Privacy Policy

Brainfy AI Inc. ("we", "us", "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our CRM platform and related services (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

2.1 Information You Provide Directly:

• Account Information: Name, email address, phone number, agency name, address, and billing information
• Client Data: Information about your clients, including names, contact details, policy information, renewal dates, and communication history
• Policy Data: Insurance policy numbers, carriers, coverage types, premiums, expiration dates, and status
• Communication Data: Emails, messages, support tickets, and feedback you send to us or through the Service
• Financial Data: Commission information, revenue data, and payment details (processed securely through third-party payment processors)

2.2 Information Collected Automatically:

• Usage Data: Features used, pages viewed, time spent, click patterns, and interaction with the Service
• Device Information: IP address, browser type and version, device type, operating system, and unique device identifiers
• Log Data: Server logs, error reports, and diagnostic information
• Cookies: We use cookies and similar tracking technologies to track activity and store preferences

2.3 Information from Third Parties:

• Email service providers when you integrate your email
• Calendar services for appointment synchronization
• Payment processors for billing information
• Insurance carriers (when authorized by you)

We use the collected information for the following purposes:

3.1 Service Provision:

• Provide, operate, and maintain the Service
• Process transactions and manage subscriptions
• Enable core CRM functionality (contact management, policy tracking, renewals)
• Deliver scoring features (churn-risk and lead scores, calculated with fixed rules in Canada) and optional AI features (the Alex assistant and email categorization)

3.2 Communication:

• Send transactional emails (account confirmations, renewal notices, receipts)
• Provide customer support and respond to inquiries
• Send product updates, newsletters, and marketing communications (with your consent)
• Notify you of Service changes, security alerts, or policy updates

3.3 Improvement and Analytics:

• Analyze usage patterns to improve the Service
• Develop new features and functionality
• Train and improve AI models and algorithms
• Generate aggregated, anonymized analytics and insights

3.4 Security and Compliance:

• Detect, prevent, and address fraud, security issues, and technical problems
• Enforce our Terms of Service and protect our rights
• Comply with legal obligations and regulatory requirements
• Respond to law enforcement requests and legal processes

Under PIPEDA, we process your personal information based on:

• Consent: You provide consent when you create an account and use the Service
• Contractual Necessity: Processing is necessary to fulfill our contract with you (Terms of Service)
• Legitimate Interests: We have legitimate business interests in improving our Service and preventing fraud
• Legal Obligations: We may process data to comply with Canadian laws and regulations

We do NOT sell your personal information to third parties.

We may share your information in the following circumstances:

5.1 Service Providers:

• Cloud hosting providers (Canadian data centers)
• Email delivery services
• Payment processor (Stripe) for subscription billing
• Analytics providers (anonymized data only)
• Customer support tools
• AI model provider (Anthropic, United States) for the Alex assistant, AI email categorization and the website chatbot. See section 12 and our Subprocessors page
• E-signature provider (DocuSign) only for brokerages that choose to connect a DocuSign account and only for the documents a broker sends for signature: the document itself, the signer's name and email address, the signing status, and the signed copy returned to the brokerage's file. See section 12
• SMS provider (Telnyx, United States) for the Canadian number clients can text. It handles the sender's phone number, the message text and any attached media. Inbound replies only today — CovioIQ does not send SMS to clients. See our Subprocessors page

5.2 Business Transfers:

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

5.3 Legal Requirements:

• To comply with court orders, subpoenas, or legal processes
• To respond to law enforcement or government requests
• To enforce our Terms of Service and protect our rights
• To protect the safety and security of users or the public

5.4 With Your Consent:

We may share information with third parties when you explicitly authorize us to do so (e.g., insurance carrier integrations).

We implement industry-standard security measures to protect your data:

• Encryption: All data in transit is encrypted using TLS 1.3. Data at rest is encrypted using AES-256.
• Access Controls: Strict role-based access controls and multi-factor authentication
• Regular Audits: Security audits, penetration testing, and vulnerability assessments
• Data Centers: SOC 2 Type II certified Canadian data centers with physical security
• Monitoring: 24/7 security monitoring and incident response procedures
• Employee Training: Regular security awareness training for all staff

While we implement robust security measures, no system is 100% secure. We cannot guarantee absolute security but will notify you of any material breaches as required by PIPEDA.

7.1 Active Accounts: We retain your data for as long as your account is active and as needed to provide the Service.

7.2 Deleted Accounts: When you cancel your account, you have 30 days to export your data. After this period, your data will be permanently deleted within 90 days unless retention is required by law.

7.3 Legal Requirements: We may retain certain information to comply with legal obligations, resolve disputes, and enforce agreements (typically 7 years for financial records).

7.4 Anonymized Data: We may retain anonymized, aggregated data indefinitely for analytics and research purposes.

Under PIPEDA, you have the following rights:

8.1 Right to Access: Request a copy of the personal information we hold about you.

8.2 Right to Correction: Request corrections to inaccurate or incomplete information.

8.3 Right to Deletion: Request deletion of your personal information (subject to legal retention requirements).

8.4 Right to Data Portability: Export your data in a machine-readable format.

8.5 Right to Withdraw Consent: Withdraw consent for marketing communications or data processing (may limit Service functionality).

8.6 Right to Complain: Lodge a complaint with the Office of the Privacy Commissioner of Canada.

To exercise your rights, contact us at:
Email: admin@covioiq.com
We will respond within 30 days as required by PIPEDA.

We use cookies and similar technologies to:

• Essential Cookies: Required for authentication and core functionality (cannot be disabled)
• Analytics Cookies: Help us understand how you use the Service (can be disabled in Settings)
• Preference Cookies: Remember your settings and preferences
• Marketing Cookies: Track effectiveness of marketing campaigns (with your consent)

You can control cookies through your browser settings. Note that disabling certain cookies may limit functionality.

The Service may contain links to third-party websites or integrate with third-party services (e.g., email providers, insurance carriers). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child without parental consent, we will delete it immediately.

Your CRM database is stored in Canadian data centers. We transfer data outside of Canada only when necessary to provide the Service through third-party service providers, under contractual safeguards. Our current providers and where they process data are listed on our Subprocessors page.

AI features. The Alex assistant (Team and Agency plans), AI email categorization and the website chatbot use Anthropic's API, which processes requests in the United States. When a user asks Alex a question, we send the question together with that agency's client names and policy, renewal, opportunity and task details needed to answer it. We do not send email addresses, phone numbers, street addresses, dates of birth, notes or documents. AI email categorization sends the subject and body of the one email a user chooses to categorize. Information processed in the United States may be accessible to authorities there under United States law. Lead and churn-risk scores do not use an AI provider and are calculated in Canada. Details are on our AI transparency page.

E-signatures. A brokerage may connect its own DocuSign account to send client documents for signature. DocuSign then processes the document, the signer's name and email address, and the signed copy in the data centre of that DocuSign account, which for most accounts is in the United States. The DocuSign sign-in and refresh tokens are stored encrypted in our Canadian database. Nothing is sent to DocuSign until a broker sends a specific document.

The CovioIQ app for iPhone and Android is a second way to use the same account and the same brokerage data described above. It has no sign-up: an account is created on the web, and the app signs in to it. The app contains no advertising, analytics or tracking software.

13.1 Device permissions. Each permission is optional and is requested only when you use the feature:

• Camera and Photos: to photograph a document or choose one from your photo library and file it to a client. Only the file you choose is uploaded, to the brokerage's document storage in Canada. The app does not read your photo library otherwise.
• Face ID, Touch ID or the device's biometric unlock: to lock the app on that device. The check is performed by the operating system; CovioIQ never receives or stores biometric data.
• Notifications: for optional reminders about tasks assigned to you. Reminders are scheduled on the device and their text contains no client information.

13.2 Information kept on the device.

• Your sign-in session, in the operating system's secure storage, so you stay signed in. It is removed when you sign out.
• A short-lived cache of the records you viewed, so screens open quickly. It is cleared when you sign out.
• Your language and app-lock preferences.

13.3 Alex in the app. Before the first question, the app shows what is sent to Anthropic and asks for your consent, as described in section 12.

13.4 Deleting your account. From the app, choose More, then Delete account, and confirm. Deletion takes effect immediately, with the same rules as the web app: the whole brokerage account when you are its only member, otherwise your own profile and sign-in. Details are at covioiq.com/delete-account, and retention follows section 7.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service at least 30 days before the changes take effect. Your continued use of the Service after changes constitutes acceptance of the updated policy.

The "Last updated" date at the top of this page indicates when this policy was last revised.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

You also have the right to file a complaint with the Office of the Privacy Commissioner of Canada atwww.priv.gc.ca