Privacy Policy

Sourcy is a controller when you deal directly with us, such as when you create an account, request support, or manage billing. When an insurance agency uses Nexus to handle information about its clients, prospects, employees, or other people, Sourcy acts as that agency’s processor or service provider. A data processing addendum is available on request.

We collect four kinds of information:

• Account and contact details — name, work email, agency, role, and authentication data.
• Billing records — plan, seat count, subscription status, and payment history.
• Customer content — files, messages, policy records, forms, notes, and any information about an agency’s clients and prospects submitted to Nexus.
• Technical telemetry — IP address, browser, device, timestamps, authentication events, logs, and feature usage.

We use information to provide, secure, maintain, and improve Nexus; process billing; respond to support; prevent fraud, abuse, and unauthorized access; and comply with legal obligations. We do not share personal information for advertising. See also Product development, AI and de-identified data.

Product development and AI. We use the information we collect, including content and usage information, to provide and improve our services and to develop, train, test and improve artificial intelligence and machine learning models and technologies.

De-identified and aggregated information. We may de-identify or aggregate information so that it does not reasonably identify, and cannot reasonably be linked to, any individual, customer or customer’s client. We may use, share, license or sell de-identified or aggregated information to third parties for any lawful purpose, including for the development and training of their own artificial intelligence models. We maintain de-identified information in de-identified form, do not attempt to re-identify it, and contractually prohibit recipients from re-identifying it. Under applicable laws, including the California Consumer Privacy Act (Cal. Civ. Code § 1798.140) and the Florida Digital Bill of Rights (Fla. Stat. § 501.702), de-identified information is not personal information.

Personal and sensitive information. We never sell or share personal information, including nonpublic personal information about insurance consumers, or sensitive personal information, and we do not include it in any information we share, license or sell. When an agency enters information about its clients, we process that information on the agency’s behalf to provide our services.

Google user data. Information received from Google APIs, including the Gmail API and the Google Drive API, is used and transferred in accordance with the Google API Services User Data Policy, including the Limited Use requirements. It is never used to develop, improve or train generalized artificial intelligence or machine learning models, and it is never sold.

Nexus includes AI-assisted search, analysis, extraction, drafting, and transcription features. When an authorized user invokes them, the prompt and only the records, document excerpts, or audio needed to answer the request may be sent to OpenAI or to an OpenAI-compatible provider configured for the service. These providers process that content to return the requested output and are not permitted to train their models on it.

AI output may be incomplete or inaccurate and is not legal, insurance, financial, or other professional advice. Users must review it before acting on it.

An authorized user can connect Nexus to an AI assistant of their choice, such as ChatGPT, Claude, Grok, or Cursor, through our Model Context Protocol (MCP) server. How to connect, and what the assistant can do, is explained on AI assistants.

• What we receive. The user’s sign-in and the permissions they approve on the consent screen, and, for each request, the tool the assistant calls and the inputs it sends to that tool. We do not receive or read the conversation, the assistant’s memory, or its files.
• What the assistant receives. Only the result of each tool it calls, limited to what the user can already see in Nexus and to the permissions they approved. Results can include text the agency recorded, such as notes or a claim’s loss description, which may mention injuries or other personal details. Dates of birth and tax identifiers (FEIN) are withheld from every result, and premium amounts are returned only when the user approved the permission for amounts.
• How we use it. To run the tool the user asked for, to keep each change waiting for the user’s confirmation, and to secure, support, and audit the service. Messages to clients, carriers, or signers are reviewed and sent from Nexus, never directly from the assistant.
• Sharing. Tool results go to the assistant the user chose, at the user’s direction. Its provider processes them under the user’s own agreement with that provider, not under this policy. We do not share this information or use it for advertising.
• Retention. We keep a log of each assistant request (user, agency, tool, IP address, and outcome, not the content of the request) for 90 days for security and support. Records created or changed through the assistant are kept like any other Nexus record.
• Your controls. A user or agency administrator can revoke a connection at any time from the MCP page in Nexus, and the assistant loses access on its next request. An administrator can turn off assistant access for the whole agency. Questions: [email protected].

Our code and production configuration use the following categories and providers:

These providers receive only the information reasonably needed to perform their services and are bound by contractual or legal confidentiality and data-protection obligations. We do not share personal information.

Optional integrations are activated by an agency or its authorized users. Google Drive access is read-only and limited to files or folders the agency makes available to Nexus. An agency may also connect Gmail so Nexus can read commission-statement messages and their attachments. Our use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through the Gmail API and the Google Drive API is never used to train generalized AI models and is never sold. An agency can revoke Google access or remove the relevant integration credentials from its account or Google settings.

Sourcy may send transactional messages about authentication, security, billing, support, and service operation.

Agencies may separately use Nexus to send email, SMS, or calls to their own clients. For those agency-directed communications, the agency controls the recipients, content, consent, and applicable opt-out obligations, and Sourcy acts as its processor.

Nexus uses cookies or similar browser storage needed for authentication, security, session continuity, and preferences such as display theme. We do not use advertising cookies or create advertising profiles. Technical usage logs are used to operate and protect the service, not for cross-site ads.

We generally keep account data and customer content while the account is active. After account closure, we delete or de-identify customer content within approximately 90 days, including through ordinary backup rotation, unless a longer period is required for legal, security, dispute, or financial-record obligations.

We use safeguards appropriate to the nature of the information, including TLS in transit, password hashing, role-based access controls, tenant-aware authorization, logical separation between agency records, restricted credentials, and logging.

No system is perfectly secure. If a breach affects protected information, we will notify affected customers and authorities as required by law.

Sourcy operates from Florida, United States, and Nexus information is processed in the United States and wherever our service providers operate. If information is transferred across borders, we use applicable contractual and legal safeguards.

Nexus is a business service and is not directed to anyone under 18. We do not knowingly collect personal information directly from children.

Depending on where you live, you may request access to, correction of, or deletion of your personal information, or object to or restrict certain processing. Contact us to make a request. If an agency entered or controls the information, we will direct the request to that agency and assist it as required. We may verify identity before completing a request.

We may update this policy as Nexus or applicable law changes. We will post the revised policy on this page and update the effective date. We will provide additional notice when a material change requires it.