Privacy policy

Your brokerage (the "Tenant") is the data controller for the personal information of plan members, dependents, and other natural persons whose data you upload or generate within ABB. We are your data processor and act under your authority. We are the data controller for information about your Broker users (your authorized employees and partners who log in to ABB).

• Broker users: name, work email, password hash, role, audit log of actions.
• Plan member & dependent data: identifying details (name, DOB, address), coverage class, dependents, salary range, claims information — whatever you choose to upload.
• Operational data: service threads, agent drafts, carrier bulletins, opportunity records, generated enrollments.
• Technical telemetry: agent token usage, error reports (no PII content), basic page-view logs.
• Client deck opens: When a client deck link is opened we record the time and a one-way hash of the device, so the advisor can see that the deck was opened; no IP address is stored.

We process personal information only to operate the Service for your tenant: classify and action service mail, draft enrollments and communications, parse carrier bulletins, match client impacts, and generate the artifacts the agent produces for your review. We do not use your data for training any AI model. We do not sell your data.

One category of information is pooled across Tenants, and it is described here in full rather than buried in a definition. From each renewal or quote the Service derives an anonymised rate observation: insurer, province, industry, number of covered lives, total premium, claims experience, and the percentage rate change. These observations are combined across all Tenants to produce the market benchmarks and carrier statistics the Service reports.

An observation carries no personal information. It contains no names, no dates of birth, no health or claims detail about any individual, and no employee records. The pooled figures other Tenants see never identify the employer, the brokerage or the document an observation came from, so a figure cannot be attributed back to a client or a brokerage. We keep an internal reference from each observation to its source, used only so that a client’s data can be removed from the pool on request. No statistic is published from fewer than four comparable observations.

Your documents, employee records, client identities, employer list and the rates quoted for any named group are not pooled and are never visible to another Tenant.

We consider a properly de-identified rate observation to fall outside “personal information” under PIPEDA. We disclose it anyway, because a Tenant deciding whether to place client data in this Service is entitled to know exactly what leaves their workspace.

• Anthropic, PBC — model inference. Contractual commitment that customer data is not used for training.
• DigitalOcean, LLC — application, database and uploaded-document hosting, Toronto (tor1) region. Uploaded documents are stored in and served from DigitalOcean Spaces, Toronto.
• Cloudflare, Inc. — content delivery, TLS, and object storage (R2) for encrypted off-site backups, and for copies of documents uploaded before October 17, 2026, which remain there as they were stored before the move to Toronto, not encrypted by us, until we delete them.
• Functional Software, Inc. (Sentry) — server-side error reporting, United States. It receives the first line of the error message, its stack trace, the page or API path it happened on with any query string removed, the request headers other than cookies and sign-in headers, and a 10% sample of performance timings. Request bodies (uploaded documents, census files, forms), cookies, query strings and console output are removed before anything is sent.
• Stripe, Inc. — subscription billing and payment processing.
• Resend (Plus Five Five, Inc.) — transactional and outbound email delivery.
• Microsoft Corporation / Google LLC — only when you connect a Microsoft 365 or Gmail mailbox to your tenant.

Subprocessor list is kept current; we notify Tenants 14 days before adding a new one.

The primary database and the application run in Toronto, Canada (DigitalOcean, tor1 region). Tenant records — clients, employees, reviews, quotes, audit log — and uploaded documents are stored there.

Model inference is performed in the United States by Anthropic, under a contractual commitment that customer data is not used for training. Outbound email transits Resend (United States). Server error reports go to Sentry (United States), with request bodies, cookies and query strings removed. Database backups, and from October 24, 2026 nightly backups of uploaded documents, are encrypted on our servers before they are copied off-site to Cloudflare R2, which may store them outside Canada; a backup is only ever read to restore the service after a failure. Copies of documents uploaded before October 17, 2026 also remain in Cloudflare R2, as they were stored before the move to Toronto (not encrypted by us), until we delete them; documents are served from DigitalOcean Spaces, Toronto.

By using ABB you consent to this cross-border processing for the operational purpose of running the service and generating agent outputs. We will update this notice if these locations change.

We retain tenant data for the active life of the tenancy plus 30 days following termination, during which we make a final export available on request. After that window we delete operational data on request, and an automated retention schedule that performs this on a rolling basis is being implemented. Prospect / review-funnel data not converted to a tenancy is retained 12 months, then deleted. We intend to retain audit-log entries for seven (7) years as a regulatory record; automated enforcement of that schedule is on the roadmap (see our Security page).

If you are a plan member or other natural person whose data is processed in ABB through a broker tenant, you can request access, correction, or deletion of your personal information. Direct your request to the broker you work with — they are the data controller. If you cannot reach your broker, contact us at the address below and we will route the request.

See the Security page for technical and organizational measures.

We follow a standing incident-response process. In the event of a real risk of significant harm under PIPEDA Section 10.1, we will notify affected Tenants without unreasonable delay and assist with notifications to the Office of the Privacy Commissioner of Canada and affected individuals.

We will notify Tenants at least 30 days before material changes. Continued use after the effective date constitutes acceptance.

Privacy Officer: James Stirling, Scotia Blue Technology — james@scotiablue.com
Postal: Scotia Blue Technology, 40 Loon Terrace, Bedford, Nova Scotia B4A 3X9, Canada