Privacy Policy

Last updated: October 21, 2026

CRM For Claims ("CRM For Claims", "we", "us") makes software that roofing, restoration and public adjusting companies use to run their insurance claim work. This policy covers our website crmforclaims.com, the application at app.crmforclaims.com (the "Service"), the document signing pages the Service opens, and the emails and text messages the Service sends. Using the Service is also governed by our Terms of Service.

1. The two roles we play

Our own information. For visitors of this website, people who request a demo, and the companies and users that hold accounts, we decide how the information is used.

Information our customers keep in the Service. A company that subscribes to CRM For Claims enters information about its own clients, projects and claims (for example a homeowner's name, address, phone number, insurance policy and claim details, photos and signed documents). We process that information only on the company's behalf and on its instructions, as its service provider. The company is responsible for having the right to collect it and for answering the people it is about. We help our customers when someone asks them to see, correct or delete their information.

2. What we collect

Website visitors

• Demo and contact requests: your name, email address, and, if you add them, phone number, company name and message.
• Server logs: IP address, date and time, the page requested and browser type, used to keep the site running and secure.
• Analytics: Google Analytics 4 measures visits, pages read, approximate location derived from the IP address, device type and how you arrived. It sets cookies named _ga. We also count a few actions (demo form sent, phone number clicked, demo video opened, sign-up clicked) without sending your name, email, phone or message to Google.

Account holders and users of the Service

• Sign-up details: company name and state, the administrator's name, email address and password (stored only as a one-way hash), the chosen plan, and a record that the administrator agreed to the Terms of Service (date, time, IP address and browser).
• Billing: handled by Stripe. We receive the card brand, last four digits and expiry date, never the full card number.
• User profiles: what an administrator or user enters, such as phone numbers, addresses, job role and, for public adjusters, license numbers and license documents.
• Usage and security records: sign-in times, IP addresses, browser type, failed sign-in attempts and a history of changes made in the account (Project Records), so that a company can see who did what.

Customer data

Everything a company stores in its account: contacts, project and claim details, insurance and mortgage information, inspection photos, documents and templates, invoices, payments and expenses, tasks, notes, calendar events, and the emails and texts sent from the Service. We handle this as described in section 1.

People who sign documents

When a company sends documents for electronic signature, the signing page records the signer's name, the email address or phone number the link was sent to, the date and time of each step (link opened, agreement to sign electronically, signature), the IP address and browser used, the text of the Electronic Record and Signature Disclosure the signer agreed to, and a SHA-256 fingerprint of each signed file. This record, the Certificate of Completion, lets the company and the signer show who signed what and when. The disclosure itself is published at app.crmforclaims.com/terms-for-electronic-transactions-and-records.

Text messages and email

The Service sends emails and texts on behalf of our customers: signing links, reminders, project updates, invoices and review requests. We keep a record of each message (recipient, content, time and whether the provider accepted it), the replies people text back, and STOP and START requests.

3. How we use information

• to provide, maintain and secure the Service and this website;
• to answer demo requests and support questions;
• to bill subscriptions and send account, billing and security notices;
• to prevent fraud, abuse and spam, and to investigate problems;
• to meet legal obligations and enforce our Terms of Service;
• to improve the Service using usage statistics that do not identify a person.

We do not use customer data for our own marketing, we do not sell personal information, and we do not build advertising profiles from it.

4. Who else handles information

We use a small number of companies to run the Service. Each receives only what it needs for its task:

• IONOS hosts the Service and its database on servers in the United States.
• Stripe processes subscription payments, and payments that a customer collects from its own clients through Online Payments.
• Google delivers email sent from the Service (Google Workspace), syncs calendars for users who connect Google Calendar (section 6), suggests addresses while typing (Google Maps), serves the fonts of this website and provides Google Analytics on this website.
• GatewayAPI delivers text messages; it receives the phone number and the text of each message.
• Anthropic reads documents that a user sends to AI intake (section 7).
• CompanyCam exchanges photos and project links only for companies that connect their CompanyCam account.
• Cloudflare checks that the contact form on this website is used by a person (Turnstile).

We also disclose information when the law requires it, to protect people or the security of the Service, or as part of a merger or sale of our business, in which case this policy continues to apply to it.

5. Text messages

Texts from the Service are sent by the company you deal with, which is responsible for having your consent. Message frequency varies with your project. Message and data rates may apply. Reply STOP to stop optional texts such as project updates and review requests, START to turn them back on, and HELP for help. Texts that carry documents you asked to sign or an invoice may still be sent.

6. Google Calendar and other Google user data

A user can connect a Google account to the CRM calendar. The Service then asks Google for permission to see and edit that user's calendars and events, and for the email address and name of the Google account. We use this only to show the user's Google events in the CRM calendar and to create, update or remove the events the user manages in the CRM. We store the connection token and the event details needed to keep the two calendars in step.

• We do not use Google user data for advertising, we do not sell it, and we do not use it to train artificial intelligence models.
• Our staff read it only with the user's permission, to investigate a security problem, or when the law requires it.
• The user can disconnect the calendar in the CRM, or remove our access at myaccount.google.com/permissions.

CRM For Claims' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. AI document intake

When a user uploads an insurance policy or another document to AI intake, the file is sent to Anthropic, which reads it and returns the extracted details so that the user can review them before they are saved. Under Anthropic's commercial terms, these files are not used to train its models. AI intake runs only on documents a user chooses to send to it.

8. Cookies

• This website: only the Google Analytics cookies described in section 2. You can block them with the Google Analytics Opt-out Browser Add-on or your browser settings; the site works the same without them.
• The Service and signing pages: a session cookie and a sign-in cookie that keep you signed in. They are needed for the Service to work and are not used for advertising.

We do not sell or share personal information for targeted advertising, so there is nothing to opt out of; we still treat a Global Privacy Control signal from your browser as a request not to.

9. How long we keep information

• Demo and contact requests: up to 24 months after our last contact with you.
• Google Analytics data: 14 months, then deleted by Google.
• Accounts and customer data: for as long as the subscription is active. When a subscription ends, the account is closed to its users but its information is kept, so that the company can reactivate it or ask us for a copy. A company can ask us at any time to delete its account and its information; we do so within 30 days of the request, except what the law requires us to keep.
• Signed documents and Certificates of Completion: kept with the company's account for as long as the company keeps them. Some companies must keep these records for years (Illinois public adjusters, for example, for 7 years), and each company is responsible for keeping or downloading what its rules require.
• We keep information longer when the law requires it or to resolve a dispute.

10. Security

The Service runs only over encrypted HTTPS connections. Passwords are stored as one-way hashes. Every record is stored with the account of the company it belongs to, the application shows each user only records of their own company, and within a company each user sees only what the company's permissions allow. Signing links are long random codes that cannot be guessed from one another. Changes to project data are logged. No system is perfectly secure; if a breach affects personal information, we notify the affected customers without unreasonable delay and help them notify the people involved as the law requires.

11. Your rights

Depending on where you live, you may have the right to know what personal information we hold about you, to get a copy, to correct it, to delete it, and to opt out of its sale, sharing for targeted advertising, or profiling. We do none of the last three. To make a request, email info@crmforclaims.com. We confirm who you are before acting on a request, we answer within 45 days, and we do not treat you differently for using your rights. An authorized agent may make a request for you with your written permission. If we decline a request, you can ask us to reconsider by replying to our answer; if you are still not satisfied, you can contact your state Attorney General.

If your information is in the account of a company that uses CRM For Claims, send your request to that company. If you write to us instead, we pass it to them.

California residents

In the last 12 months we collected identifiers (name, email, phone, IP address), commercial information (plan and billing history), internet activity (pages visited, actions in the Service), approximate location derived from IP address, and professional information (job role, public adjuster license). We collected it from you, from your company's administrator and from your use of the Service, for the purposes in section 3, and we disclosed it only to the providers in section 4. We have not sold or shared personal information as the California Consumer Privacy Act defines those terms, and we do not use sensitive personal information to infer characteristics about anyone.

Visitors from the EU and UK

We process information to answer your request, to perform our contract with your company, and for our legitimate interest in running a secure service. You may ask for access, correction, deletion, restriction or a copy of your information, object to processing, and complain to your data protection authority. Our servers are in the United States; GatewayAPI processes text messages in the European Union.

12. Children

The Service and this website are for businesses and are not directed at children. We do not knowingly collect information from anyone under 16.

13. Changes to this policy

When we change how we handle information, we update this page and the date at the top. For a material change we also email the administrators of active accounts before it takes effect.

14. Contact us