--- title: "Privacy Policy | CopyCat AI" description: "How CopyCat Technologies, Inc. collects, uses, and protects your information when you use our AI-powered automation platform." url: https://www.runcopycat.com/privacy source: https://www.runcopycat.com --- # Privacy Policy Updated August 2026 ## 1\. Introduction CopyCat Technologies, Inc. ("CopyCat AI," "we," "our," or "us") provides an AI workspace for commercial insurance brokers, including proposal generation, quote comparison, benefits market summaries, document management, and coverage comparison. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our websites, request a demo, communicate with us, or use our platform and related services (collectively, the "Services"). This policy is a notice about our privacy practices. Our agreements with business customers may include additional terms governing Customer Data; if those terms conflict with this policy, the customer agreement controls for that Customer Data. ## 2\. Information We Collect ### Information You or Your Organization Provide - Contact and account information, such as your name, work email address, phone number, role, and authentication or single sign-on identifiers - Organization information, such as agency name, address, agency size, annual revenue range, and lines of business written - Demo requests, appointment details, survey responses, support requests, feedback, and other communications - API keys, portal credentials, and workflow configuration that you choose to store in the Services - Proposal templates, brand assets (logo, color palette, fonts), and template configuration - Carrier quote PDFs, policy documents, supplemental documents, loss runs, statements of value, and other files you upload - Prompts, instructions, comments, proposal edits, generated outputs, and version history ### Information Collected Automatically - Device, operating system, and browser information - IP address and approximate location derived from it - Pages viewed, referring URLs, advertising and campaign identifiers, clicks, navigation, and interactions with forms and product features - Proposal generation logs, extraction telemetry, audit events, error reports, and performance metrics - Cookies, pixels, local storage, session storage, session replay, and similar technologies ### Information from Other Sources We may receive information from your organization's account administrators, identity and authentication providers, integrations you connect to the Services, scheduling providers, analytics and advertising partners, and publicly available or commercially available business sources. For example, we may receive an advertising click identifier or campaign information when you arrive through an advertisement. ### Customer Data When generating proposals, comparing carrier quotes, preparing benefits market summaries, or running coverage comparison on your behalf, we process the documents, files, prompts, and related information you upload or create ("Customer Data"). Our business customer controls this data, and CopyCat AI processes it to provide the Services and as otherwise permitted by our agreement with that customer. Customer Data is not used to train, fine-tune, or improve generative AI or foundation models. ## 3\. How We Use Your Information - To provide, operate, and maintain the Services - To execute automations and process workflows on your behalf - To authenticate users and administer accounts, permissions, integrations, and subscriptions - To communicate with you about your account, support requests, and service updates - To respond to demo and sample requests and send sales or marketing communications, subject to your communication preferences - To improve, optimize, and develop new features for our platform - To monitor and analyze usage patterns, troubleshoot errors, replay sessions for diagnostics, and measure performance - To measure advertising campaigns and show or evaluate relevant advertising - To detect, prevent, and address security issues and fraud - To comply with legal obligations Where applicable law requires a legal basis, we process personal information to perform a contract, pursue our legitimate interests in operating and improving the Services, comply with legal obligations, or based on consent. You can unsubscribe from marketing emails using the link in the message and can ask us to stop other marketing communications at any time. ## 4\. Data Security We implement industry-standard technical and organizational measures to protect your information, including: - Encryption of data in transit (TLS) and at rest (AES-256) - Role-based access controls and multi-factor authentication - Audit logging and continuous monitoring - Regular security assessments and penetration testing - Encrypted credential vaults for stored portal access credentials - Security practices that follow SOC 2 guidelines We review third-party integrations and service providers through our vendor risk-management process and require appropriate security and confidentiality measures based on the nature of the service and data involved. Learn more about our security program, controls, and available reports at our [Trust Center](https://trust.runcopycat.com). No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security. ## 5\. Data Sharing and Disclosure We do not sell Customer Data or personal information for money. We may disclose information to: - **Service providers and subprocessors** that support hosting, data storage, authentication, AI-assisted document processing, document rendering, analytics, session replay, error monitoring, communications, email delivery, scheduling, customer relationship management, and support - **Third-party integrations** that you or your organization choose to connect or direct us to use - **Analytics and advertising partners** that receive website activity, device or browser identifiers, advertising identifiers, and conversion events through technologies such as the PostHog analytics service and Meta Pixel - **Professional advisors** (lawyers, accountants, auditors) as needed for business operations - **Government authorities and other parties** when required by law or when reasonably necessary to protect rights, safety, security, and the integrity of the Services - **Business transfers** in connection with a merger, acquisition, or sale of assets, with notice to affected users Although we do not sell personal information for money, disclosure to advertising partners may be considered a "sale," "sharing," or use for targeted advertising under some privacy laws. Where those laws apply, you may request to opt out by contacting us at the address below. Customer Data is shared with service providers only as needed to provide the Services or as directed by the customer, and not for third-party advertising. ## 6\. Data Retention We retain information for as long as reasonably necessary to provide the Services, maintain security and business records, comply with legal obligations, resolve disputes, and enforce agreements. Account information, Customer Data, and execution records are generally retained for the duration of the customer relationship. Upon termination, Customer Data is deleted within thirty (30) days unless a different period is set out in an agreement or retention is required by law. Limited copies may remain temporarily in protected backups until overwritten in the ordinary course. Marketing and sales records are retained while relevant to our business relationship or until you opt out, subject to legal and recordkeeping requirements. ## 7\. Your Rights Depending on your location, you may have the right to: - Access the personal information we hold about you - Correct inaccurate or incomplete information - Request deletion of your information - Restrict or object to certain processing activities - Request portability of your data in a structured format - Withdraw consent where processing is based on consent - Opt out of targeted advertising or the sale or sharing of personal information, where applicable - Appeal a decision we make about a privacy request, where applicable To exercise a right, contact us at the address below. We may need to verify your identity and authority to make the request. We will respond within the time required by applicable law and will not discriminate against you for exercising a privacy right. If we process information on behalf of your organization, we may direct your request to that organization. ## 8\. Privacy and Security Program ### SOC 2 CopyCat AI follows SOC 2 guidelines for security, availability, and confidentiality. Learn more about our security practices at our [Trust Center](https://trust.runcopycat.com). ### Data Protection Regulations We handle personal information in accordance with privacy and data protection laws that apply to us. The rights and obligations described in this policy apply only where required by applicable law. ## 9\. Cookies and Tracking We use cookies and similar technologies to authenticate users, remember settings, maintain security, analyze use of the Services, diagnose problems, record sessions, measure campaigns, and support advertising. PostHog may collect page views, clicks, navigation, feature usage, and session recordings, which may include information entered into website forms. Meta Pixel may collect page visits, browser or device identifiers, advertising identifiers, and conversion events. Our authenticated product also uses Sentry to collect error, diagnostic, and related user or device information. You can limit cookies and similar technologies through browser settings, privacy extensions, or device controls, although doing so may affect functionality. Because there is not a uniform industry standard for browser "Do Not Track" signals, the Services do not currently respond automatically to them. You may contact us about an applicable opt-out right using the information below. ## 10\. International Data Transfers CopyCat AI and our service providers may process information in the United States and other countries where we or they operate. Those countries may have data protection laws that differ from the laws where you live. Where required, we use appropriate contractual or other safeguards for international transfers. ## 11\. Children's Privacy The Services are intended for businesses and are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can take appropriate action. ## 12\. Third-Party Links The Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any information. ## 13\. Changes to This Policy We may update this Privacy Policy from time to time. We will post the updated policy on this page and revise the "Updated" date. If required by law or contract, we will provide additional notice of material changes. ## 14\. Contact Us If you have questions about this Privacy Policy or our data practices, please contact us at: **Email:** hello@runcopycat.com **Website:** [runcopycat.com](https://runcopycat.com)