Privacy Policy

When you submit a Commercial Risk Analysis or contact us directly, we collect the information you provide: business legal name, contact details, operational description, prior policy documents (such as declaration pages), and any supporting materials you choose to share.

We also collect limited technical metadata - IP address, browser type, and basic request timing - for security, rate limiting, and abuse prevention.

Submitted information is used solely to evaluate your risk profile, prepare a preliminary review, market your account to appropriate carriers, and service any resulting policy. We do not sell your data, and we do not use it for advertising.

Carrier submissions disclose only the information underwriters require to quote. You will know which carriers receive your information.

Data is transmitted over TLS and stored in an access-controlled, role-based backend with row-level security. Uploaded documents are scoped to authorized staff. Sensitive credentials are managed as encrypted secrets, never embedded in client code.

We follow least-privilege access internally and review our security posture on an ongoing basis.

We share information only with: (a) insurance carriers and wholesale markets actively quoting your account, (b) service providers that operate our infrastructure under confidentiality obligations, and (c) regulators or counsel where required by law. We never trade or sell your data.

We retain information you submit through our Risk Analysis intake based on your relationship with us:

• If you submit an intake but do not become a client, your information (including any uploaded declaration page) is retained for up to 18 months from submission, after which it is permanently deleted from our systems.
• If you become a client, your file is retained for the duration of our relationship and for 6 years after your policy is no longer in force, consistent with insurance recordkeeping requirements in Colorado, New York, and Hawaii.
• After a client relationship ends and the required retention period has passed, records are archived and permanently deleted, including any associated documents in storage.
• We maintain an internal audit log of deletions (record identifiers and timestamps only, no personal or business content) to demonstrate compliance with this policy.

You may request earlier deletion of your information if you did not proceed with coverage through us, except where we are required to retain records by law.

You may request access to, correction of, or deletion of the personal information we hold about you, subject to legal and regulatory limits. Email contact@yisraelagency.com to make a request.

Privacy questions go to contact@yisraelagency.com.