NextAgency Privacy Policy

1. Core Principles and Scope

As between Agency and Take 44, Agency owns Agency Data. Agency controls its Users and their permissions. Take 44 does not use Agency Data to market or solicit products or services directly to Agency’s clients or prospects for Take 44’s own account. Take 44 processes Agency Data to provide, maintain, improve, protect, bill for, and administer the Platform; comply with law; and carry out Agency’s instructions.

This Policy applies to Platform accounts, mobile applications, support, onboarding, email and calendar features, and similar Platform extensions. The Terms of Service (“TOS”), Mutual Non-Disclosure Agreement (“NDA”), and, where applicable, Business Associate Agreement (“BAA”) also govern. The BAA controls PHI to the extent of a direct conflict. The TOS’s governing-law, arbitration, venue, jury and class waivers, one-year claim period, liability limitations, and other applicable protections apply to this Policy and to disputes concerning Take 44’s handling of information. Nothing in this Policy expands Agency’s or a User’s rights or remedies, limits a defense or protection available to Take 44, or creates a contractual obligation beyond those expressly stated.

2. Information We Collect

2.1 Account and User Information

We may collect names, business and email addresses, telephone numbers, account roles, credentials, authentication information, preferences, support communications, and other information supplied when an account is created or administered.

2.2 Agency Data

Agency Data may include information about Agency, its Users, prospects, clients, policies, benefits, employees, contacts, carriers, commissions, general agents, sub-agents, communications, notes, tasks, documents, and other records. Agency determines what Agency Data it submits and is responsible for having the rights and permissions necessary to do so.

2.3 Payment Information

We and our payment service providers may process credit-card and debit-card information, ACH and bank-draft information, other electronic-payment details, billing addresses, full or partial account numbers, expiration dates, authorization information, and transaction records. Information may be entered through Take 44’s administrative portal or, when a customer requests assistance, provided directly to authorized Take 44 personnel for entry or transmission to a payment processor. We seek to limit our handling to what is reasonably necessary to administer payment, prevent fraud, maintain records, and comply with law.

2.4 Integrations and Connected Accounts

When Agency or a User connects an email account, calendar, enrollment platform, carrier, communications system, payment service, or other application, we may receive credentials or tokens, messages, attachments, metadata, contacts, calendar information, configuration information, and other data needed to provide the requested integration.

2.5 Usage, Device, and Log Information

We may collect IP addresses, device and browser information, dates and times, authentication events, pages or features used, actions taken, errors, diagnostic information, and approximate location derived from IP address. We use this information to operate, secure, troubleshoot, support, analyze, and improve the Platform and to maintain audit records.

2.6 Cookies and Similar Technologies

The Platform may use session and persistent cookies and similar technologies for authentication, preferences, security, performance, and Platform analytics. Blocking cookies may limit functionality. We do not sell Platform information or use it for third-party cross-context behavioral advertising.

3. How We Use Information

We may use information to: provide and administer accounts and features; authenticate Users; process payments; deliver messages and notifications; provide support, onboarding, migration, and training; maintain, test, secure, troubleshoot, and improve the Platform; develop new features; analyze use in aggregated or de-identified form; prevent fraud, abuse, and security incidents; enforce agreements; comply with legal obligations; and communicate about the Platform, maintenance, services, and account matters.

Take 44 may create and use aggregated or de-identified information that does not reasonably identify Agency, a User, client, or prospect for lawful business, research, security, analytics, and product-improvement purposes. PHI will be de-identified or aggregated only as permitted by the BAA and applicable law.

4. Email, Calendar, and Provider-Specific Requirements

When Agency enables an email or calendar feature, Agency authorizes Take 44 and the providers facilitating that feature to process connected-account data as necessary to provide, secure, maintain, and support the feature. Take 44 may change the provider facilitating the feature and need not identify that provider in the user-facing feature name. Each provider is responsible for its own services, systems, acts, omissions, security, availability, and compliance with the obligations applicable to its role. Take 44 is not responsible for a provider’s acts, omissions, outages, security incidents, or other failures, except to the extent responsibility cannot lawfully be disclaimed or is expressly imposed on Take 44 by an applicable BAA.

If Agency authorizes transmission of data from the Platform to a third-party account or service selected by Agency, the recipient’s terms and privacy practices govern the recipient’s subsequent handling.

Where Take 44 receives data originating from Google APIs, Take 44 will handle that data as required by the Google API Services User Data Policy, including its applicable Limited Use requirements. Such data will be used only to provide or improve the applicable user-facing feature, protect the feature or its users, comply with law, or for another purpose permitted by that policy. Take 44 does not use connected Google data for advertising or permit human access except with the user’s affirmative permission for specific data, when necessary for security or abuse investigation, when required by law, or as otherwise permitted by the applicable Google policy. If an applicable Google policy requires affirmative consent before a new or changed use of Google-originating data, Take 44 will obtain that consent before beginning the use. These provider-specific requirements apply only to data originating from Google APIs and do not create additional restrictions on other Agency Data.

5. How We Disclose Information

5.1 Agency and Authorized Users

We disclose information within Agency according to the roles and permissions established through the Platform. Agency’s designation of Agency Administrators, their authority to act for and bind Agency, and Agency’s responsibility for their actions are governed by Section 2.3 of the TOS.

5.2 Take 44 Service Providers

We may disclose information to hosting, communications, payment, integration infrastructure, analytics, support, security, artificial-intelligence, professional, insurance, and other service providers that perform functions for Take 44. Depending on the Platform features enabled and the information submitted, connected, or made available by Agency and its Users, these providers may process information reasonably related to the functions they perform. Take 44 authorizes providers acting on its behalf to process information to perform those functions and for related security, support, administration, legal-compliance, and other purposes permitted by their applicable agreements and law. Each provider is responsible for its own services, systems, acts, omissions, security, and compliance with the obligations applicable to its role. We may change providers as the Platform evolves. For PHI, the BAA’s subcontractor requirements apply.

5.3 Agency-Authorized Third Parties

We may disclose Agency Data when Agency or a User with appropriate authority enables an integration, requests a transmission, or otherwise directs the disclosure. Agency’s direction constitutes its instruction and authorization for Take 44 to make the disclosure. If the disclosure includes PHI, Take 44 will handle the disclosure in accordance with the applicable BAA. Agency is responsible for determining that the disclosure is lawful, that the recipient is authorized to receive the information, and that Agency has any agreement required with an Agency-selected recipient. An Agency-selected recipient does not become Take 44’s service provider or subcontractor merely because Take 44 transmits information at Agency’s direction. Take 44 is not responsible for the recipient’s acts, omissions, security, availability, or information practices after the information leaves Take 44’s control.

5.4 Legal, Safety, and Enforcement Reasons

We may preserve or disclose information when we reasonably believe doing so is necessary to comply with law, regulation, legal process, or governmental request; protect the rights, safety, or property of Take 44, Agency, Users, or others; investigate or prevent fraud, abuse, security threats, or technical problems; enforce agreements; or establish or defend legal claims. Except to the extent preservation or a different retention period is required or reasonably necessary for one of those purposes, the applicable access, retention, and deletion provisions of the TOS control Agency Data. More specific requirements in an applicable BAA or other controlling legal obligation govern PHI and other specially regulated information.

5.5 Corporate Transactions

We may disclose or transfer information in connection with a financing, merger, acquisition, reorganization, bankruptcy, sale of assets, change of control, or similar transaction, subject to applicable contractual, confidentiality, and legal requirements.

Take 44 does not sell Agency Data or sell or share personal information for cross-context behavioral advertising, as “sell,” “share,” and “cross-context behavioral advertising” are defined under applicable privacy law.