Privacy Policy

Information You Provide Directly: Name, email address, phone number, mailing address, property address, insurance policy information, and account login credentials (username and password for the ContentsClaims platform — not your email provider credentials). A phone number is required for homeowner and adjuster accounts so we can reach you about your account and claim; providing it does not by itself sign you up for text messages (see "Phone Numbers — SMS Consent" below).

Email Account Credentials: When you connect an email account, you provide either: (a) an app-specific password generated by your email provider (Gmail, Yahoo, AOL, iCloud), which is a limited-purpose credential separate from your main account password; or (b) a Microsoft OAuth2 authorization token (for Outlook/Hotmail/Live). We do not receive or store your primary email account password under any circumstances. App-specific passwords are stored in encrypted form and kept only as described in §7. OAuth2 tokens are stored encrypted and can be revoked at any time through your email provider's account settings.

Email Content Retrieved During a Scan: When you connect an email account, our systems search it for likely purchase records (such as order confirmations, receipts, invoices, and warranty documents), principally using subject-line keywords, and retrieve candidate emails and their attachments. With some providers, if that search finds nothing, our systems retrieve messages within the scan's date range more broadly and filter them after retrieval. Depending on how your provider organizes folders, the search may also reach sent messages or drafts. Some retrieved emails may turn out not to be purchase-related and can include personal correspondence, banking, medical, or other mail. Retrieved emails and attachments are processed with automated tools — which can include third-party AI services, for example to read the text of a scanned PDF attachment — both before and after our system decides which emails are purchase-related. Your report is built from the purchase records our system identifies. Message text and attachment content retrieved during a scan are stored with your project (encrypted at rest where our processing pipeline supports it) and are deleted no later than when your project data is deleted, as described in §7; some of it is deleted earlier, for example when a scan completes. We also keep limited technical records about retrieved emails — such as header information (sender, subject line, date), classification results, details our system detected (such as product or order identifiers), and fingerprints (hashes). These technical records are deleted with your project data. Authorized staff can see subject lines in internal troubleshooting tools; our tools do not display message text to staff. We use your email access to read email during scan sessions you initiate; we do not conduct ongoing or background monitoring of your inbox.

AI Processing of Email Data — PII Disclosure: Email content retrieved during a scan — principally the purchase records our systems identify, and in some cases attachments of candidate emails before they are classified (for example, scanned PDFs read by an AI text-recognition service) — is transmitted to third-party AI API providers for classification, structuring, and analysis to generate your claim inventory. ContentsClaims may use any AI provider at its discretion — including but not limited to OpenAI, Anthropic, Google, open-source or self-hosted models, or other providers — and may change providers at any time. These providers receive the full text content of purchase emails — such as order confirmations and receipts — which may contain personally identifiable information including your name, billing address, shipping address, and email address embedded in those purchase records. AI providers do not receive your email login credentials or primary account password. ContentsClaims works to obtain appropriate data processing agreements or contractual protections with AI API providers; where such agreements are not yet finalized, ContentsClaims implements alternative safeguards or restricts the data transmitted. Each provider's data handling is governed by its own published privacy policy and API usage terms. ContentsClaims does not independently control or warrant any AI provider's internal data retention or usage practices beyond what they publicly disclose. ContentsClaims does not sell or license your data to anyone for AI training purposes, and does not permit third-party AI providers to use it to train their models where the provider's API terms allow us to opt out. By using the Service, you acknowledge and consent to the transmission of retrieved email content, which may contain personally identifiable information, to AI API providers as necessary to generate your claim documentation. Separately, if you use our in-app support chat, the messages you type and basic project context (such as your project name) are sent to an AI provider (currently Anthropic) to generate replies, and report summaries may be generated by sending report figures (such as totals, categories, and retailer names) to an AI provider.

Payment Information: Payment card details are collected and processed exclusively by Stripe, Inc., a PCI-DSS Level 1 certified payment processor. ContentsClaims does not store full card numbers, CVV codes, or complete cardholder data on our systems. We retain billing records (transaction amounts, dates, status, and last-four card digits) for accounting, dispute resolution, and legal compliance purposes.

Usage and Device Data: IP addresses, browser type and version, operating system, device identifiers, pages visited, session duration, referring URLs, and clickstream data are automatically collected when you visit or use the Service.

IP Address and Geolocation: We collect your IP address automatically upon each visit to the Service, including before you create an account. We use IP addresses to infer approximate geographic location (city and region level — not street-level or GPS-level precision) through a third-party geolocation service (ip-api.com). IP addresses are personal information under applicable law. Geolocation data derived from IP addresses is used for: fraud prevention, regulatory compliance verification (confirming U.S.-based access), platform security, and aggregate analytics. We do not collect device GPS location.

Phone Numbers — SMS Consent: Text messages are sent only if you separately check an SMS consent box; consent is not a condition of using the Service. If you check the SMS consent box, you consent to receive text messages as described in our Terms of Service §2. If you register as an Adjuster Partner and check the SMS consent box, you additionally consent to fire incident alerts and adjuster-program notifications as described in our Terms of Service §2. If you change the phone number on your account, text-message consent for that account is turned off until you give it again for the new number.

ContentsClaims uses the information we collect for the following purposes:

• Providing, operating, securing, and improving the Service;
• Accessing and processing email accounts to generate insurance claim documentation reports;
• Transmitting retrieved email content and attachments (principally purchase records), and data extracted from them, to AI API providers to classify them and generate structured claim inventories;
• Processing payments and managing your account;
• Communicating with you about your account, reports, security, and Service updates, including through our AI-assisted support chat;
• Sending SMS notifications to users who have provided express written consent (see Terms of Service §2);
• Providing registered adjusters with a feed of public fire-incident information, and mailing informational postcards to owners of fire-affected properties (see §4);
• Verifying your identity, detecting fraud, and preventing unauthorized access;
• IP-based geolocation for fraud prevention, regulatory compliance, and security monitoring;
• Logging adjuster and professional partner platform activity for compliance and audit purposes;
• Complying with legal obligations and responding to lawful requests from government authorities;
• Defending legal claims, enforcing our Terms of Service, and protecting ContentsClaims' rights;
• Improving our extraction systems and Service features using de-identified or aggregated data.

What We Use: We use cookies and similar tracking technologies for: authentication (session tokens), security (CSRF protection and bot checks), and payment processing (Stripe fraud detection). We do not use advertising cookies or third-party analytics cookies. See our Cookie Policy for the full cookie inventory.

Global Privacy Control (GPC): ContentsClaims treats a valid Global Privacy Control (GPC) signal as a request to opt out of the sale or sharing of personal information about the person using the browser. We do not sell or share (for cross-context behavioral advertising) information collected through your browser or your use of the Service, so honoring the signal requires no change to how that information is handled. We also do not sell or share property-owner information described in §4.

Do Not Track: The World Wide Web Consortium (W3C) has not established universal standards for browser-level Do Not Track (DNT) signals distinct from GPC. ContentsClaims does not separately respond to legacy DNT signals; as described above, we do not use tracking or advertising technologies that DNT is meant to control.

Third-Party Cookies: Stripe (payment fraud detection) and Cloudflare (network security, including the Turnstile bot check on sign-up) may set cookies subject to their respective privacy policies. See our Cookie Policy for details. IP geolocation (ip-api.com) is performed server-side and sets no cookies.

ContentsClaims does not sell personal information — neither that of its users (account holders), including your email content, purchase data, and reports, nor the property-owner information described below. We do not share personal information for cross-context behavioral advertising. We share information only as described below.

Fire Incident Feed for Adjusters: Registered, approved Adjuster Partners can view a feed of reported fire incidents compiled from publicly viewable emergency-dispatch and incident information, which we retrieve through automated means (including third-party proxy services). The feed shows the incident address, incident type, and time. It does not include property-owner names, phone numbers, email addresses, or mailing addresses, and we do not provide that information to adjusters or any other third party.

Property-Owner Postcards: ContentsClaims may mail one informational postcard about our Service to the owner of a property affected by a reported fire. Only when we prepare a postcard mailing do we obtain the owner's name and mailing address from a commercial data (skip-trace) vendor; the vendor may also return phone numbers or email addresses, which we store internally but do not use to contact property owners and do not provide to anyone. This information is not derived from ContentsClaims user accounts or users' email data, is not sold, and is shared only with service providers that help us send the mail (such as our mail-fulfillment provider). We do not text or email property owners who are not our users. To stop mail from us, property owners may use contentsclaims.com/optout or email privacy@contentsclaims.com with the mailing or property address; we keep a do-not-mail list that is checked before every mailing. Property owners may also ask us to delete the information we hold about them (see §10).

Public Fire Incident Articles: We publish blog articles about local fire incidents based on public incident information. These articles do not name property owners. To request removal of an article, contact privacy@contentsclaims.com.

Service Providers and Processors: We share data with vendors that help us operate the Service. Current categories of service providers include: cloud hosting and storage (Render, Cloudflare); offsite backups (RunPod — backups are encrypted before they are uploaded); a virtual-server provider used as a network relay for retrieving public incident data; email delivery (SendGrid); bot protection (Cloudflare Turnstile); error monitoring (Sentry); payment processing (Stripe); sales-tax calculation (TaxJar, where enabled); Outlook sign-in (Microsoft); AI processing APIs (third-party AI providers receive purchase email content which may include PII as described in §1, and support-chat messages — providers may change at our discretion); pricing and web-data services (ScraperAPI, which receives item descriptions and product identifiers from your purchases to look up current prices, and which we also use to retrieve public incident information); address geocoding (U.S. Census Bureau geocoder); internal operations alerts (Telegram, which may include fire-incident addresses); SMS delivery (Twilio); IP geolocation (ip-api.com); property-owner name and mailing-address lookups for postcards (a commercial skip-trace vendor, currently Tracerfy); and direct mail fulfillment and address verification (Lob). ContentsClaims does not currently maintain formal data processing agreements with all vendors. We work to obtain appropriate agreements where feasible; where we cannot, we implement alternative safeguards or discontinue that vendor for processing personal information.

Your Adjuster, Attorney, or Insurer: If you share a Generated Report with your public adjuster, attorney, or insurance carrier through the Service, we transmit the report and associated documentation as directed by you. You control this sharing.

Adjuster Partner Platform Activity: If you use the Service as a licensed Adjuster Partner, we log your platform activity (logins, report generation, client account access, fire feed views, referral activity) for compliance, security, and service quality purposes. This activity data may be reviewed by ContentsClaims in connection with regulatory inquiries, legal proceedings, or partner program compliance. Adjuster activity logs are retained for a minimum of 3 years.

Legal Process: We disclose personal information in response to valid legal process — including subpoenas, court orders, civil investigative demands, and government requests that we are legally compelled to honor. To the extent permitted by law and not prohibited by the terms of the legal process, we will endeavor to notify you before complying with a government request for your personal information. We will comply with all valid, legally issued process; however, we will review requests for legal sufficiency and may challenge overbroad demands.

Imminent Harm Disclosure: ContentsClaims may disclose personal information without prior legal process only when we have a reasonable, documented, good-faith belief that immediate disclosure to law enforcement is necessary to prevent imminent harm to the life or safety of a person. We will document the specific basis for any such disclosure. All other disclosures to law enforcement, insurance fraud bureaus, or government agencies require valid legal process.

Insurance Fraud Cooperation: ContentsClaims cooperates with law enforcement and regulatory authorities in response to valid legal process. If ContentsClaims identifies activity that reasonably suggests insurance fraud, we reserve the right to: (a) suspend the involved account, (b) preserve relevant records, and (c) comply with any applicable legal obligations. ContentsClaims does not proactively report users to insurers, fraud bureaus, or law enforcement absent valid legal process or an imminent harm situation as described above.

Business Transfers: If ContentsClaims is involved in a merger, acquisition, sale of all or substantially all assets, bankruptcy, or reorganization, your information may be transferred as part of that transaction. We will provide notice before your personal information is transferred and before it becomes subject to a materially different privacy policy.

Aggregate and De-Identified Data: We may share de-identified, aggregated statistics about Service usage and claim documentation patterns with business partners, investors, or the public for business and research purposes. This data cannot reasonably be used to identify any individual user.

ContentsClaims may use de-identified data derived from user interactions to improve the Service, train and refine our internal extraction and machine learning systems, develop new features, and conduct research.

ContentsClaims will not re-identify de-identified or aggregated data or attempt to link it back to any individual. ContentsClaims retains full ownership of all models, insights, and derivative works created from de-identified aggregate data.

The following table describes the categories of personal information ContentsClaims collects, the sources, business purposes for collection, and categories of third parties with whom we share or disclose it. ContentsClaims does not sell personal information as defined by the CCPA/CPRA, and does not share personal information for cross-context behavioral advertising. Information about people who are not our users (property owners and licensed adjusters we market to) is listed in the last two rows of the table.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. Property-owner information is described in §4.

Email Credentials: App-specific passwords are deleted from our active systems when your full email scan completes, and in any event when you confirm your claim submission, use the data-deletion option in your project, or request deletion. A password provided only for a free preview, or kept so we can finish an interrupted scan, is not deleted at that point; in those cases, and if a scan is abandoned, our systems purge the stored app-specific password automatically about 72 hours after it was provided (if a scan using it is still running at that point, right after that scan ends). You may also revoke an app-specific password at any time from your email provider's account settings, which immediately disables it regardless of anything stored on our systems, and you may request deletion of your stored credentials at any time. Any residual copies in our backups are purged in the ordinary course of our backup rotation (see "Backup Systems" below). Outlook (OAuth) tokens are deleted when a full scan completes, when you confirm your claim submission, or when you use the data-deletion option in your project. They are not covered by the 72-hour automatic purge, so otherwise they are kept until you revoke them via your email provider or request deletion from ContentsClaims.

Email Content and Extracted Purchase Data: Project data includes message text and attachment content retrieved during a scan, the purchase data extracted from it (item descriptions, prices, dates, merchants, order numbers), and any receipts or files you upload. Project data is deleted 90 days after your report is delivered to you (activity on the project after that can postpone the deletion), or sooner if you use the data-deletion option in your project — available at any time except while a scan is running — or request deletion, subject to legal hold obligations; some retrieved message text is deleted earlier, for example when a scan completes. If a scan does not complete, retrieved content may remain with your project until you request deletion; it is not deleted on a fixed schedule in that case. Technical records about retrieved emails (such as fingerprints and classification results) are deleted with your project data. The 90-day deletion and the data-deletion option also clear your project name, your loss address, the summary list of top items shown on your project page, error messages, and the email addresses and credentials you connected; city, state, ZIP and report totals are kept with your payment records. Payment and audit records are retained as described below.

Generated Reports: Reports are generated from your project data and are available only while that data is retained — 90 days after your report is delivered, or until you use the data-deletion option in your project or request deletion, whichever is earlier, subject to legal holds. Download and keep your own copies.

Payment Records: Billing and payment records are retained for at least 7 years for accounting and legal compliance purposes.

IP and Visitor Logs: IP address logs and associated geolocation data are retained for as long as reasonably necessary for security and fraud-prevention purposes. We do not currently apply a fixed automatic deletion period to these logs; you may request deletion of logs associated with your account as described in §10.

Property-Owner Information: Property-owner names and mailing details obtained for postcards are kept while needed for our mailing program and are deleted on request. Addresses on our do-not-mail list are kept so that we can continue to honor the request. Fire-incident records (address, incident type, and time) are kept as a historical incident database.

Adjuster Activity Logs: Platform activity logs for Adjuster Partners are retained for a minimum of 3 years for compliance and regulatory purposes.

Legal Holds: If ContentsClaims receives a subpoena, court order, regulatory demand, or has a reasonable basis to believe litigation or investigation may be imminent, ContentsClaims will implement a legal hold on all relevant data. A legal hold overrides the standard retention schedules above and remains in effect for the duration of the legal matter plus one year, or as otherwise ordered by a court. If a legal hold is in effect on your account and you request deletion, ContentsClaims will notify you of the hold and preserve your data until the hold is released. After the hold is released, your data will be deleted within 30 days per the standard schedule.

Backup Systems: Nightly database backups are encrypted (AES-256) before they are stored with an offsite backup provider whose storage may be located outside the United States (currently in the European Union), and may persist for up to 90 days following deletion from active systems. This window is necessary for data integrity and does not extend ContentsClaims' obligations under this Policy for service delivery purposes.

De-Identified and Aggregated Data: We retain the right to retain de-identified or aggregated data indefinitely for research, analytics, and AI model improvement, provided it cannot reasonably identify any individual.

ContentsClaims implements technical, administrative, and physical safeguards designed to protect the personal information we collect from unauthorized access, disclosure, alteration, and loss. Our current security practices include:

• Encryption of data in transit using TLS 1.2 or higher between your browser and our servers;
• Encrypted connections from our servers to most service providers; a small number of lookups, including IP-address geolocation lookups to ip-api.com, are currently sent over unencrypted connections;
• Encryption at rest of email credentials, and of retrieved email message text where our processing pipeline supports it; some other data, such as text read from email attachments, is not separately encrypted by our application;
• Encryption (AES-256) of nightly database backups before they are stored offsite;
• Encrypted storage of email credentials, with app-specific passwords deleted as described in §7;
• Access controls limiting administrative access to personal data to authorized personnel;
• Rate limiting, anomaly detection, and access logging for security-relevant events;
• Regular security reviews of our infrastructure and third-party service providers.

ContentsClaims is not SOC 2 certified. Our security practices are designed to be appropriate to the sensitivity of the data we handle, but we do not represent that we have obtained any specific third-party security certification. No security system is impenetrable. We cannot guarantee the security of our systems against all possible attack vectors. See our Terms of Service §9 for the liability limitations that apply in the event of a security incident.

Notification Obligation: In the event of a security incident that compromises the confidentiality, integrity, or availability of your personal information in a manner triggering notification obligations under applicable state or federal law, ContentsClaims will notify affected users as required by law. Notification will be provided via email to the address on file and/or via a prominent notice on our website, within the timeframes required by applicable law.

Notification Contents: Where required and permitted by law, our breach notification will include: (a) a description of the nature of the incident; (b) the categories and approximate volume of information involved; (c) steps we are taking to investigate and remediate; and (d) recommended steps you can take to protect yourself.

Liability Limitation: Compliance with breach notification obligations does not expand ContentsClaims' liability beyond the caps and limitations set forth in Section 9 of our Terms of Service, incorporated herein by reference. ContentsClaims' fulfillment of its notification obligations constitutes its complete obligation with respect to informing affected individuals, and does not create any additional duty to provide identity theft services, credit monitoring, or compensation beyond the liability cap.

Access and Portability: You may request a copy of the personal information we hold about you. We will provide this information in a commonly used electronic format; requests are currently handled manually.

Correction: You may request that we correct inaccurate personal information in our records.

Deletion: You may request deletion of your personal information, including any email content retained from an incomplete scan and the technical records about retrieved emails. We will fulfill deletion requests subject to: (a) legal retention obligations (including 7-year billing records and 3-year adjuster activity logs); (b) active legal holds; and (c) backup copies, which age out within up to 90 days (see §7). Deletion requests are currently processed manually; we will confirm completion of deletion from our active systems within 45 days. Property owners who are not our users may also request deletion of the information we hold about them by emailing privacy@contentsclaims.com with the property or mailing address.

Opt-Out of Marketing Communications: You may opt out of marketing emails at any time by clicking "unsubscribe" in any marketing email or contacting support@contentsclaims.com. Opting out of marketing does not affect transactional or security-related communications.

SMS Opt-Out: You may opt out of SMS messages at any time by replying STOP to any text message from ContentsClaims or by contacting support@contentsclaims.com. ContentsClaims currently sends all text messages from a single number, so replying STOP to any text from ContentsClaims stops further text messages from ContentsClaims to your number.

CCPA/CPRA Rights (California Residents): California residents have the right to: (1) know what personal information we collect, how we use it, and with whom we share it; (2) request deletion of personal information we collected directly from you, subject to legal retention exceptions; (3) correct inaccurate personal information we hold about you; (4) opt out of the sale or sharing of personal information (we do not sell personal information or share any personal information for cross-context behavioral advertising); (5) limit the use and disclosure of sensitive personal information, to the extent the CPRA provides that right (see "Sensitive Personal Information" below); and (6) non-discrimination for exercising these rights. To exercise CCPA/CPRA rights, you or your authorized agent (with written authorization or valid power of attorney) may submit a verifiable consumer request to privacy@contentsclaims.com or by certified mail to ContentsClaims LLC, 401 Ryland Street, Ste 200-A, Reno, NV 89502. We will respond to verifiable requests within 45 days, with one possible 45-day extension for complex requests (we will notify you of any extension). If we deny your request, you may appeal by contacting privacy@contentsclaims.com with subject line "Privacy Rights Appeal" within 45 days of receiving our denial. We will respond to appeals within 60 days.

Sensitive Personal Information (CPRA): Under CPRA, the following information we collect is classified as sensitive personal information: (a) account log-in credentials (email app-specific passwords and OAuth tokens); and (b) the contents of email messages retrieved from your connected account, which may include personal, financial, or health-related information. We use sensitive personal information to provide the Service — specifically, to access your email account, classify retrieved emails, and extract purchase data. We do not use sensitive personal information for inferring characteristics about you or for advertising, and we do not sell it. You may ask us to delete retained email content at any time (see "Deletion" above).

Do Not Sell or Share: ContentsClaims does not sell personal information — including property-owner information (§4) — and does not share personal information for cross-context behavioral advertising. You may still send a request to privacy@contentsclaims.com with subject line "Do Not Sell/Share Request" and we will confirm it. Property owners who want us to stop mailing them should use contentsclaims.com/optout or include the mailing or property address. See §3 regarding Global Privacy Control.

Residents of the following states have privacy rights under their respective state laws. To exercise any of these rights, contact privacy@contentsclaims.com with your state of residence and the right(s) you wish to exercise. We will respond as required by applicable law.

ContentsClaims does not sell personal information and does not share personal information for cross-context behavioral advertising. Property-owner information is described in §4, including how to stop mail. We treat universal opt-out signals (including GPC) as a request to opt out of the sale or sharing of personal information about the browser user, as described in §3.

Under Nevada Revised Statutes Chapter 603A, Nevada residents may opt out of the sale of certain covered information. ContentsClaims does not sell covered information, including the property-owner information described in §4. You may still submit an opt-out request to privacy@contentsclaims.com with subject line "Nevada Privacy Rights" or "Do Not Sell/Share Request" (property owners: include the property address); either subject line is handled the same way.

ContentsClaims does not knowingly collect personal information from children under 13 years of age. The Service is intended only for users 18 years of age or older. If we become aware that we have inadvertently collected personal information from a child under 13, we will take prompt steps to delete such information. If you are a parent or guardian and believe your child has provided us with personal information, contact privacy@contentsclaims.com immediately.

Household members under 18. An account holder who is the parent or legal guardian of a household member aged 13 to 17 may connect that minor's email account, only with the minor's agreement and only to document household personal property for an insurance claim (see Terms of Service §2). The email accounts of children under 13 may not be connected. Information from a minor's account is accessed, used, and retained on the same terms as any other connected account (see §1 and §7) and is not sold. A parent or guardian — or the minor — may ask us to delete data derived from a minor's account at any time by contacting privacy@contentsclaims.com.

ContentsClaims is based in the United States and processes data primarily in the United States. Some service providers (including our offsite backup provider, which receives only encrypted backups, and certain AI API providers) may store or process data outside the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the United States and in the other locations where our service providers operate. U.S. privacy laws may differ from the laws of your home jurisdiction. By using the Service, you consent to the transfer, processing, and storage of your information in the United States and in those other locations as described in this Policy. ContentsClaims does not currently offer services to European Union residents and does not have a GDPR compliance program; EU residents should not use this Service.

The Service may contain links to third-party websites or services. ContentsClaims does not control and is not responsible for the privacy practices, content, or security of any third-party site. ContentsClaims expressly disclaims all liability for the privacy or security practices of third parties. Please review the privacy policies of each third-party site or service before providing personal information.

ContentsClaims may update this Privacy Policy from time to time. Material changes will be communicated by posting the updated Policy on this page with a revised "Last Updated" date and by sending notice to the email address on your account. For changes that materially alter how we collect or use sensitive personal information (including email credentials), we will request your affirmative re-consent before the change takes effect as to your data. Your continued use of the Service after the effective date of a non-sensitive update constitutes your acceptance of the updated Policy.