Privacy Policy

1. Introduction

This Privacy Policy describes how Flobase LLC ("Flobase," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with flobase.tech and all related websites, software, admin and agent portals, inbound call-routing and live-transfer services, telephony and call-monitoring tools, lead-distribution and lead-marketplace services, artificial-intelligence and rules-based decisioning features, training and coaching tools, payment and commission-tracking features, support services, and related products and services (collectively, the "Platform").

This Privacy Policy is incorporated into the Flobase Terms of Service. By using the Platform, you acknowledge that you have read and understood this Privacy Policy.

2. Who This Policy Covers

This Privacy Policy applies to:

• Platform users — licensed insurance agents, agency owners and managers, account administrators, publishers, and other business users who create accounts or use the Platform; and
• Call participants — consumers and other individuals whose calls, messages, or information are routed through, recorded by, or otherwise processed on the Platform.

The Platform is a business tool. Agents and agencies who handle consumer information through the Platform have their own legal obligations to those consumers, as described in the Terms of Service. This Policy describes Flobase's own practices.

3. Information We Collect

Account and identity information. Name, email address, phone number, agency and hierarchy affiliation (including your position in the reporting structure), insurance licensing information (including licensed states), identity-verification information, and other information provided during registration, onboarding, or verification.

Payment, wallet, and commission information. Purchase amounts for Real-Time and aged leads, credit and wallet balances, transaction history, insertion-order and CPA-target information, commission and chargeback records, and billing records. Card and bank details are collected and processed by our third-party payment processor(s); Flobase does not store full card numbers.

Calls, recordings, and transcripts. Call audio recordings, live and post-call transcripts, Listen/Whisper/Barge monitoring activity, caller and destination phone numbers, call-routing and round-robin events, timestamps, durations, dispositions, and related telephony metadata for calls processed through the Platform.

Lead and campaign information. Lead records purchased or distributed through the lead marketplace or aged-lead inventory, replacement-request submissions, campaign and insertion-order details, and related routing and bid data.

AI-generated and rules-based information. Call summaries, script-adherence results, quality and compliance (QA) scores, classifications, coaching analytics (such as agent score, close rate by lead source, and call consistency), risk and fraud flags, and outputs of deterministic rules engines such as our UW Genie underwriting-eligibility tool.

Acceptance and evidence records. Records of your acceptance of the Terms of Service and related acknowledgments, including the version accepted, the exact acknowledgment text, timestamps, IP address, and device and browser information.

Device and usage information. IP address, browser type, device information, login activity, pages visited, feature usage, and diagnostic and admin_audit logs.

Communications. Support messages, chat conversations, emails, SMS messages sent through Platform tools, dispute and replacement-request submissions, and other communications with us or through the Platform.

Consumer information handled by agents. Information consumers share during live-transfer or other calls, or that arrives with a routed call or lead, which may include names, contact details, dates of birth, health-related statements, insurance information, financial information, and application details.

4. Call Recording, Monitoring, and Transcription

Calls and communications processed through or associated with the Platform — including live-transfer calls — may be recorded, monitored (including through Listen, Whisper, and Barge functionality), intercepted, transcribed, stored, replayed, evaluated, and analyzed for quality assurance, billing and dispute review, training and coaching, script adherence, consumer protection, legal and regulatory compliance, do-not-call ("DNC") scrub compliance, fraud and abuse detection, replacement-request and complaint investigation, chargeback response, technical support, security, analytics, product development, and enforcement of the Terms of Service.

Platform users consent to this recording and processing by using the Platform. Agents are responsible for delivering any legally required recording announcement to call participants and obtaining every consent required by the laws applicable to the participants and locations involved.

5. Automated Decisioning and Artificial Intelligence

The Platform uses a combination of deterministic, rules-based systems and artificial intelligence.

Certain features — including our UW Genie underwriting and product-eligibility tool — are built on deterministic, rules-based logic rather than generative AI or large language models. These tools apply defined underwriting rules to information you enter to help identify potentially eligible carriers and products. They are decision-support tools only, do not display or determine final premiums, and do not make final underwriting decisions — those decisions remain with the applicable insurance carrier. We use this rules-based approach specifically to keep these outputs consistent and auditable.

Other Platform features use artificial intelligence, machine learning, natural-language processing, speech recognition, and large language models ("AI Systems") to process recordings, transcripts, call metadata, scripts, campaign criteria, dispositions, and user activity. AI Systems may generate or assist with transcripts, call

summaries, script-adherence results, quality and compliance scores, coaching suggestions and analytics, fraud or risk flags, classifications, and similar outputs.

AI-generated outputs may be incomplete or inaccurate and are used to support — not replace — human review by managers and administrators, as described in the Terms of Service.

Flobase does not use your information to train its own general-purpose AI models. AI processing is performed by Flobase and by third-party AI service providers under commercial agreements that govern how those providers may use the data they process on our behalf. Flobase does not authorize its providers to use Platform data for third-party advertising.

6. How We Use Information

• To provide, operate, secure, and maintain the Platform, including inbound call routing, round-robin and overflow distribution, live-transfer handling, and the lead marketplace and aged-lead inventory.
• To process payments, manage credits and wallets, and maintain billing, commission, and chargeback records.
• To bill calls and leads, review disputes and replacement requests, and respond to chargebacks and payment disputes.
• To perform quality assurance, DNC scrub and other compliance monitoring, and fraud and abuse detection, including through AI Systems and rules-based tools.
• To provide training, coaching, production dashboards, and performance analytics.
• To operate hierarchy-scoped reporting and monitoring for managers and administrators.
• To communicate with you about your account, support requests, compliance matters, and service changes.
• To maintain evidence of Terms acceptance, acknowledgments, and Platform activity, including admin_audit logs.
• To comply with legal obligations, respond to lawful requests, and enforce our agreements.
• To improve Platform performance, features, and reliability, including through aggregated or de-identified analytics.

7. How We Share Information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

We share information with:

• Service providers that process data on our behalf, including telephony and call-routing providers, payment processors, AI and transcription providers, cloud hosting and infrastructure providers, email and communications providers, identity-verification providers, support and chat tools, and analytics providers. Providers are bound by contractual obligations appropriate to the services they perform, and we may replace or add providers as described in the Terms of Service.

• Within your organization — consistent with our hierarchy-scoping model, agency owners, managers, and administrators may access information about the agents and activity under their scope, including calls, recordings, performance data, and compliance results, based on their role and permissions (RBAC).
• Campaign and marketplace partners — publishers who warm-transfer leads to agents, insurance carriers, and other lead-marketplace counterparties may receive information reasonably necessary for campaign operation, lead delivery, billing reconciliation, replacement-request review, complaint investigation, or compliance review.
• Payment dispute reviewers — processors, issuing banks, card networks, arbitrators, or courts, when we contest a chargeback or payment dispute using the records described in the Terms of Service.
• Legal and safety recipients — regulators, law enforcement, courts, or other parties when required by law, subpoena, or court order, or when reasonably necessary to investigate fraud, protect consumers, enforce our agreements, or protect the rights, property, or safety of Flobase, our users, or others.
• Business transferees — in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to this Policy or successor terms.

8. Health-Related and Sensitive Information

Insurance conversations may include health-related statements and other sensitive information. This information is processed to provide the Platform services described above — including recording, transcription, AI and rules-based analysis, billing review, and compliance monitoring — and is subject to the access restrictions and safeguards described in this Policy.

Flobase is not a HIPAA-covered entity and, unless a separate Business Associate Agreement has been signed for a specific service, does not act as a HIPAA business associate. Users are responsible for determining whether HIPAA, the Gramm-Leach-Bliley Act, state insurance privacy laws, or other sector-specific requirements apply to their own activities, as described in the Terms of Service.

9. SMS and Text Messaging

If you use Platform SMS tools, messages may be sent to prospects and customers only after appropriate consent, such as verbal consent obtained during an active phone call. Messages may include appointment reminders, follow-up information, or other service-related content. Message and data rates may apply, and message frequency varies. Recipients can opt out at any time by replying STOP to any message. We do not sell or share phone numbers for marketing purposes.

10. Cookies and Similar Technologies

The Platform uses cookies, local storage, and similar technologies to keep you signed in, remember preferences, maintain session security, and understand Platform usage. Support chat and similar embedded tools may set their own cookies subject to their providers' policies. You can control cookies through your browser settings, though some Platform features require them to function.

11. Data Retention

We retain information for as long as reasonably necessary for the purposes described in this Policy, considering:

• the period your account is active and any period needed to resolve outstanding balances, commissions, or disputes;
• legal, regulatory, carrier, and campaign requirements — including call-recording retention periods required for regulated insurance and telemarketing activity;
• billing, chargeback, audit, and evidence needs, including Terms-acceptance and admin_audit records;
• fraud prevention and security; and
• legal holds, investigations, complaints, or anticipated disputes, which may extend retention beyond ordinary periods.

Account termination does not require immediate deletion of records we are legally or operationally permitted to retain. When information is no longer needed, we delete it or de-identify it.

12. Security

We use administrative, technical, and organizational safeguards designed to protect the Platform and the information processed through it, including encryption in transit, access controls, hierarchy-scoped permissions, and restricted access to recordings and consumer information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you become aware of a security incident involving the Platform, notify us promptly at founders@flobasehq.com.

13. Your Rights and Choices

Depending on your jurisdiction, you may have rights to access, correct, delete, or receive a copy of your personal information, or to restrict or object to certain processing. Residents of Kentucky, California, Texas, and other states with comprehensive privacy laws may have additional rights under those laws.

To exercise a privacy right, contact us at founders@flobasehq.com. We may need to verify your identity before acting on a request, and some records — such as billing evidence, acceptance records, and recordings subject to regulatory retention — may be exempt from deletion. If we decline a request, we will explain why, and you may have the right to appeal under applicable state law.

Call participants who wish to exercise rights regarding a specific call may contact us or the agent or agency they spoke with. Where the request concerns an agent's or agency's own obligations, we may direct the request to them.

14. Children's Privacy

The Platform is a business tool intended for users who are at least 18 years old. We do not knowingly collect personal information from children under 18 as Platform users. If you believe a child has provided personal

information through the Platform, contact us at founders@flobasehq.com.

15. Third-Party Sites and Services

The Platform may link to or integrate with third-party websites and services, including payment checkouts, carrier links, support chat, and optional integrations such as InsuranceToolkits. Those services are governed by their own privacy policies, and we are not responsible for their practices.

16. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with a revised "Last Updated" date, and we may provide additional notice through the Platform or by email. Continued use of the Platform after the effective date of an updated Policy constitutes acceptance where permitted by law.

17. Contact Us

Flobase LLC

300 E Main St

Lexington, KY 40507

Email: founders@flobasehq.com

Website: flobase.tech