Privacy Policy

This Privacy Policy explains how FilingScout LLC ("FilingScout," "we," "us," or "our") collects, uses, shares, and protects personal information when you visit filingscout.com, create an account, call our application programming interface (API), or otherwise use services made available through FilingScout (collectively, the "Service").

This Policy covers personal information about customers, website visitors, and account users. FilingScout also provides access to publicly available property and casualty (P&C) insurance filings, which may contain professional contact information as described in Section 1.

For purposes of applicable privacy laws, FilingScout is the "controller" or "business" for personal information we collect about you as a customer or visitor.

Related: Terms of Service.

1. Scope

This Policy applies to:

• the marketing website, documentation, and API explorer;
• account registration, sign-in, and the customer dashboard;
• API keys, usage metering, and billing;
• emails and other communications with support, sales, or billing; and
• information we collect automatically when you use those surfaces.

This Policy covers our handling of personal information we send to or receive from third-party providers.

This Policy does not apply to:

• the independent processing of personal information by third-party services, including Stripe Checkout and Amazon Cognito hosted sign-in, or the practices of other sites we link to, such as state insurance-department websites, which are governed by their own privacy notices; or
• information you process in your own applications after you retrieve results from the API; you are responsible for that processing.

Our regulatory database consists of publicly available insurance filings and structured regulatory information, including company names and National Association of Insurance Commissioners (NAIC) numbers. These records may contain professional contact information, such as names, business email addresses, and signatures. If you have a privacy concern about information appearing in a filing, contact support@filingscout.com. We review requests subject to applicable law and the public-record nature of the material. Nothing in this Policy limits privacy rights that apply to information in those records.

2. Information we collect

2.1 Information you provide

Account information: email address, name (if provided), and password. Passwords are handled by Amazon Cognito and are stored hashed by that service; we do not store plaintext passwords. We store a Cognito subject identifier (sub) to uniquely identify your account.

API-key metadata: key name, environment (live/test), prefix (for display), status, last-used time, and a hash of the secret using the 256-bit Secure Hash Algorithm (SHA-256). The full secret is shown once at creation and is not stored in recoverable form.

Billing contacts: email, name, and any billing address you give Stripe. Payment-card numbers, card verification codes, and bank details are collected and stored by Stripe, not by FilingScout.

Support and sales content: messages, attachments, and related metadata you send to support@filingscout.com or sales@filingscout.com.

Cancellation feedback:if you cancel through Stripe, we may receive Stripe's cancellation reason, feedback category, and optional comment.

2.2 Information collected automatically

Website logs: Internet Protocol (IP) address, user-agent, date and time, requested web address, referrer, and response status, collected by our hosting environment to operate and secure the site.

Session data: an opaque session cookie named fs_session. The browser holds a random token; we store only a keyed hash of that token, the associated user identifier, and an expiry (currently a seven-day lifetime with sliding renewal). Cognito access and refresh tokens are not persisted in our customer database.

API usage data: for each admitted request, the user identifier, API-key identifier, endpoint path, Hypertext Transfer Protocol (HTTP) method, status code, latency, timestamp, and calendar-month bucket used to enforce quotas and rate limits.

Rate-limit counters: short-lived per-key or per-user counters.

Approximate location: coarse location derived from IP address (typically country or region) for security, fraud prevention, and tax or sanctions screening.

Theme preference: light/dark/system preference stored locally in your browser by our theme library, not on our servers.

2.3 Information from service providers

Amazon Web Services (AWS), including Cognito: authentication events, email verification status, and identifiers needed to sign you in.

Stripe: customer identifier, subscription identifier, plan and interval, payment status, invoice history, and metered-usage reports. See Stripe's Privacy Policy.

Email and infrastructure vendors that host, monitor, or deliver the Service.

We do not currently use session-replay tools, advertising pixels, or third-party advertising networks on the Service. If that changes, we will update this Policy and, where required, obtain consent or honor opt-out signals.

2.4 Information we do not collect

We do not collect Social Security numbers, driver's license numbers, or government identification images in the ordinary course of the Service.

We do not collect consumer insurance-policyholder data as a product. The filings corpus concerns insurers, rates, rules, and forms.

We do not intend to collect sensitive data revealing racial or ethnic origin, religious beliefs, health, or sexual orientation. Please do not send that information to us.

3. How we use information

We use personal information to:

• provide, operate, maintain, and improve the Service, including authentication, API-key issuance, quota enforcement, and the dashboard;
• process payments, prevent failed charges, and collect tax;
• communicate about the account, security, product changes, and support;
• send product or marketing email where permitted — you may unsubscribe from marketing at any time;
• monitor security, abuse, fraud, rate-limit evasion, and violations of the Terms of Service;
• analyze aggregated usage (for example, which endpoints are called) to plan capacity and product development;
• create de-identified or aggregated statistics that no longer reasonably identify you;
• comply with law, enforce our agreements, and protect FilingScout, our users, and the public; and
• evaluate or complete a financing, merger, acquisition, or sale of assets.

Our public regulatory database is separate from customer account information. We do not sell access to your account profile as a marketing list.

3.1 Legal bases where European data protection laws apply

If data-protection law in the European Economic Area (EEA), United Kingdom (UK), or Switzerland applies, we process personal information as needed to perform our contract with you (providing the Service and billing); as needed for our legitimate interests in securing, improving, and marketing the Service in a proportionate way; to comply with legal obligations; and, where required, based on consent (for example, optional marketing).

4. How we share information

We do not sell your personal information for money. We share it only as follows:

• Service providers / processors: we use providers for infrastructure, authentication, payments, email, logging, and support. When acting as our processors, they process personal information on our behalf under contractual confidentiality and security obligations. Core providers include AWS (including Cognito, hosting, and databases) and Stripe. Some providers also process personal information as independent controllers for their own purposes, as described in Section 12 and their privacy notices.
• Affiliates that help us operate the Service, under this Policy.
• Professional advisors such as lawyers, accountants, and insurers, under confidentiality obligations.
• Legal and safety disclosures: we may disclose personal information when we believe in good faith that disclosure is required by law or valid legal process, or is necessary to protect the rights or security of FilingScout, our users, or others, or the integrity of the Service.
• Business transfers in connection with a merger, acquisition, financing, reorganization, or sale of assets. We will require the recipient to continue to protect personal information in a manner consistent with this Policy, subject to applicable law.
• With your direction— for example, if you ask us to share account details with your organization's administrator or an integration partner.

We may disclose de-identified or aggregated information that does not reasonably identify you.

5. Cookies and similar technologies

We use the following:

Strictly necessary cookies are required for the Service to function. You can block cookies in your browser; if you block fs_session, you will not be able to stay signed in. We currently do not respond to generic "Do Not Track" signals because there is no consistent industry standard. Where a U.S. state law requires us to honor a recognized opt-out preference signal such as Global Privacy Control for "sale" or targeted advertising, we will do so. We do not presently sell personal information or engage in targeted advertising as those terms are commonly defined.

6. Retention

We retain personal information only as long as needed for the purposes described in this Policy, including:

• Account records: for the life of the account and a reasonable period afterward (typically up to 24 months) for security, dispute resolution, and backup cycling, unless a longer period is required by law.
• API usage events and counters: generally for the current billing period plus up to 24 months for quota auditing, abuse investigation, and product analytics, then deleted or aggregated.
• Stripe billing records: retained by Stripe and by us as needed for tax, accounting, and chargebacks (often 7 years for financial records).
• Support correspondence: for as long as needed to resolve the request and for a reasonable archival period.
• Security logs: for a shorter operational window unless needed for an incident investigation.

When you request account deletion, we delete or de-identify personal information we are not required or permitted to retain. Hashed API keys are revoked. We may keep limited records of the deletion request itself.

7. Security

We implement administrative, technical, and physical safeguards appropriate to the nature of the information, including Transport Layer Security (TLS) in transit, hashed API keys and session tokens, HTTP-only session cookies, security headers, rate limiting, and access controls on production systems. No method of transmission or storage is completely secure. You are responsible for the security of your passwords, API keys, and devices.

If we become aware of a security incident affecting your personal information, we will notify you and regulators as required by applicable law.

8. International transfers

We are based in the United States and process information in the United States, including on AWS and Stripe infrastructure. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, which may have different data-protection rules than your country. Where required, we use appropriate transfer mechanisms (such as Standard Contractual Clauses) with processors.

9. Your rights and choices

Depending on your location and the laws that apply to FilingScout, you may have some or all of the following rights:

• request access to a copy of personal information we hold about you;
• request the correction of inaccurate personal information;
• request that FilingScout delete personal information, subject to legal exceptions (for example, billing records or security logs);
• opt out of marketing emails via the unsubscribe link or by contacting us;
• restrict or object to certain processing, where applicable;
• receive a portable copy of information you provided to us; and
• withdraw consent where processing is based on consent (withdrawal does not affect prior processing).

To exercise these rights, email support@filingscout.comand tell us which right you want to exercise. If you have an account, please contact us from the email address associated with it. You may also submit a request if you do not have an account. Where verification is required, we may request information reasonably necessary to confirm your identity. You may use an authorized agent where permitted by law; we may verify your identity and the agent's authority as required by applicable law.

These rights are subject to applicable law and exceptions. We may decline all or part of a request where permitted by law, including when we cannot reasonably verify your identity for a request that requires verification. We may also retain specific information where required or permitted for legal, security, or billing purposes.

We respond within the timeframe required by applicable law and explain any denial. You may appeal a denial by replying to our response. We will not discriminate against you for exercising applicable privacy rights.

Account users can also update profile information in Cognito / the dashboard, revoke API keys, and manage billing through the Stripe Customer Portal.

10. Additional U.S. state disclosures

Residents of California and other U.S. states with comprehensive privacy laws may have additional rights where those laws apply to FilingScout's processing. These include the applicable rights described in Section 9 and the right to information about the categories below.

10.1 Notice at collection / categories

We do not collect biometric identifiers, precise geolocation, or consumer credit-report information. We do not "sell" or "share" personal information as those terms are defined in the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), and we do not use or disclose sensitive personal information for purposes that require a right to limit under California law.

California residents may designate an authorized agent. We do not currently have a consumer "Shine the Light" (Civil Code § 1798.83) sharing program with unaffiliated third parties for their direct marketing.

11. Children

The Service is not directed to children under 18, and we do not knowingly collect personal information from children under 13 (or under 16 in jurisdictions that set that threshold). If you believe a child has provided personal information, contact us and we will delete it.

12. Third-party services

Sign-in is handled in part on Amazon Cognito domains. Paid checkout and subscription management occur on Stripe domains. This Policy covers our handling of personal information we send to or receive from those providers. They act as our processors for some activities and as independent controllers for certain processing they undertake for their own purposes, such as fraud prevention, security, and legal compliance. Their own privacy notices describe their independent processing:

• AWS Privacy Notice
• Stripe Privacy Policy

Source filing systems operated by states or the NAIC have their own terms. FilingScout is not those organizations.

13. Changes to this Policy

We may update this Policy from time to time. We will change the "Last updated" date and, for material changes that expand our use of personal information in a way that meaningfully affects you, we will provide additional notice (for example, email to the account address). The updated Policy is effective when posted unless a later date is stated.

14. Contact

Privacy questions, requests, or complaints: support@filingscout.com.

If you are in the EEA, UK, or Switzerland and we have not resolved your concern, you may lodge a complaint with your local supervisory authority. If you are a U.S. state resident, you may also contact your state attorney general.

Related: Terms of Service. Contact.