Privacy Policy

1. Introduction

This Privacy Policy describes how Claimiflo, Inc. ("Claimiflo," "we," "us," or "our") collects, uses, shares, and protects information in connection with the Claimiflo platform (the "Service") accessible at app.claimiflo.com and the marketing website at claimiflo.com.

Claimiflo is a software-as-a-service platform that provides workflow tools for corporate unclaimed property discovery and claim management. This policy applies to all users of our Service, including Customer accounts, Authorized Users, and visitors to our website.

By using the Service or visiting our website, you agree to the collection and use of information as described in this Privacy Policy. This Privacy Policy is incorporated into and subject to our Terms of Service.

---

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Business information: Company name, address, trade names, DBAs, subsidiaries
• User information: Name, email address, job title, phone number
• Authentication credentials: Password (hashed, never stored in plaintext), multi-factor authentication settings

2.2 Subscription and Payment Information

• Plan details: Selected subscription tier and billing interval
• Payment information: Credit card and billing details are collected and processed by Stripe, our third-party payment processor. Claimiflo does not store full credit card numbers on our servers.

2.3 Customer Data

Information you provide or upload to the platform in connection with unclaimed property claims:

• Company documents: Articles of incorporation, W-9 forms, letters of authorization, and other supporting documents
• Identity documents: Driver's licenses, tax returns, and other verification documents as required by state agencies
• Personally Identifiable Information (PII): Social Security Numbers, Tax Identification Numbers, and other sensitive identifiers you choose to upload
• Correspondence: Documents and communications related to unclaimed property claims displayed within the platform
• Notes and comments: User-created notes attached to findings and claims

2.4 Findings Data

• Unclaimed property records: Information retrieved from publicly available state unclaimed property databases, including property IDs, holder names, amounts, property types, and state sources
• Claim status information: Workflow status, submission dates, and tracking data

2.5 Usage Data

We automatically collect certain information when you use the Service:

• Log data: IP address, browser type, operating system, pages visited, date and time of access
• Device information: Device type, screen resolution, and browser settings
• Feature usage: Which platform features you use and how you interact with the Service
• Session data: Login times, session duration, and activity within the platform

2.6 Website Visitor Data

When you visit claimiflo.com, we collect:

• Analytics data: Pages visited, referral source, time spent on pages (via Google Analytics)
• Contact form submissions: Name, email, company name, and message content

---

3. How We Use Your Information

3.1 Provide and Operate the Service

• Create and manage your account
• Search publicly available state unclaimed property databases on your behalf
• Display findings, correspondence, and claim workflow information
• Process subscription payments
• Provide platform tools for claim preparation and tracking

3.2 Communicate With You

• Send transactional emails (account confirmation, password reset, subscription receipts)
• Send service notifications (new findings, status changes, correspondence alerts)
• Respond to support inquiries
• Provide important service updates and security alerts

3.3 Improve the Service

• Analyze usage patterns to improve platform functionality
• Identify and fix bugs and performance issues
• Develop new features based on aggregate usage data
• Conduct internal analytics and reporting

3.4 Security and Compliance

• Detect and prevent fraud, abuse, and unauthorized access
• Monitor for security threats and vulnerabilities
• Comply with legal obligations
• Enforce our Terms of Service

---

4. How We Share Your Information

4.1 We Do Not Sell Your Data

Claimiflo does not sell, rent, or trade your personal information or Customer Data to third parties. We do not share your data with advertisers or data brokers.

4.2 Service Providers (Sub-Processors)

We share information with third-party service providers who assist in operating the Service. These providers are contractually obligated to use your information only as directed by us and in accordance with this Privacy Policy.

4.3 Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, including court orders, subpoenas, law enforcement requests, and regulatory compliance requirements.

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or substantially all of our assets, your information may be transferred as part of the transaction. We will notify you of any such change and any choices you may have regarding your information.

4.5 With Your Consent

We may share your information in other ways if you provide explicit consent.

---

5. Data Security

5.1 Encryption

• In transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher
• At rest: Sensitive data fields (including PII such as Social Security Numbers and Tax IDs) are encrypted using AES-256 encryption
• Documents: Uploaded documents are stored with server-side encryption

5.2 Access Controls

• Multi-tenant data isolation ensures your data is segregated from other customers
• Role-based access controls limit data access based on user roles
• All access to sensitive data is logged and auditable
• Sessions expire after periods of inactivity

5.3 Infrastructure Security

• HTTPS enforced across all services with HSTS headers
• Regular security updates and dependency audits
• Input validation and output sanitization to prevent common vulnerabilities
• Rate limiting on authentication and sensitive endpoints

5.4 Breach Notification

In the event of a data breach affecting your personal information, we will notify you within seventy-two (72) hours of discovery, as required by applicable law and as stated in our Terms of Service.

---

6. Data Retention

6.1 Active Accounts

We retain your information for as long as your account is active and as needed to provide the Service.

6.2 After Cancellation

• Account data (findings, documents, notes, claim history): Retained for ninety (90) days after cancellation, then permanently deleted
• Correspondence forwarding: Correspondence received from state agencies related to claims submitted prior to cancellation will continue to be forwarded as described in our Terms of Service
• Payment records: Retained as required for tax and accounting purposes (typically 7 years)
• Security logs: Retained for up to 6 years for security and compliance purposes

6.3 Deleted Data

After the retention period, your data is permanently deleted from our systems, including all backups, within thirty (30) days. Deletion is irreversible.

6.4 Legal Holds

We may retain information beyond the standard retention period if required by law, regulation, or ongoing legal proceedings.

---

7. Your Rights and Choices

7.1 Access Your Data

You can access your Customer Data at any time through the platform. You may also request a copy of your personal information by contacting us at support@claimiflo.com.

7.2 Export Your Data

You may export your data (findings, documents, claim history) at any time during your active subscription using the platform's export features.

7.3 Correct Your Data

You can update your account information and company details directly within the platform. For corrections to other data, contact us at support@claimiflo.com.

7.4 Delete Your Data

You may request deletion of your personal information by contacting us at support@claimiflo.com. Upon receiving a verified request, we will delete your data within thirty (30) days, subject to legal retention requirements, ongoing subscription obligations, and data necessary for legitimate business purposes.

7.5 Opt Out of Communications

• Marketing emails: You can unsubscribe using the link in any marketing email
• Service notifications: Essential service notifications (security alerts, billing, account changes) cannot be opted out of while your account is active

7.6 Account Deletion

You may delete your account at any time through account settings or by contacting support@claimiflo.com. Account deletion triggers the data retention process described in Section 6.2.

---

8. California Privacy Rights (CCPA/CPRA)

8.1 Your California Rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions
• Right to Correct: You may request correction of inaccurate personal information
• Right to Opt Out of Sale: We do not sell personal information, so this right does not apply
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

8.2 Categories of Information

8.3 Service Provider Status

For purposes of the CCPA/CPRA, Claimiflo acts as a "Service Provider." We process Customer Data only for the specific business purposes described in our Terms and this Privacy Policy. We do not sell or share (as defined by the CPRA) personal information.

8.4 Exercising Your Rights

To exercise your California privacy rights, contact us at support@claimiflo.com. We will respond to verified requests within 45 days. We may need to verify your identity before processing your request.

---

9. Cookies and Tracking Technologies

9.1 Cookies We Use

9.2 Google Analytics

We use Google Analytics (GA4) on our marketing website (claimiflo.com) to understand how visitors find and use our site. Google Analytics collects anonymized data including pages visited, referral source, browser type, and geographic region (not precise location).

You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

9.3 No Third-Party Advertising

We do not use advertising cookies, retargeting pixels, or third-party tracking for advertising purposes.

---

10. Children's Privacy

The Service is intended for use by business entities and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

---

11. International Data

The Service is hosted in the United States and intended for use by businesses operating in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.

---

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will provide at least thirty (30) days' notice of material changes via email to your account's registered email address and/or through an in-app notification. Continued use of the Service after the effective date of an updated policy constitutes acceptance of the changes.

The "Last Updated" date at the top of this policy indicates when it was most recently revised.

---

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

If you have questions about this Privacy Policy, please contact us at support@claimiflo.com before subscribing.