• You: name, email, phone, role, agency and licence details, and your login activity.
• Business records: ACORD 130 submissions, payroll by class, loss runs, quotes, underwriting decisions and uploaded documents.
• Claim details: loss runs can include information about injured workers. We use it only to understand the risk.
• Technical: basic device, browser and security logs.

To run the platform, rate and underwrite submissions, manage agency appointments, keep accounts secure, meet insurance and legal record-keeping duties, and improve our rules. We do not sell personal information and we don’t use it for targeted advertising.

A small set of service providers under contract: Supabase (database and file storage, US East), Vercel (hosting), and Anthropic (AI guidance — see AI use & data). Carriers and programs see a submission when it is sent to them for a decision. We may disclose information when the law requires it.

Encryption in transit, access limited by role and agency, and an audit trail of changes. We follow the GLBA Safeguards Rule and state insurance data security laws as they apply to us, and we’ll notify affected people as those laws require if something goes wrong.

Your own details, you can remove. Ask us to delete or anonymise your name, email, phone and profile, and we will.

Insurance records, we must keep. Submissions, quotes, decisions, audit logs and policy records are kept for the period the law requires — generally five years or more under state insurance record-retention rules — because regulators and auditors need to see what happened and why.

So we do both. Where we can, we replace your identifiers in those records with a neutral placeholder (pseudonymise), so the record survives but no longer points to you. When the retention period ends, the records are deleted or fully anonymised.

You can ask to see, correct, download or delete your personal data, or appeal our answer to a request. Use the privacy request form or email privacy@workcompfinder.com. We’ll verify it’s you and reply within 45 days. If you are an insured or injured worker and an agency submitted your information, you can contact us too — we’ll coordinate with them.

RaterOS is for business use by adults. We don’t knowingly collect information from children, other than what may appear in an insurance record.

If this policy changes, we’ll update the date above and flag material changes in the app.