Privacy Policy

Introduction

InsureMEP, Inc. ("InsureMEP," "we," "our," or "us"), a Delaware corporation based in Long Beach, California, respects your privacy. This Privacy Policy explains what personal information we collect on www.insuremep.com (the "Website") and in our CriticalAsset apps and connected services (see CriticalAsset apps and connected services), why we collect it, who we share it with, and the choices you have. We follow applicable U.S. privacy laws, including the California Consumer Privacy Act as amended by the CPRA.

Personal information we collect

• Identifiers: name, email, phone, company, job title (when you submit a form).
• Commercial information: property type and insurance interest you describe.
• Internet activity: pages visited, referrer, IP address, browser/device data via cookies and similar technologies — only as permitted by your consent choices.

On the Website, we do not intentionally collect sensitive personal information, precise geolocation, biometric data, or information of children under 16.

Sources

Directly from you (forms, email), automatically from your device (cookies/SDKs you have allowed), and from service providers acting on our behalf.

How we use it

• Respond to inquiries and provide quotes.
• Operate, secure, and improve the Website.
• Comply with law and prevent fraud.
• With your consent, measure site performance (analytics) and run marketing.

Categories of recipients

• Service providers: website hosting (Amazon Web Services), our CRM and contact form (HubSpot), email delivery (Resend).
• Video embeds: Vimeo, Inc., loaded only after you click to load a video or have granted functional-cookie consent. Vimeo processes your IP address, device data, and viewing activity as a processor under our Vimeo Data Processing Addendum (DPA).
• Analytics/marketing vendors only when you have consented (e.g., HubSpot’s tracking code).
• Authorities when legally required.

Sale or sharing of personal information

We do not sell personal information for money. We may "share" personal information for cross-context behavioral advertising only if you have explicitly consented. You can opt out at any time using theDo Not Sell or Share My Personal Informationlink, by enabling Global Privacy Control in your browser, or via the cookie preferences panel.

Global Privacy Control

We honor the Global Privacy Control (GPC) browser signal as a valid opt-out of sale/share for the browser sending it.

Retention

Form submissions and quote requests are retained for up to 24 months after last contact, unless a longer period is required by law. Consent records and admin privacy audit logs are retained for a minimum of 24 months for compliance and audit purposes.

CriticalAsset apps and connected services

This section covers the CriticalAsset mobile app (listed on the App Store as CriticalAsset Capture), the CriticalCopilot web app, and the online services they connect to. It applies in addition to the sections above.

What we receive

• Account: your name, email address and sign-in identifier from Google, Apple (including an Apple private relay address if you choose Hide My Email) or email sign-in, which we verify through Google Firebase, or through a one-time sign-in link we email to you.
• Device: a device name and app-generated identifier, and, if you allow notifications, a push token used only to deliver them.
• What you choose to connect, submit or share: addresses, room layouts and measurements, 3D scans and depth information, equipment details, photos, videos (which can include sound), documents, notes and contacts you select. Capturing on your device does not upload anything by itself; we receive what you connect, submit for assigned work, or prepare for sharing.
• Diagnostics: if you turn on the app's diagnostic logging, technical events you send to support, such as errors and app state.

Location

The app can use Apple's location lookup, only when you ask it to, to suggest a street address; you can type an address instead. It does not track your location continuously. Photos and videos you upload are stored as you took them, so they can contain location information your camera embedded; we do not read it for tracking. For commercial work, we store the location of the buildings you are assigned to so the app can match you to the right building.

AI

For households, AI reads your photos and records only with your permission, which you can withdraw at any time in the app. It runs on AI models operated by CriticalAsset on Amazon Web Services in the United States; your household's content is not sent to third-party AI providers. AI results are suggestions you confirm or reject. In the commercial workspace, some operator tools also use Google's Gemini to interpret work-order text an operator pastes in; household content is never sent to it.

We never use customer data to train AI models. Your photos, videos, scans, records, answers and documents are used only to provide the service to you and your organization.

Who processes it, and where

• Amazon Web Services (United States, us-east-1): storage, database, application and AI processing.
• Google Firebase: sign-in verification. Apple: Sign in with Apple, push notifications and on-device maps.
• PostHog: product analytics in the app, only if you opt in. Session replay is off, and photos, videos, floor plans, addresses, notes and credentials are not sent as analytics content.
• SendGrid (email): sign-in links, requests from an insurer or broker to see your proof, and notices about your sharing; in the commercial workspace, also invitations and work notifications.
• Commercial workspace only: Twilio (text messages with pairing codes), Google (address lookup and the pasted-text tool above) and Firecrawl (public web research about commercial buildings).

We do not sell this information and do not use it for advertising.

Who can see it

A home is visible to you and to the people you give access to. Commercial work is visible to authorized members of your organization according to their permissions. A viewer link you create shows the material you selected to anyone who has the link until it expires or you revoke it; we cannot recall copies someone already saved. CriticalAsset staff can open a household's records only through a time-limited access grant that the household can see and revoke.

Sharing with your insurer or broker

You can choose to share proof of your home's emergency controls with an insurance company or insurance broker, either when they ask (we email you their request) or on your own. Nothing is shared unless you approve it on a screen that names the organization, the home, the purpose and the period. They see only: the home's name and address and your name; each emergency control you recorded, with the name you gave it, the room and area it is in, your location note, its identity details (such as make, model and serial number), and its photos with the date each was taken; any policy number you enter; the emergency-controls checklist; and CriticalAsset's review of each control (accepted, or sent back for a photo, the room or a clearer photo) and whether the proof is signed off. Photos are re-encoded for them with the location and other data your camera stored removed. They do not see your email address, phone number or emergency contacts, access notes such as gate codes, photos you excluded from sharing, any other room, item, document or guide, or any other home.

Sharing lasts for the period you choose (30 days, 90 days or one year) and you can stop it at any time; it ends on their next request. We record each time someone at the organization opens your proof or one of its photos, and you can see that record. Before any insurer or broker can use this, they sign a data-use agreement with us: they may use what you share only for the purpose you chose, may not pass it on or sell it, must protect it, and must delete what they hold when you stop sharing or the purpose ends, except a record an insurance law requires them to keep for a policy or claim. We cannot recall a copy they already saved or printed. A disclosure you direct in this way is not a sale of your personal information. People at the insurer or broker are named in the record you see.

How long we keep it

• Your homes and records are kept while your account is active.
• When you delete a home or your account, it is removed from the service immediately and permanently deleted, together with its photos and files, 30 days later. Backup copies are gone within 7 days after that.
• A photo or file you delete on its own is permanently deleted 30 days later.
• App diagnostic logs and server logs are deleted after 90 days.
• Security, consent and account-deletion records are kept for 2 years. This includes what you shared with an insurer or broker, your consent, and each time they opened it; if you delete the home, these go with it 30 days later.
• A request from an insurer or broker to see your proof is deleted 90 days after you answer it or it lapses.
• Commercial workspace records are kept for the term of your organization's agreement with us.
• Analytics data in PostHog stays until we delete it; resetting the app does not delete it. Ask us at privacy@insuremep.com and we will delete it.

Stored files and our database are encrypted at rest, and data is encrypted in transit.

Your choices

You can capture without connecting, choose what to connect or share, turn analytics off, withdraw AI permission, and manage camera, microphone, location and notification permissions in iOS Settings. You can delete your account in the app. If you also use the same sign-in for a commercial workspace, that workspace account continues; your household data is deleted. Signing out or deleting the app does not delete what is stored online.

Your California rights

• Right to know what personal information we collect and how we use it.
• Right to access a copy of your personal information.
• Right to delete personal information.
• Right to correct inaccurate personal information.
• Right to opt out of sale/sharing and to limit use of sensitive personal information.
• Right to non-discrimination for exercising your rights.

Submit a verifiable request at /privacy-request. We verify access, deletion, and correction requests by email before completing them and respond within 45 days.

Contact