Privacy Policy
Last updated: September 15, 2026
This policy explains what ZemSignal ("we", "us") collects, why, and what choices you have. ZemSignal is an embeddable property-risk widget that insurance and real estate agents ("agents") place on their own websites. Two different relationships are covered here:
- For agents (our account holders) — we are the controller of your account information and decide how it's handled; this policy governs that directly.
- For people who use the widget on an agent's site (address lookups and submitted leads) — we act as a service provider on behalf of that agent. The agent controls that data and it is delivered to them. If you submitted your details through a widget and want them changed or removed, contact the agency whose site you used; we will help them action it.
What we collect
From agents (account holders)
- Account and profile: name, work email, agency or brokerage name, phone (optional), password (stored hashed, never in plain text).
- Configuration you enter: allowed website domains, branding, contact fields, service area.
- Billing: handled by Stripe. We store a Stripe customer reference and your plan and subscription status — we do not store card numbers.
- Support correspondence and product-usage records (e.g. lookup counts) needed to operate your account and enforce plan limits.
From visitors who use the widget on an agent's site
- The property address entered, used to look up public risk data for that location.
- If the visitor chooses to submit the lead form: their name, email, and/or phone number, plus the risk summary shown at that moment.
- Limited technical data with each widget request — IP address, timestamp, and the website domain the request came from — used only to apply rate limits, enforce each agent's allowed-domain list, and prevent abuse. It is not used to build a profile of the visitor or to track them across sites.
The widget sets no advertising or cross-site tracking cookies and loads no third-party analytics or ad scripts on the agent's site. Our own dashboard (for signed-in agents) uses a single session cookie that is strictly necessary to keep you logged in.
Anonymous search records
If a visitor enters an address but does not submit their contact details, the agent may still see that a search was performed on that address, so they can gauge interest in their service area. These records contain the address and the risk result only — no name, email, phone, or IP, and nothing that identifies the visitor — and are deleted after 60 days. Agents can turn this off for their account.
How address lookups work
To produce a report, the entered address is sent to a geocoding service and to public government data sources — FEMA (flood), NOAA NCEI (storm history), USDA Forest Service (wildfire), USGS (seismic), EPA (radon), and USACE (levees). Results are cached by location (not by visitor) to reduce load on those public services. Source-specific refresh intervals are on our methodology page.
How we use and share information
- To deliver leads to the agent. Submitted contact details and the risk snapshot go to the agency whose website the widget was on. They own that lead.
- Service providers ("subprocessors") who help us run the product, under contract and only for that purpose: Stripe (billing), our transactional email provider (account and lead-notification emails), our hosting and infrastructure providers, and Cloudflare (DNS, email routing, network security). A current list is available on request.
- Legal and safety. To comply with law, enforce our terms, or protect the rights and safety of users and the public.
- Business transfer. If ZemSignal is acquired or merged, information may transfer as part of that transaction; the successor will remain bound by this policy or provide notice of changes.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
Data retention
- Agent account data: kept while the account is active and for a limited period afterward to handle billing, disputes, and legal obligations, then deleted or anonymized.
- Leads: retained for as long as the agent's account is active. If an agent closes their account or asks us to delete their leads, we do so within 30 days unless they've already exported the data (it is then theirs to hold under their own policy). This is currently a manual process handled by request — email us to close an account or delete data.
- Anonymous search records: 60 days.
- Cached government-data lookups: retained only as long as needed to avoid redundant upstream calls.
Your rights
Depending on where you live (including California, Colorado, Connecticut, Virginia, and other US states with privacy laws, and the EU/UK), you may have the right to access, correct, delete, or port your personal information, and to appeal a decision about a request.
- If you're an agent: email privacy@zemsignal.com and we'll action it directly.
- If you used a widget on an agent's site: contact that agency — they control the data. Point them to privacy@zemsignal.com and we will help them fulfill the request.
We respond to requests within 30 days. We do not discriminate against anyone for exercising these rights.
Security
We use reasonable technical and organizational safeguards — encryption in transit, hashed passwords, scoped per-account access, and least-necessary data collection. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Children
The service is for licensed/operating professionals and is not directed to children. We do not knowingly collect personal information from children under 13.
Changes to this policy
We may update this policy. Material changes will be posted here with a new "last updated" date and, for agents, notified by email.
Contact
Questions or a request about your data: privacy@zemsignal.com.