Privacy Policy

1. Information We Collect

We collect various types of information to provide, maintain, and improve our services.

1.1 Information You Provide Directly

• Account Information: Name, email address, phone number, password (encrypted), business name
• Professional Credentials: Appraiser license numbers, license states, certification levels, license expiration dates
• Profile Information: Professional experience, service coverage areas, specializations, years of experience, educational background
• Contact Information: Mailing address, business address, phone numbers, fax numbers, email addresses
• Financial Information: Payment method details (processed and stored by Stripe), billing address, tax information
• Professional Documents: E&O insurance certificates, sample appraisal reports, professional licenses, certifications, resumes
• Company Notes: Personal notes and credentials you store for AMC companies (usernames, passwords, registration dates)
• Outreach Emails: Customized email templates, outreach campaign data, communication preferences

1.2 Automatically Collected Information

• Device Information: IP address, browser type and version, operating system, device identifiers, screen resolution
• Usage Data: Pages viewed, features used, time spent on pages, click patterns, navigation paths, session duration
• Location Data: Approximate geographic location based on IP address (city/state level)
• Authentication Data: Login timestamps, device fingerprints, geolocation at login, two-factor authentication codes (hashed)
• Cookies and Tracking: Session cookies, preference cookies, analytics cookies (see Section 9)
• Performance Data: Error logs, crash reports, API response times, feature usage metrics

1.3 Chrome Extension Data Collection

Our Chrome browser extension collects and uses the following data:

• Profile Data Access: Retrieves your stored profile information from our servers to enable autofill functionality
• Field Interaction Data: Records which form fields you fill out manually to improve autofill accuracy (field names, field types, domain names)
• Domain Information: Tracks which AMC websites you visit to enable domain-based quota reuse and autofill optimization
• Authentication Tokens: Stores JWT tokens locally to authenticate API requests
• Usage Quotas: Tracks autofill operations to enforce subscription limits

Chrome Web Store Limited Use Disclosure: The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. We do not sell user data, use it for personalized advertising, or transfer it to data brokers.

1.4 Information from Third-Party Sources

• Payment Processors: Transaction confirmations, payment status, fraud detection signals from Stripe
• Email Service: Email delivery status, bounce reports, spam complaints from SendGrid
• Public Databases: Professional license verification data from state regulatory authorities (when applicable)

1.5 AI Chatbot Conversation Data

• Chat Messages: Text of your questions and the AI Assistant's responses
• Conversation Context: Conversation history, session identifiers, timestamps
• Escalation Requests: Flags for human support escalation, support ticket creation

2. How We Use Your Information

We use collected information for the following purposes:

2.1 Service Provision and Improvement

• Create and manage your account
• Facilitate connections between appraisers and AMC companies
• Provide Chrome extension autofill functionality
• Enable AI-powered chatbot support
• Store and manage professional documents securely
• Generate and send AMC outreach emails on your behalf
• Track subscription quotas and enforce usage limits
• Improve Platform performance, features, and user experience

2.2 Communication and Support

• Send transactional emails (account verification, password resets, subscription confirmations)
• Provide customer support and respond to inquiries
• Send service announcements and important platform updates
• Notify you of changes to our Terms of Service or Privacy Policy
• Deliver marketing communications (with your consent, opt-out available)

2.3 Payment Processing and Billing

• Process subscription payments through Stripe
• Manage billing cycles, renewals, and cancellations
• Track quota usage and apply subscription benefits
• Generate invoices and payment receipts
• Detect and prevent payment fraud

2.4 Security and Fraud Prevention

• Authenticate user identity with two-factor authentication (2FA)
• Monitor for suspicious activity, unauthorized access, and security threats
• Detect and prevent fraud, abuse, and policy violations
• Maintain audit logs for security investigations
• Protect against malicious software and attacks

2.5 Analytics and Research

• Analyze usage patterns and feature adoption rates
• Conduct internal research to improve AI chatbot responses
• Generate aggregated, anonymized statistics for business planning
• Test new features and conduct A/B testing

2.6 Legal Compliance

• Comply with applicable laws, regulations, and legal processes
• Respond to lawful requests from government authorities
• Enforce our Terms of Service and protect our legal rights
• Resolve disputes and investigate policy violations

3. How We Share Your Information

We share your information only in the following circumstances:

3.1 With AMC Companies (Your Selection)

When you use the Platform to register with AMC companies or send outreach emails, we share the information you authorize with the selected AMCs, including your professional credentials, contact details, and uploaded documents.

3.2 With Service Providers and Sub-Processors

We engage third-party service providers to perform functions on our behalf. These providers have access to your information only to perform specific tasks and are obligated to protect your data:

• Neon (PostgreSQL Database): Data storage and database management
• Stripe: Payment processing, subscription management, fraud detection
• OpenAI: AI chatbot functionality (GPT-4o model), conversation processing
• SendGrid: Transactional email delivery, outreach email sending
• Replit: Application hosting and infrastructure services
• Clearbit, Google, DuckDuckGo: Company logo retrieval services

A complete list of sub-processors is available upon request.

3.3 For Legal and Safety Reasons

We may disclose your information when required by law or to protect our rights:

• Comply with court orders, subpoenas, or legal processes
• Respond to lawful requests from government authorities
• Enforce our Terms of Service and investigate violations
• Protect the safety, rights, or property of AMC-Connect, our users, or the public
• Detect, prevent, or address fraud, security, or technical issues

3.4 Business Transfers

If AMC-Connect is involved in a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on the Platform of any change in ownership or use of your personal information.

3.5 With Your Consent

We may share your information for purposes not described in this Privacy Policy with your explicit consent.

3.6 Aggregated and Anonymized Data

We may share aggregated, de-identified, or anonymized data that cannot reasonably be used to identify you for research, marketing, or analytics purposes.

We Do Not Sell Your Personal Information. We have never sold personal information and have no plans to do so.

4. Data Security and Protection

We implement industry-standard security measures to protect your information from unauthorized access, alteration, disclosure, or destruction:

• Encryption: Data encrypted in transit using TLS/SSL and at rest using AES-256 encryption
• Access Controls: Role-based access controls limiting employee access to user data on a need-to-know basis
• Authentication: Two-factor authentication (2FA) via email OTP for account security
• Password Security: Passwords hashed using bcrypt with industry-standard salt rounds
• Session Management: Secure JWT tokens with expiration, device tracking, and geolocation verification
• Infrastructure Security: Hosting on secure, SOC 2 compliant infrastructure (Replit, Neon)
• Regular Audits: Periodic security assessments, vulnerability scanning, and penetration testing
• Monitoring: Real-time monitoring for suspicious activity, failed login attempts, and security anomalies

Data Breach Notification: In the event of a data breach affecting your personal information, we will notify you and relevant authorities within 72 hours as required by GDPR and applicable state laws.

While we strive to protect your information, no security system is impenetrable. You are responsible for maintaining the confidentiality of your account credentials and should notify us immediately of any unauthorized access.

5. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

5.1 Retention Periods by Data Type

• Active Accounts: Data retained while your account is active and for 90 days after account deletion
• Transaction Records: Payment and billing data retained for 7 years for tax and accounting purposes
• Security Logs: Authentication logs, IP addresses, and security events retained for 2 years
• Communication Records: Customer support emails and chatbot conversations retained for 3 years
• Marketing Data: Email marketing lists purged within 30 days of unsubscribe request
• Legal Holds: Data subject to legal holds retained until the hold is lifted

5.2 Account Deletion

When you delete your account, we will:

• Immediately revoke access to your account and Platform features
• Remove your profile information and personal data within 90 days
• Retain transaction records and billing data as required by law
• Preserve anonymized, aggregated usage data for analytics

6. Your Privacy Rights

Depending on your location, you may have specific privacy rights under applicable data protection laws.

6.1 General Rights (All Users)

• Access: Request a copy of your personal information we hold
• Correction: Update or correct inaccurate or incomplete information
• Deletion: Request deletion of your account and personal data (subject to legal retention requirements)
• Opt-Out: Unsubscribe from marketing emails via the "Unsubscribe" link in emails
• Data Portability: Receive your data in a structured, machine-readable format

6.2 Rights for EU/EEA Users (GDPR)

If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR):

• Right to Access: Obtain confirmation of whether we process your data and receive a copy
• Right to Rectification: Correct inaccurate or incomplete personal data
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data under certain circumstances
• Right to Restrict Processing: Limit how we use your data in specific situations
• Right to Data Portability: Receive your data in a portable format and transfer it to another service
• Right to Object: Object to processing based on legitimate interests or direct marketing
• Right to Withdraw Consent: Withdraw consent at any time for consent-based processing
• Right to Lodge a Complaint: File a complaint with your local data protection authority

Legal Basis for Processing (GDPR): We process your data based on:

• Contractual Necessity: To provide services under our Terms of Service
• Consent: For marketing communications and optional features
• Legitimate Interests: For fraud prevention, security, and service improvement
• Legal Obligations: To comply with applicable laws and regulations

6.3 Rights for California Residents (CCPA/CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of categories and specific pieces of personal information collected, sources, purposes, and third parties we share with
• Right to Delete: Request deletion of your personal information (subject to legal exceptions)
• Right to Opt-Out: Opt-out of "sale" or "sharing" of personal information (we do not sell data)
• Right to Correct: Request correction of inaccurate personal information
• Right to Limit Use: Limit use and disclosure of sensitive personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights

California "Do Not Sell My Personal Information" Disclosure: We do not sell personal information as defined by CCPA. We do not share personal information for cross-context behavioral advertising.

6.4 Rights for Other U.S. State Residents

Residents of Colorado, Virginia, Connecticut, Utah, and other states with comprehensive privacy laws have similar rights to those described for California residents. Please contact us to exercise your rights.

6.5 How to Exercise Your Rights

To exercise any of these rights, contact us at:

• Email: [email protected] with "Privacy Request" in the subject line
• Phone: 1-408-256-0154 (7AM-4PM PST, Monday-Friday)

We will respond to your request within 30 days (45 days for CCPA requests). We may request identity verification to process your request.

7. International Data Transfers

AMC-Connect operates in the United States. If you access our Platform from outside the U.S., your information will be transferred to, stored, and processed in the United States, which may have different data protection laws than your country.

For EU/EEA Users: We rely on Standard Contractual Clauses (SCCs) approved by the European Commission for international data transfers. By using our Platform, you consent to the transfer of your information to the United States and other countries where our service providers operate.

Data Storage Locations:

• Primary database: United States (Neon PostgreSQL)
• Application hosting: United States (Replit)
• Payment processing: United States (Stripe)
• Email delivery: United States (SendGrid)

8. Children's Privacy

AMC-Connect is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected information from a child under 18, we will take steps to delete that information promptly.

If you believe a child under 18 has provided us with personal information, please contact us at [email protected].

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience, analyze usage, and improve our services.

9.1 Types of Cookies We Use

• Essential Cookies: Required for authentication, session management, and core Platform functionality (cannot be disabled)
• Preference Cookies: Remember your settings, language preferences, and customization choices
• Analytics Cookies: Track usage patterns, feature adoption, and performance metrics to improve the Platform
• Security Cookies: Detect fraud, prevent abuse, and enhance account security

9.2 Third-Party Cookies

We do not use third-party advertising or marketing cookies. Our third-party service providers (Stripe, OpenAI) may set their own cookies for service delivery and fraud prevention.

9.3 Managing Cookies

You can control cookies through your browser settings:

• Block all cookies (may impair Platform functionality)
• Delete existing cookies stored on your device
• Set preferences for specific websites
• Receive notifications before cookies are placed

Consult your browser's help documentation for specific instructions.

9.4 Do Not Track Signals

Our Platform does not currently respond to "Do Not Track" (DNT) browser signals or similar mechanisms. We honor opt-out preferences communicated through your account settings or direct contact with us.

10. Marketing Communications

With your consent, we may send you marketing emails about new features, service updates, promotions, and industry news.

Opt-Out: You may unsubscribe from marketing emails at any time by:

• Clicking the "Unsubscribe" link in any marketing email
• Updating your email preferences in your account settings
• Contacting us at [email protected]

Transactional Emails: You cannot opt-out of transactional emails related to your account, subscriptions, security alerts, or legal notices, as these are necessary for the Platform's operation.

11. Third-Party Links

Our Platform contains links to third-party websites, including AMC registration portals and external resources. We are not responsible for the privacy practices, content, or security of third-party websites.

When you click on external links, you leave our Platform and are subject to the privacy policies and terms of the destination website. We encourage you to review the privacy policies of any third-party sites you visit.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations.

Notification of Changes: Material changes will be communicated via:

• Email notification to your registered email address
• Prominent notice on the Platform homepage
• In-app notifications upon next login

The "Last Updated" date at the top of this policy indicates when it was last revised. Your continued use of the Platform after changes become effective constitutes acceptance of the updated Privacy Policy.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For EU/EEA Users: You have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not addressed your privacy concerns adequately.