Privacy Policy

AgencyCommand is a software-as-a-service customer relationship management (CRM) and agency management platform built for insurance agencies. It is used by agency owners, agency administrators, licensed agents, and agency staff to manage leads, clients, policies, tasks, appointments, learning, metrics, recordings, and related workflows.

AgencyCommand is business software. It is not an insurance carrier, broker, legal advisor, compliance officer, government agency, or CMS representative.

• Agency owners and agency admins who configure an environment, manage their team, and oversee subscriptions.
• Licensed insurance agents who work leads, manage clients, and use the AgentDashboard.
• Agency staff with delegated responsibilities inside an agency environment.
• AgencyCommand platform administrators who maintain the service.

We collect information you and your agency provide directly, information generated as you use the platform, and information returned by integrations you choose to connect.

Account & environment information

• Name, email address, and (optionally) phone number for users invited to an agency environment.
• Role assignment within an environment (e.g. agency admin, agent).
• Agency / environment name, agency code used to onboard agents, branding settings.
• Subscription tier and billing identifiers (managed by Stripe — we do not store full card numbers).

CRM data entered by agencies and agents

• Lead and client records, including contact details, statuses, sources, notes, and tags.
• Policies, quotes, plan types, carriers, and commission entries.
• Tasks and appointments, including reminders, attendees, locations, and meeting links.
• Communications and notes logged inside the CRM, including call dispositions and outcomes.
• Call recordings made via the in-app Work Queue, where the agency has enabled recording.
• Provider, prescription, chronic condition, and other health-related client details that an agent enters to support an insurance workflow.
• Files uploaded or imported (for example, client documents and lead-list spreadsheets).

Usage and operational data

• Activity and audit logs (e.g. who created or updated a record, when a recording was uploaded).
• Diagnostic metadata about integrations (e.g. last sync time, success/failure status).
• Basic device and browser information needed to deliver the application.

Integration metadata

• OAuth tokens for third-party services you choose to connect (e.g. Google, Calendly). Tokens are stored server-side, scoped to the connecting user and/or environment, and are never exposed to the frontend.
• Email address of the connected third-party account, used to display connection status in the UI.

Agencies and agents may enter information related to insurance benefits, Medicare, Medicaid, life and health insurance, providers, medications, chronic conditions, and policies. AgencyCommand processes this information on behalf of the agency that entered it, solely to provide CRM and agency management features.

Agency responsibility. Agencies are responsible for obtaining the permissions and consents required to collect and store information about their leads and clients, including any consent required by applicable insurance, telemarketing, recording, and privacy laws. Users should only enter data they are authorized to store in the platform.

AgencyCommand does not currently advertise HIPAA compliance, a signed Business Associate Agreement program, SOC 2 attestation, or any other formal certification. Agencies that have specific regulatory obligations are responsible for determining whether the platform is appropriate for their use case.

• Provide, operate, and maintain the AgencyCommand platform.
• Create and manage agency environments, users, roles, and access.
• Support CRM workflows: leads, clients, policies, tasks/appointments, communications, and recordings.
• Power optional Calendar, Email, Meet, and Drive features when an agency or agent connects an integration.
• Power optional CommandAI features (assistive AI inside the platform) where enabled.
• Maintain security, prevent abuse, and respond to support requests.
• Manage subscriptions and billing through Stripe.
• Improve the product based on aggregate usage patterns.

Integrations are optional. They are enabled by an authorized user (an agency admin for environment-level integrations, or an agent for their own per-account integrations) and can be disconnected at any time from the relevant Settings page.

• Google: Calendar (two-way sync of tasks/appointments and Meet links), Gmail (sending email from the connected account), and Google Drive (optional agency-level call-recording storage).
• Calendly: scheduled appointments can be imported into the AgencyCommand calendar.
• Stripe: subscription billing for agency environments.

Integration data is used only to provide the connected feature. We do not share integration data with third parties for advertising. If an integration is not listed here or not visible in the in-app Settings, it is not active.

AgencyCommand’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Gmail, Calendar, Meet, and Drive data accessed through Google OAuth is used only to provide the user-facing AgencyCommand feature the user connected (e.g. sending an email from your Gmail address, syncing a calendar event, attaching a Meet link, or saving a call recording to a configured Drive folder).
• AgencyCommand does not sell Google user data.
• AgencyCommand does not use Google user data for advertising.
• AgencyCommand does not transfer Google user data to third parties except as necessary to provide or improve user-facing features, to comply with applicable law, to maintain security, or with explicit user or admin direction.
• AgencyCommand does not allow humans to read Google user data unless we have obtained the user’s affirmative consent, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or for limited operational purposes such as resolving a user-reported issue.

Users can revoke AgencyCommand’s access to their Google account at any time from myaccount.google.com/permissions or from inside the AgencyCommand integration settings.

AgencyCommand shares information only as needed to provide the service or as required by law:

• Service providers that host the application, run our databases, deliver email, or otherwise support the platform.
• Payment processors — Stripe processes subscription payments for agency environments.
• Connected third-party services (Google, Calendly, etc.) when an authorized user has enabled the integration, and only the data needed for that feature.
• Other users inside the same agency environment, subject to role-based permissions configured by the agency admin.
• Legal, regulatory, or law-enforcement requests where we believe disclosure is required.
• A successor entity in connection with a merger, acquisition, financing, or sale of business assets, subject to standard confidentiality terms.

We do not sell personal information, and we do not share personal information with third parties for cross-context behavioral advertising.

AgencyCommand uses an environment model. Each agency operates inside its own environment, identified by an internal environment/agency ID. Records and integration tokens are scoped to the environment that owns them, and access is enforced by role-based permissions (agency admin vs. agent).

Agencies cannot read or modify data belonging to another agency, and platform administrators may only access an environment when necessary for security, support, or operational reasons.

• Account and environment data is retained while the agency’s subscription is active.
• CRM records (leads, clients, policies, tasks, communications) are retained as needed to provide the service to the agency that entered them.
• Call recordings are retained according to the agency’s recording-storage configuration (in-platform storage or a connected agency-level Drive folder, where enabled).
• When an account, environment, or record is deleted, related data may be retained for a limited period to satisfy backups, legal obligations, billing reconciliation, or security needs before being permanently removed.
• Specific deletion requests can be made by an authorized agency admin and will be handled in accordance with the above.

AgencyCommand uses reasonable administrative, technical, and physical safeguards to protect information, including role-based access controls, per-environment isolation, encrypted transport (HTTPS) for traffic to and from the application, and server-side-only storage of OAuth credentials and integration tokens.

No internet-connected service can be guaranteed 100% secure. Agencies are responsible for safeguarding their own login credentials and for promptly revoking access when a user leaves the agency.

• Agencies are responsible for the accuracy, lawfulness, and appropriateness of the data they enter into AgencyCommand.
• Agencies are responsible for complying with applicable insurance, telemarketing, recording-consent, privacy, and electronic-communications laws.
• Agencies are responsible for managing their users and revoking access promptly when a team member departs.
• Users should only enter information they are authorized to store on behalf of the agency or its clients.

AgencyCommand uses cookies and similar local-storage mechanisms strictly to keep users signed in, remember in-app preferences (such as theme, density, and dashboard layout), and protect the application from abuse. We do not run advertising cookies or cross-site tracking on the AgencyCommand application.

AgencyCommand is intended for business users and is not directed to children. We do not knowingly collect personal information from anyone under 13 years of age. If you believe a child has provided us with personal information, please contact us so we can investigate and delete it.

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page and, where appropriate, notify agency admins through the application. Continued use of AgencyCommand after the effective date constitutes acceptance of the updated policy.

Questions about this Privacy Policy or AgencyCommand’s privacy practices can be sent to support@agencycommand.app.