Privacy Policy

Version 2.1 — Effective Date: May 20, 2026   GLBA CCPA/CPRA TDPSA GPC

Lead Validator Pro ("we," "us," "our," or the "Service") is operated by Resolon LLC. This Privacy Policy describes how we collect, use, disclose, and safeguard personal information when you use our insurance lead validation platform.

1. Information We Collect

We process the following categories of personally identifiable information (PII) for the purpose of insurance lead validation and quality scoring:

2. Data Sources and Purposes

We obtain and cross-reference lead data from the following sources to validate lead quality and detect fraud. The authoritative, current list of all sub-processors (with privacy-policy links and jurisdictions) is maintained at /subprocessors and forms part of this Privacy Policy by reference.

3. Third-Party Sub-processors

In addition to the data sources above, we engage infrastructure and operational sub-processors to host the Service, secure the perimeter, deliver email, process payments, monitor errors, and route operational alerts. Each sub-processor is contractually bound (where a Data Processing Agreement is offered by the sub-processor) to process data only for the specified purpose and in accordance with applicable data protection laws.

4. How We Use Your Information

We use the personal information we process for the following business purposes:

• Lead Validation: Verifying identity, contact information, and address accuracy for insurance lead quality scoring
• Fraud Detection: Identifying fraudulent, synthetic, or low-quality insurance leads using cross-source verification
• Property Assessment: Validating property details for home insurance underwriting support
• Vehicle and DL Verification: Confirming vehicle ownership and driver's license status for auto insurance leads
• Household Intelligence: Analyzing household composition for multi-policy opportunity identification
• Disposition Recommendations: Generating AI-assisted lead handling recommendations for insurance agents
• Compliance: Meeting regulatory requirements under GLBA, FCRA, DPPA, TCPA, CCPA, and TDPSA
• Service Improvement: Training, calibrating, and improving our validation algorithms, scoring models, and fraud detection systems using Lead Data, including derivative and aggregated forms
• Benchmarking and Derivative Products: Generating aggregated industry benchmarks, lead quality metrics, regional trend data, and other derivative data products. Derivative data may be licensed, sold, or otherwise commercialized by us as described in our Terms of Service, Section 10.
• Product Development: Developing new features, validation modules, and derivative data products
• Research: Conducting internal and external research on lead quality patterns, fraud indicators, and insurance market trends

4.1 Data Rights and Derivative Use

5. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected:

Upon expiration of the retention period, individually identifiable data is permanently deleted from active systems. Backup copies are purged within 30 days of the primary deletion. Derivative data that cannot reasonably identify any individual is retained indefinitely.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Right to Access: Request a copy of the personal information we hold about you
• Right to Correction: Request that we correct inaccurate or incomplete personal information
• Right to Deletion: Request that we delete your personal information (subject to legal retention requirements and the derivative-data carve-out in Section 5)
• Right to Data Portability: Receive your data in a structured, machine-readable format (JSON or CSV)
• Right to Opt-Out of Sale: Direct us not to sell raw, individually identifiable personal information (see CCPA section below)
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

7. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected, the sources, the business purposes, and the third parties with whom we share it
• Right to Delete: You may request deletion of personal information we have collected from you
• Right to Correct: You may request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: You may opt out of the "sale" or "sharing" of your personal information
• Right to Limit Use of Sensitive Personal Information: You may limit our use of sensitive personal information to what is necessary to provide the Service

7.1 "Do Not Sell or Share My Personal Information"

Verification of other requests: To protect your privacy, we will verify your identity before fulfilling any access, deletion, or correction request by matching at least two data points you provide against information we hold.

Authorized Agents: You may designate an authorized agent to submit requests on your behalf. The agent must provide written authorization signed by you.

Response Timeline: We will acknowledge receipt within 10 business days and provide a substantive response within 45 calendar days. We may extend by an additional 45 days with notice.

8. Texas Data Privacy and Security Act (TDPSA)

If you are a Texas resident, the Texas Data Privacy and Security Act (effective July 1, 2024) provides you with the following rights:

• Right to Access: Confirm whether we are processing your personal data and access such data
• Right to Correction: Correct inaccuracies in your personal data
• Right to Deletion: Delete personal data you have provided or we have obtained
• Right to Data Portability: Obtain your personal data in a portable, readily usable format
• Right to Opt-Out: Opt out of processing for targeted advertising, sale of personal data, or profiling that produces legal or similarly significant effects

To exercise your TDPSA rights, contact us at privacy@leadvalidatorpro.com. We will respond within 45 days. If we decline a request, you may appeal within 60 days, and we will respond to the appeal within 60 days.

9. Gramm-Leach-Bliley Act (GLBA) Notice

10. Cookies and Local Storage

We use essential cookies and localStorage only. We do not use third-party advertising pixels. Product analytics (PostHog) may be enabled when the user grants consent and is fully disabled when Global Privacy Control is signaled.

No personal information is stored in localStorage. Authentication tokens are stored exclusively in httpOnly cookies that are inaccessible to JavaScript.

10.1 Global Privacy Control (GPC)

We recognize and honor the Global Privacy Control (GPC) signal as a valid opt-out of the sale and sharing of personal information, as required by the California Consumer Privacy Act (CCPA/CPRA), the Colorado Privacy Act (CPA), and the Texas Data Privacy and Security Act (TDPSA).

You can enable GPC in your browser settings (Firefox, Brave, DuckDuckGo have built-in support) or by installing a GPC browser extension for Chrome or Edge. You can verify your GPC status in the Settings > Privacy tab within the application.

10.2 Cookie Consent Banner on Authentication Pages

The cookie consent banner is suppressed on authentication-mandatory pages (/login, /signup, /verify, /finalize-invite, /forgot-password, /reset-password) because (a) the cookies set on these pages are strictly necessary for authentication and security and require no consent under the ePrivacy Directive Article 5(3) "strictly necessary" exemption and the CCPA "necessary to provide the service" exemption, and (b) on small viewports the banner geometry would intercept the SIGN IN control. The banner is presented on the next non-authentication navigation (Dashboard, Leads, etc.). Analytics and other non-essential tracking remain disabled until explicit consent is granted on a non-authentication page.

11. Data Security

We implement comprehensive security measures to protect your personal information:

• Encryption in Transit: All data is transmitted via TLS 1.2+ (HTTPS enforced via Cloudflare)
• Data at Rest: Application data is stored in managed PostgreSQL hosted by Render (US-based infrastructure) with encryption at rest enabled at the storage layer. Daily encrypted backups and point-in-time recovery (PITR) over a 7-day window are managed by Render
• Authentication: Identity, password storage, and session management are provided by WorkOS, a SOC 2 Type II certified identity platform. Passwords are hashed by WorkOS using industry-standard algorithms (bcrypt) and are never stored in our systems. Sessions use sealed JWE cookies (encrypted-and-signed) with rotation per WorkOS recommendations. Optional multi-factor authentication via WorkOS-managed TOTP (RFC 6238) is supported; account lockout and brute-force protection are managed by WorkOS based on geolocation, device, and risk signals
• Access Control: Role-based access control (RBAC) with principle of least privilege; tenant isolation enforced via PostgreSQL row-level security (RLS), with every query scoped to the authenticated tenant's org_id
• Audit Logging: All data access, modifications, and administrative actions are logged with timestamps, user identity, and IP addresses
• Rate Limiting: API endpoints are rate-limited to prevent abuse and brute-force attacks
• Security Monitoring: Real-time login monitoring, suspicious activity detection, and automated session revocation
• Incident Response: Documented incident response plan with 24-hour processor-to-controller breach notification commitment (see Incident Response Plan and Data Processing Agreement § 12)

11.1 Security Certifications and Readiness

12. Children's Privacy

Our Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child under 18 has provided us with personal information, we will take steps to delete such information promptly. Subscribers must not submit Lead Data of any individual under 18.

13. Geographic Scope and International Transfers

The Service is designed for and offered to insurance professionals operating in the United States, and Subscriber Data and Lead Data are processed and stored in the United States. We do not market the Service to residents of the European Economic Area, the United Kingdom, or Switzerland. Where a Subscriber chooses to submit Lead Data originating in a jurisdiction that requires additional cross-border transfer safeguards, the Subscriber is responsible for ensuring those safeguards are in place. Our Data Processing Agreement, Section 13, incorporates the Standard Contractual Clauses (Module 2, Controller-to-Processor) and the UK International Data Transfer Addendum for use by Subscribers who require them.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email notification to account holders and/or a prominent notice within the Service at least 30 days prior to the change taking effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

15. Contact Information

For privacy-related inquiries, data access requests, or to exercise your rights under applicable law:

We will acknowledge all privacy requests within 10 business days and provide a substantive response within 30-45 calendar days depending on complexity and applicable law.