Privacy policy

InsureBloc is a customer relationship manager used by insurance agents and advisors in Hong Kong. This policy explains what personal data we hold, why we hold it, who else handles it, how long we keep it, and what you can do about it. It is written to meet the Personal Data (Privacy) Ordinance (Cap. 486) (“the Ordinance”).

We hold two kinds of personal data, and our role is different for each. For an agent’s own account details, we decide how the data is used, so we are the data user under the Ordinance. For the records an agent keeps about their prospects, recruits and clients, the agent is the data user. We only store and process those records on the agent’s behalf, as a data processor.

To create an account you must give an email address and a password. Before you start using the service we also ask for your full name, a mobile number and a backup email, which we need to secure and recover your account. We cannot provide an account without these. Anything else you tell us about yourself is optional.

While you use the service we also record the devices and browsers you sign in from, the IP address and time of security events such as sign-ins and password changes, and your language and year settings. If you turn them on, we hold a two-step verification secret and the link to the Google account you connect for Sheets export.

Your password is stored only as a hash, and two-step secrets and Google tokens are encrypted, so we cannot read them.

Agents record the people they deal with: typically a name, phone number, email and notes about conversations, and sometimes a date of birth, address or the products discussed. You may have given these to the agent directly, handed over a business card, or filled in the agent’s “Add me” form. Filling in that form is voluntary, and what you enter goes only to that agent.

The agent decides what to record and is responsible for how it is used. InsureBloc stores it on the agent’s behalf, and only that agent can see it. No other agent, including others in the same agency, has access. We do not contact you, and we do not use your details for any purpose of our own.

To see, correct or delete what an agent holds about you, ask that agent. See “Your rights” below.

If you enter your email to start signing up, or send us a team enquiry with your name, email and (optionally) mobile number, we keep those details to continue your sign-up or to reply to you. Giving them is voluntary; without them we cannot reply.

We use personal data only to provide and secure the service: to show an agent their own records and remind them to follow up, to sign people in and protect their accounts, to send account and security emails, to reply to enquiries, and to meet legal obligations.

We do not sell personal data, and we do not share it with insurers or advertisers.

We do not use personal data for direct marketing. If we ever want to send you marketing, we will ask for your consent first, as Part 6A of the Ordinance requires, and you will be able to withdraw it at any time, free of charge.

When an agent photographs a business card, the image is sent once to Google’s Gemini service to read the text. InsureBloc does not store the photo. Only the details read from it (such as name, phone numbers, email and company) are saved to the agent’s records.

We use service providers to run InsureBloc. They handle personal data only to provide their service to us:

• Vercel, which hosts the application on servers in Singapore.
• Neon, which hosts the database.
• Google, which reads business-card photos through its Gemini service and, only if an agent connects it, receives the records that agent exports to their own Google Sheets.
• Resend, which delivers our account and security emails.

These providers and their servers are outside Hong Kong, so personal data is stored and processed outside Hong Kong. We do not give personal data to anyone else unless the law requires it.

Authorised InsureBloc staff can open an agent’s account in a read-only view to provide support or investigate a problem. They cannot change or export data in that view, and every such access is logged with who did it and when.

Passwords are hashed, stored secrets are encrypted, connections are encrypted in transit, and accounts can be protected with two-step verification. Agents can see every device signed in to their account, sign any of them out, and review a log of security events. Each agent’s records are isolated from every other agent’s.

No system is perfectly secure. If a security incident affects your personal data, we will tell the affected account holders without undue delay and explain what happened and what we are doing about it.

• Account details and an agent’s records are kept for as long as the account is open. Deleting a record removes it. Deleting an account permanently removes its leads, timelines, to-dos and connected settings straight away.
• A record that our staff accessed or reset an account is kept after the account is deleted, without the account’s contents, so the audit trail stays complete.
• Security log entries are deleted after 90 days.
• Expired sign-in sessions, and used or expired password-reset and email-verification links, are deleted within a day. Counters that limit repeated attempts, which can include an IP or email address, are deleted after a day.
• Enquiries and unfinished sign-ups are kept until they have been dealt with. We review them at least once a year and delete those we no longer need, and we delete them sooner if you ask.
• Deleted data may remain in our database provider’s short-term backups until those are overwritten.

We use only the cookies the service needs to work: one that keeps you signed in, one that holds a two-step sign-in while it is in progress, and two that remember your language and the year you are viewing. We do not use advertising or analytics trackers.

If an agent captures a lead while offline, it is held in their browser’s storage until it can be sent, and it is cleared when they sign out.

Under the Ordinance you may ask whether we hold personal data about you, ask for a copy of it, and ask us to correct it.

If you have an account, you can see and correct your details in Settings, download everything in your account, or delete the account at any time. You can also write to us using the contact details below.

If an agent holds your details, please send your request to that agent, who is the data user. If you write to us instead, we will pass your request to the agent where we can identify them, and help them respond.

We respond to access and correction requests within 40 days, as the Ordinance requires. You may also contact the Office of the Privacy Commissioner for Personal Data (pcpd.org.hk).

InsureBloc is a business tool and is not intended for anyone under 18. We do not knowingly open accounts for them.

We will post any change on this page and update the date at the top. If a change materially affects how we use account holders’ personal data, we will tell them by email or in the app before it takes effect.

Requests to access or correct personal data, and questions about this policy, go to: the Privacy Officer, InsureBloc, at jeron@insurebloc.xyz.

If the English and Chinese versions of this policy differ, the English version prevails.