Medicare Sales Agents - Privacy Policy

This Privacy Policy describes how Mizwicki Interactive, LLC, a Hawaii limited liability company doing business as Medicare Sales Agents ("we," "us," the "Platform"), collects, uses, and shares information through medicaresalesagents.com, app.medicaresalesagents.com, and our API. It applies to insurance agents who list on our directory ("agents") and to visitors browsing the site. 1. What We Collect From agents: name, National Producer Number (NPN), email address, business location (state, city, service areas), profile content you submit (bio, photo, specialties, contact details), your agency association if any, and subscription and billing records (plan, dates, invoices, payment status). Card numbers are collected and stored by our payment processor (Stripe), never by us. From visitors: limited technical data described in Section 4 (Cookies and Analytics). Consumers browsing the directory do not create accounts, and we do not ask consumers for health, insurance, or Medicare enrollment information. From public records: we may collect and refresh licensing information associated with an NPN from public licensing records, both for agents with accounts and for licensed agents whose public professional information we list for profile claiming (see Section 6). 2. How We Use It - To publish and operate the public agent directory, including search and agent profile pages, which are public and indexed by search engines. - To distribute directory profiles via our API to approved third-party websites connected to the platform (for example, an agency's WordPress site), under the API-distribution consent you give at registration. - To let your associated agency view and manage aspects of your listing. - To process subscriptions, payments, refunds, and payouts through Stripe. - To operate, secure, and improve the Platform, and to communicate with you about your account, billing, and service changes. - To comply with legal, tax, and regulatory obligations. We do not sell personal information, and we do not share it for cross-context behavioral advertising. API distribution of your profile happens at your direction, under the publication and API-distribution consents you give at registration. The one exception is optional and yours to control: if you choose the recruiting-contact option described in Section 3, we may provide your profile and contact information to recruiting organizations - that disclosure is a "sale" as the CCPA defines the term, it happens only if you opt in, and you can turn it off at any time. 3. Who Can See Your Information - The public: your directory profile (name, location, specialties, bio, photo, and the professional details you choose to display) is public and searchable. - Connected websites: approved third-party websites connected to the platform receive profile data through the API under your API-distribution consent. - Your agency: if you are associated with an agency, it can view your profile and manage aspects of your listing. - Service providers: vendors that host and operate the Platform on our behalf, including Stripe (payments and payouts), Clerk (authentication), Neon (database hosting), Vercel (web hosting and analytics), Cloudflare (image storage and delivery), Resend (transactional email), Google (site analytics, as configured in Section 4), and PostHog (product analytics). Each receives only what its function requires. - Legal: we may disclose information when required by law, to enforce our terms, or to protect the Platform and its users. - Recruiting organizations - only if you opt in: at signup (or later from your dashboard) you can choose to let insurance organizations that recruit agents (agencies, FMOs, carriers) receive your profile and contact information from us. This is optional, off by default, and reversible: turning it off in your dashboard stops any future sharing. If you never opt in, your information is not shared this way. - Business transfers: if the Platform is involved in a merger, acquisition, financing, reorganization, or sale of all or substantially all of its business or assets, your information may be transferred as part of that transaction. The successor will be bound by this policy with respect to information collected under it; the successor may apply materially different practices to that information only with your consent, and may begin any new sale or sharing of it only with your affirmative opt-in consent. 4. Cookies and Analytics The Platform uses cookies required for sign-in and session security, and analytics that help us understand how the site and product are used: - Google Analytics measures site traffic and how visitors find and move through the site. We configure it for measurement only: advertising personalization features are turned off, and Google is engaged as our service provider for analytics, not to build advertising profiles. - PostHog measures how the product itself is used (feature usage, signup funnel) so we can improve it. PostHog processes this data on our behalf as a service provider. - Vercel Web Analytics provides basic, cookie-light page metrics. The technical data these tools collect consists of device and browser information, approximate location derived from your IP address, and usage information such as the pages you visit, the site that referred you, and how you interact with the site - in CCPA terms, identifiers and internet or other electronic network activity information. We do not use third-party advertising cookies or tracking pixels, and we do not share your information for cross-context behavioral advertising. You can opt out of Google Analytics with Google's browser opt-out add-on, and you can contact us under Section 7 about analytics data tied to you. If your browser sends a Global Privacy Control signal while you are signed in, we treat it as a request to opt out of the recruiting-organization sharing described in Section 3: we will turn that setting off and let you know, and you can turn it back on in your dashboard if the signal did not reflect your preference. 5. Your Choices You can edit your profile at any time from your dashboard, including what optional details are displayed. You can end an agency association through your dashboard. You can turn the optional recruiting-organization sharing described in Section 3 on or off at any time from your dashboard. You can close your account at any time. Ending publication (by closing your account or removing your listing) removes your profile from the directory and API feeds; copies cached by search engines or third-party sites outside our control may persist for a time. 6. Profiles From Public Records (Unclaimed Listings) We may list basic professional information about licensed agents drawn from public licensing records (name, NPN, location) before the agent creates an account, so that the agent can find and claim their profile. We list this information because it comes from public government licensing records and helps consumers find licensed agents; the CCPA does not treat information lawfully made available from government records as personal information. If you are listed this way and do not want to be, contact us at support@medicaresalesagents.com - we will remove the unclaimed listing and suppress your NPN so future refreshes from public records do not re-create it (suppression ends if you later create an account). Unclaimed listings that are never claimed are deleted per Section 8. 7. California Privacy Rights (CCPA) California residents may request: to know the personal information we hold about them; to correct inaccurate information; to delete their personal information; and to export a copy in a portable format. We do not sell or share personal information as those terms are defined by the CCPA, with one exception: if you opted in to recruiting-organization sharing (Section 3), providing your information to those organizations is a "sale" under the CCPA. You may opt out of that sale at any time using your dashboard toggle or by emailing us - those are the designated methods for opting out - and we will post a "Do Not Sell or Share My Personal Information" link on our homepage before any such sharing begins. If you never opted in, we do not sell or share your personal information at all. In the preceding 12 months we have collected the categories of personal information described in Section 1 and disclosed them to the service providers listed in Section 3 for business purposes; we have not sold or shared personal information. Other than the log-in credentials you create to access your account (used only to authenticate you), we do not collect sensitive personal information as the CCPA defines it. To exercise these rights, email support@medicaresalesagents.com from the email on your account (or, if you have no account, with enough information to locate and verify you). We will verify and respond within the timeframes the CCPA requires, and we will not discriminate against you for exercising your rights. Residents of other states with privacy laws may exercise comparable rights through the same contact methods. Deletion requests - what is retained and why. When we honor a deletion request, we delete or de-identify the personal information we hold, with these narrow exceptions, which the CCPA permits (Cal. Civ. Code section 1798.105(d)): - Financial and tax records, including our payment processor's customer and transaction records, are retained as required for tax filings, audits, and defense of legal claims. - Consent records (the fact, time, and version of the consents you gave while your account was active) are retained for 6 years after account closure as evidence needed to defend legal claims. - Public-record professional data (such as license status associated with an NPN) exists in public sources we do not control and may reappear in public records even after deletion here. 8. Data Retention We keep account and profile data while your account is active. After account closure or a verified deletion request, we delete or de-identify personal information within 45 days, except the retained categories in Section 7. Financial and tax records are kept for 7 years. Consent records are kept for 6 years after account closure. Analytics data is retained by our analytics providers for 14 months (Google Analytics) and 1 year (PostHog). Audit logs (immutable records of account- and payment-affecting actions) are retained for as long as needed for financial integrity, dispute resolution, and tax compliance — and for at least 7 years for payment-related records. Unclaimed public-record listings (Section 6) are deleted when they are no longer reasonably needed for profile claiming and directory accuracy. Backups are short-lived operational copies that expire automatically on a rolling basis; data deleted from production leaves backups as those backups expire. 9. Security We use industry-standard safeguards: encrypted connections, encrypted storage with our hosting providers, role-based access, audit logging of account actions, and payment handling exclusively by Stripe (we never see or store card numbers). No system is perfectly secure; if a breach affects your personal information, we will notify you as the law requires. 10. Children The Platform is a professional directory for licensed insurance agents and is not directed to anyone under 18. We do not knowingly collect information from minors. 11. Changes to This Policy We may update this policy by publishing a new version with a new version number and effective date at medicaresalesagents.com/privacy, and by notifying account holders at their account email of material changes. Material changes that would permit new uses of personal information we already hold take effect for that information only with your consent. 12. Contact Mizwicki Interactive, LLC dba Medicare Sales Agents Email: support@medicaresalesagents.com