Privacy Policy — BindVox

BindVox ("BindVox," "we," "us") builds software that helps a licensed insurance producer capture a client conversation, turn it into a structured application, and prepare quotes across carriers — with the licensed human on the call and in control the whole time. This policy explains what personal information the service handles, why, who processes it, and the choices you have. It is written to match how the product actually works.

Two roles, because there are two kinds of data

BindVox serves insurance agencies and their producers. That creates two distinct relationships:

For your agency's and your own account data — the information that identifies you as a BindVox user — we act as the business (controller) and this policy governs it directly.
For applicant and client information — the personal details of the people your agency is quoting — we act as a service provider (processor) on your agency's behalf, under our agreement with the agency. Your agency decides what is collected and why; we handle it only to provide the service and only as instructed. A consumer wanting to exercise rights over that information should contact the agency that serves them; we will support the agency in responding.

What we collect

Account & agency data: name, work email, agency and branch, role, and authentication data (a hashed password, and a multi-factor secret if you enable MFA).
Applicant & client data that a producer enters or that is captured from a client conversation: names, addresses, dates of birth, contact details, and the property, vehicle, and coverage facts needed to prepare a quote.
Call audio and transcripts, when a producer chooses to capture a conversation. Capture never begins without an affirmative, recorded consent step — see "Consent to record" below.
Carrier and portal credentials a producer or agency chooses to store so BindVox can act on their behalf. These are encrypted at rest and are write-only through our interfaces — once saved, they are never displayed back.
Usage and product analytics: activity metadata such as which steps were completed and how long a portal fill took. Aggregated productivity metrics are built from this metadata only — never from the content of a client's call.

How we use it

To provide the service: transcribe a captured conversation, extract a structured application, surface suggested answers with the producer's own reasoning attached, and prepare quotes for a licensed human to review and submit.
To operate securely: authentication, fraud and abuse prevention, and audit logging of sensitive actions.
To improve the product. Here we follow a strict boundary built into the software: the structure of a carrier's forms (field names, labels, step order) may inform the shared platform, but the values a producer or client entered stay within that agency's tenant, are used only transiently, and are purged when a form template is published. Shared, published templates carry no client values by construction.

We do not use applicant call content to train shared models in a way that would expose one agency's client information to another.

The AI never acts alone

BindVox is an assistant, not an autonomous agent. It can fill a carrier's form fields for the producer, but it never speaks to your client, never binds coverage, and never rates or submits an application on its own — the product stops before those actions and a licensed human performs them. Suggested answers always show the reason behind them so the producer can verify.

Consent to record

Recording a conversation requires an affirmative consent step that BindVox records as an event — including the method, who attested, and when. On calls BindVox bridges, a spoken disclosure is delivered to the parties before capture begins. Recording-consent laws differ by state and situation; the producer is responsible for ensuring every required party is disclosed to and consents under the law that applies to their call. BindVox provides the tooling and the record; it does not provide legal advice on your obligations.

Who we share it with

Service providers (subprocessors) that operate parts of the service under contract and may process data only to perform it, not for their own purposes. Today these include our cloud host (Amazon Web Services); our speech-to-text providers (Deepgram and/or AssemblyAI, depending on configuration); our language-model provider for extraction (Anthropic); and, for telephony features, Twilio. Where a provider offers it, we opt out of using your data to train their models (for example, Deepgram requests are sent with model-improvement opt-out enabled). We keep a current list of subprocessors available on request.
Carriers and rating platforms when a producer submits a quote or application through the product — this is the point of the tool, and it happens on a licensed human's action.
Legal and safety: when required by law, or to protect rights, safety, and the integrity of the service.
A successor in a merger or acquisition, subject to this policy.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Security

We protect data with encryption in transit (TLS), scoped access controls, tenant isolation so one agency's client data is walled off from another's, hashed credentials, optional multi-factor authentication, and logging of sensitive actions. Our production deployment adds encryption at rest and managed key storage. BindVox personnel may access data only as needed to operate, support, and secure the service. No system is perfectly secure, but protecting this information is core to the product's design.

Retention & deletion

We keep information for as long as needed to provide the service and meet legal and recordkeeping obligations, then delete or de-identify it. Applicant data and captured audio are retained per the agency's configuration and our agreement with the agency. An agency may request export or deletion of its data. Specific retention windows and backup-deletion schedules are set as part of our production data-lifecycle program and in the agency agreement.

Your rights

Depending on where you live — and, for California residents, under the CCPA/CPRA — you may have the right to access, correct, delete, or obtain a copy of your personal information, and to be free from discrimination for exercising these rights. Because we do not sell or share personal information for advertising, there is no such activity to opt out of. To exercise rights over account data, contact us below. To exercise rights over applicant data held on an agency's behalf, contact the agency; we will assist them in responding.

Children

BindVox is a tool for licensed professionals and is not directed to children. We do not knowingly collect personal information from children.

Changes

We may update this policy as the product evolves. We will post the new version here with a new "last updated" date and, for material changes, provide additional notice.

Contact

Questions or requests: privacy@bindvox.com.