads, not to show you personalised ads. In the EEA, UK, Switzerland and Canada this only happens if you accept in our cookie banner; elsewhere it's on by default and you can turn it off. We keep a record of your choice and when you made it. Change or withdraw your choice anytime: Cookie settings. Learn how Google uses this data: business.safety.google/privacy.

AlienSquad, LLC — privacy@polisays.com