Privacy Policy

About this policy

This policy explains how Coverbound ('we', 'our' or 'us') collects, uses, shares and protects personal information when you visit coverbound.co, use our free tools or use the Coverbound platform. Coverbound is a trading name of Risk Monitor Pty Ltd (ACN 158 218 994), a company registered in Australia.

We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth). For people in the United Kingdom, we also follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

'Personal information' (called 'personal data' in the UK) means information about an identified or reasonably identifiable person. It doesn't include information that has been aggregated or anonymised so that no one can be identified.

We may update this policy from time to time. The date at the top shows when it last changed. If a change is significant, we'll tell account holders by email before it takes effect.

Two kinds of data we hold

Information about you. When you visit our website, sign up, use our free tools or talk to us, we decide how your personal information is used. For UK GDPR purposes we are the controller of this information. Most of this policy is about this kind of data.

Information brokers put into Coverbound. Brokerages use Coverbound to manage their clients' insurance. That can include personal information about their clients, their clients' staff and other people named in proposal forms, policies, claims, emails and meeting recordings. Clients may also give information directly, when they answer a questionnaire, use the client portal, sign a document or report a claim through a link from their broker. For this information, the brokerage decides how it is used and we process it on the brokerage's behalf, under our Data Processing Agreement with them. For UK GDPR purposes the brokerage is the controller and we are its processor. If you are a broker's client and have a question about your information, please contact your broker first. We will help them respond.

What we collect

• Contact and account details: your name, work email, phone number, job title, brokerage name and login details.
• Billing details: billing contact and address, and payment records. Card details are handled by our payment provider; we don't store full card numbers.
• What you send us: support requests, feedback, emails and anything you tell us in a demo or meeting.
• Files you upload: for example, documents uploaded to the platform.
• Your client's details, if you send a free fact finder before signing up: your client's business name, and the name and email address of the person who will answer it, so the fact finder is ready to send from your account once you sign up.
• Usage and device data: IP address, browser and device type, pages viewed, links clicked, and the date and time of your visit.
• Information from public sources: when a broker uses Coverbound to research a business, we read public sources such as the business's website, the Australian Business Register and Companies House. These can include the names and roles of people at that business.

We don't ask for sensitive information (such as health information) about you. Brokers may put sensitive information about their clients into Coverbound where it is needed to arrange insurance. We handle it under our agreement with the brokerage.

You don't have to give us personal information. If you don't, we may not be able to give you an account or answer your request. Where the law allows and it's practical, you can contact us without identifying yourself.

How we collect it

• directly from you, when you fill in a form, sign up, upload a file, email us or use the platform
• automatically, through cookies and similar technologies when you use our website and platform (see Cookies below)
• from your brokerage, if it invites you to use Coverbound
• from public sources, as described above.

Why we use it, and our legal basis

UK law requires us to give a legal basis for each use. Australian law requires us to use information only for the purpose we collected it, or a related purpose you would reasonably expect.

• To provide our website, tools and platform, set up and run your account, and bill you. Basis: to perform our contract with you or your brokerage.
• To support you and send service messages, such as security alerts, changes to our services and replies to your questions. Basis: contract, and our legitimate interest in running a reliable service.
• To keep our services secure and prevent fraud, abuse and spam. Basis: our legitimate interest in protecting our services and users.
• To understand how our website and services are used and improve them. Basis: our legitimate interest in improving our services.
• To send marketing about Coverbound. Basis: your consent, or, for existing customers in the UK, our legitimate interest in telling you about similar services (the PECR 'soft opt-in'). You can opt out at any time.
• To meet legal obligations, such as tax and accounting records, and to respond to lawful requests. Basis: legal obligation.

We use AI to read documents and draft work for brokers. We don't use AI or any other automated process to make decisions about you that have legal or similarly significant effects. Brokers review and approve what Coverbound drafts.

Cookies

Cookies are small files a website stores on your browser or device. Most of ours are essential: they keep you logged in, remember your settings (including your cookie choice) and protect forms from bots (we use Cloudflare Turnstile for this). These are needed for the site to work, so we don't ask for consent.

We also use LinkedIn's Insight Tag on our website and platform. If your browser is set to an Australian time zone, where the law doesn't require consent for it, we set it for that visit unless you turn it off. Otherwise, including in the UK and the EU, we only set it if you accept. It sets cookies that tell us which of our LinkedIn ads brought you to us and whether you went on to try our free tool or create an account. LinkedIn receives details such as the page you visited, your browser and your IP address. It may link them to your LinkedIn account. We only see totals, never who you are. LinkedIn handles this under its own privacy policy. Wherever you are, you can change your choice at any time with Cookie settings at the bottom of our website.

We don't use any other advertising or tracking cookies. To count visits, we use Cloudflare Web Analytics, which doesn't set cookies, doesn't track you across other websites and doesn't build a profile of you. It records basic details such as the page viewed, the referring site, your country and your browser type.

Where the LinkedIn cookie is on, we also keep a first-party cookie called cb_attr for 30 days. It records the campaign tags in the link that brought you (such as utm_source or gclid) and the page you landed on, so we know where sign-ups come from. Without it, we keep the same details for your visit only, in your browser's session storage. Neither is used to build a profile of you or to follow you across other websites. We also count views of our free templates and clicks on their buttons, without cookies.

You can block or delete cookies in your browser settings. Blocking essential cookies may stop parts of the site working.

Who we share it with

We don't sell personal information. We only share it with:

• LinkedIn, only while its cookie is on, to measure our LinkedIn ads (see Cookies above).
• Service providers who help us run Coverbound, such as cloud hosting, AI processing, email delivery, payments, analytics, bot protection and customer support. They may only use the information to provide their service to us. Our sub-processor list names the providers that process brokers' data.
• Your brokerage, if your account belongs to one.
• Professional advisers, such as lawyers, accountants and auditors.
• Regulators, courts and law enforcement, where the law requires it or we need to establish, exercise or defend legal claims.
• A buyer or investor, if all or part of our business is sold or restructured. They must protect the information in line with this policy.
• Anyone else with your consent.

Overseas transfers

Our service providers store and process information in other countries. Our data is stored in the United States. Our AI provider, Google, may process information in any country where it operates, and Cloudflare runs a global network. Our staff, who may access information to support customers and run Coverbound, are based in Australia.

Before we send personal information overseas, we take reasonable steps to make sure the recipient handles it in line with the Australian Privacy Principles. For information about people in the UK, we only transfer it to countries the UK recognises as giving adequate protection, or under safeguards approved under UK law, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of these safeguards.

Security

We protect personal information with technical and organisational measures, including encryption in transit, access controls limited to staff who need it, and monitoring of our systems. No system is perfectly secure, but we work to keep risks low.

If a data breach is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme. For people in the UK, we will notify the Information Commissioner's Office (ICO) and affected people where UK GDPR requires.

How long we keep it

• Account information: while your account is open, then for as long as needed to close it properly, resolve disputes and meet legal obligations.
• Billing and tax records: for the period tax and accounting law requires (generally 5 to 7 years).
• Free fact finders: if you start sending a fact finder before you have an account, your client's details are kept for 7 days, then deleted if you haven't signed up. When you sign up, they move into your account. We never contact your client unless you press Send.
• Information brokers put into Coverbound: as set out in our agreement with the brokerage, and deleted or returned when that agreement ends.
• Marketing: until you unsubscribe. We keep a record of the opt-out so we don't contact you again.

When we no longer need personal information, we delete it or anonymise it.

Your rights

You can ask us to:

• access the personal information we hold about you and give you a copy
• correct information that is wrong, out of date or incomplete
• stop sending you marketing, at any time, by using the unsubscribe link in any marketing email or by contacting us.

If you are in the UK, you can also ask us to:

• delete your personal data
• restrict how we use it
• give your data to you, or to another organisation, in a machine-readable format
• stop using it, where we rely on legitimate interests
• withdraw your consent, where we rely on consent. This doesn't affect anything we did before you withdrew it.

To use any of these rights, email us at the address below. We may need to confirm your identity first. We will respond within 30 days (or one month in the UK) and won't charge you, unless a request is clearly unfounded or excessive. If we refuse a request, we'll explain why.

Complaints

If you're unhappy with how we've handled your personal information, please email us first. We will acknowledge your complaint within 7 days, look into it and give you our response within 30 days.

If you're not satisfied with our response, you can complain to a regulator:

• in Australia, the Office of the Australian Information Commissioner at oaic.gov.au
• in the UK, the Information Commissioner's Office at ico.org.uk.

Contact us

For any privacy question, request or complaint, email hello@coverbound.co with 'Privacy' in the subject line.