Privacy Policy
Last updated August 29, 2026
We handle sensitive information — insurance leads, client contact details, and production data. This policy describes what we collect, how it's protected, and the choices you have.
1. Who this covers
This policy explains how Diamond OS handles two kinds of information: data about our customers (the agents and agency owners who hold accounts), and data our customers enter about their own contacts and clients.
For customer account data we act as the controller. For contact and client data entered into a workspace, our customer is the controller and we act as their processor.
2. Information we collect
Account information: name, email address, workspace and role, authentication records, and billing identifiers returned by our payment processor. We never see or store full card numbers.
Workspace content: the records you create — contacts, leads, appointments, entries, notes, policies, tasks, and configuration.
Usage information: pages visited, actions taken, feature and AI usage counters, and technical logs used for security, debugging, and billing.
3. How client PII is protected
Contact phone numbers and email addresses are encrypted at rest using AES-256-GCM. For duplicate detection and lookup we store keyed HMAC tokens derived from the normalized value rather than the plaintext, so matching works without exposing the underlying data.
Integration credentials and API keys are encrypted at rest and are never returned to the browser — administrators only ever see a masked preview.
Access is enforced server-side against each workspace's member roster and role permissions. Data is isolated per workspace; hiding data in the interface is never the only control.
4. How we use information
To provide and operate the Service; to authenticate users; to process payments and enforce plan limits; to send transactional messages such as invites, trial and billing notices, and alerts; to provide support; to secure the platform and investigate abuse; and to improve features in aggregate.
We do not sell personal information, and we do not use your workspace content to train third-party AI models.
5. AI processing
When you use AI-assisted features, the prompt and the context you supply are sent to our AI provider to generate a response. Do not paste client identifiers or sensitive personal data into AI prompts unless necessary. AI features do not have access to your workspace's training scripts or unrelated records.
6. Sub-processors
We rely on service providers to operate the platform, including cloud hosting and database infrastructure, Stripe for payments, an email delivery provider for transactional email, and AI model providers. Integrations you connect yourself — such as calendaring, spreadsheet, telephony, and messaging tools — receive only the data required for that integration.
7. Data retention and deletion
We retain workspace data for as long as your account is active. When a trial or subscription lapses, data is preserved in a read-only state rather than deleted, so you can restore access.
You may delete individual records at any time, and request deletion of your account and workspace data. Some records may persist in backups or in audit and compliance logs for a limited period, or where retention is legally required.
8. Do-not-call and marketing compliance
The platform provides DNC list ingestion, suppression, and audit tooling. Suppressed contacts are flagged with a reason and excluded from queues and exports. You remain responsible for maintaining lawful consent and honoring opt-out requests.
9. Your rights
Depending on where you live, you may have rights to access, correct, export, or delete personal information we hold about you, and to object to or restrict certain processing. Contact us through your workspace's Help & Guide to make a request. If your data was entered into a workspace by an agency, direct your request to that agency as the controller.
10. Security incidents
We maintain administrative, technical, and organizational safeguards appropriate to the sensitivity of the data we handle. If a breach affecting your data occurs, we will notify affected workspace owners without undue delay and describe the scope and our response.
11. Children
The Service is not intended for anyone under 18 and we do not knowingly collect information from children.
12. Changes and contact
We may update this policy as the platform evolves; material changes will be communicated to workspace owners. Questions can be sent through the support channel listed inside your workspace under Help & Guide.
This document is provided as a starting point and does not constitute legal advice. Have it reviewed by a licensed attorney before you begin selling.