Privacy Policy — Carrier Connect AI

Introduction

Wood 19, Inc., doing business as Carrier Connect AI and Fylz AI ("Wood 19," "we," "us," or "our"), respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our websites, use our platforms and services — including Carrier Connect and Fylz (collectively, the "Services") — or otherwise interact with us.

Company Information:

Legal Name: Wood 19, Inc.
DBAs: Carrier Connect AI, Fylz AI
Address: 5890 Paddington Way, Boca Raton, FL 33496
Phone: 212-516-3959
Email: Legal@fylz.ai This Privacy Policy is incorporated into and forms part of our Terms and Conditions. By accessing or using the Services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use the Services.

1Scope of this Policy

This Privacy Policy applies to information we collect:

On our websites, including carrierconnect.ai, fylz.ai, and any other websites operated by Wood 19, Inc. that link to this Privacy Policy;
Through the Services, including web applications, APIs, and integrations;
In email, text, and other electronic communications between you and Wood 19;
Through sales, marketing, support, and other business interactions.

1.1 Our Role: Controller vs. Processor

We act in two distinct capacities, and your rights differ depending on which applies:

As a Data Controller. For information about our website visitors, prospects, account holders, and business contacts (such as registration information, billing data, and usage data), we determine how and why the information is processed. This Privacy Policy governs that processing.

As a Data Processor / Service Provider. For documents, files, and data that our business customers upload to or process through the Services ("Customer Content"), we process that information on behalf of and at the direction of our customer. In that case, the customer's own privacy policy — not this one — governs the information, and our handling is controlled by our agreement with that customer (including any Data Processing Agreement). If your personal information is contained in documents uploaded by one of our customers, please direct privacy inquiries to that customer. We will refer any request we receive regarding Customer Content to the relevant customer and reasonably assist them in responding.

2Information We Collect

2.1 Information You Provide to Us

Account and Registration Information: Name, email address, phone number, company name, job title, username, and password.
Billing and Payment Information: Billing address, payment method details, and transaction history. Full payment card numbers are collected and processed by our third-party payment processors; we do not store complete card numbers on our systems.
Communications: Information you provide when you contact support, request a demo, complete a form, respond to surveys, or otherwise communicate with us.
Business and Configuration Data: Credentials, connection settings, carrier or system configurations, and integration details you provide in order to use the Services (for example, connecting Carrier Connect to a carrier portal or agency management system).

2.2 Information We Collect Automatically

When you use the Services, we automatically collect:

Usage Data: Pages viewed, features used, actions taken, documents processed (counts and metadata, not content, for billing and analytics purposes), timestamps, and referring URLs.
Device and Connection Data: IP address, browser type and version, operating system, device identifiers, and general geographic location derived from IP address.
Log Data: Server logs, error reports, and diagnostic data generated by your use of the Services.

2.3 Information from Third Parties

We may receive information about you from:

Integration partners you connect to the Services (such as agency management systems, document storage platforms, or carrier systems), as authorized by you or your organization;
Payment processors confirming transaction status;
Business data providers and publicly available sources used for sales and marketing purposes;
Your organization, if your access to the Services is provisioned by your employer or another entity.

3Customer Content and Documents

Customer Content — the documents, files, statements, and data our customers upload to or route through Carrier Connect or Fylz — is the core of what our Services process. Our commitments regarding Customer Content:

Your content remains yours. We claim no ownership of Customer Content. It is processed solely to provide the Services to you.
We do not sell Customer Content. Ever, to anyone, for any purpose.
We do not use Customer Content to train AI models. See Section 5 below.
Access is restricted. Access to Customer Content by our personnel is limited to what is necessary to operate, support, and secure the Services, and is governed by access controls, logging, and confidentiality obligations.
Customer Content may contain personal information belonging to individuals other than our customer (for example, names appearing in commission statements or legal documents). As described in Section 1.1, we process that information as a processor/service provider on our customer's behalf. Enterprise customers may enter into a Data Processing Agreement (DPA) with us that governs Customer Content in further detail. To request our DPA, contact Legal@fylz.ai.

4How We Use Your Information

We use the information we collect to:

1. Provide and operate the Services, including processing documents, executing integrations, and delivering the features you or your organization have purchased; 2. Create and manage accounts, authenticate users, and provide customer support; 3. Process payments, manage subscriptions, and send transactional communications (invoices, receipts, renewal notices);

4. Improve and develop the Services, including analyzing usage patterns, diagnosing technical issues, and developing new features (using aggregated or de-identified data wherever practicable); 5. Secure the Services, including detecting, preventing, and investigating fraud, abuse, security incidents, and violations of our Terms; 6. Communicate with you about product updates, new features, and — where permitted by law — marketing communications, from which you may opt out at any time; 7. Comply with legal obligations, including tax, accounting, audit, and regulatory requirements; 8. Enforce our agreements, including our Terms and Conditions, and protect our rights, property, and safety and those of our users and others. We do not use your personal information for automated decision-making that produces legal or similarly significant effects concerning you.

5Artificial Intelligence and Machine Learning

The Services use artificial intelligence and machine learning technologies to classify, extract, analyze, and organize documents and data. In connection with these capabilities:

We do not use Customer Content to train our own or any third party's AI or machine learning models. Customer Content is processed by AI models solely to generate outputs for the customer who submitted it (for example, classifying a document or extracting data from a commission statement).
Our AI infrastructure providers are contractually restricted. We use enterprise-grade AI services under agreements that prohibit the provider from using Customer Content to train their models, and Customer Content submitted for inference is not retained by those providers beyond what is required to return results.
AI outputs may contain errors. AI-generated classifications, extractions, and analyses are probabilistic and should be reviewed for accuracy before being relied upon. Responsibility for verifying outputs rests with the customer, as described in our Terms and Conditions.
Aggregated, de-identified data (such as accuracy statistics or processing volumes that cannot reasonably be linked to any person or customer) may be used to improve Service quality and performance.

6How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

Service providers and sub-processors who perform services on our behalf (see Section 7), under contracts that restrict their use of your information;
Integrations you direct. When you or your organization connect the Services to a third-party system (a carrier portal, an AMS, a document storage platform), we transmit data to and from that system as you direct. That third party's handling of your data is governed by its own terms and privacy policy;
Within our corporate family, among Wood 19, Inc. and its DBAs and affiliates, for the purposes described in this Policy;
Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of all or a portion of our assets, information may be transferred as a business asset, subject to this Privacy Policy or an equivalent successor policy;

Legal compliance and protection. When we believe in good faith that disclosure is necessary to comply with law, regulation, legal process, or governmental request; to enforce our Terms; or to protect the rights, property, or safety of Wood 19, our users, or the public;
With your consent or at your direction.

7Sub-Processors and Service Providers

We rely on carefully selected third-party providers to deliver the Services, including:

Cloud infrastructure and hosting providers (including Amazon Web Services) for computing, storage, and AI/ML inference, hosted in the United States;
Payment processors for billing and subscription management;
Communications and support tools for email delivery, customer support, and messaging;
Analytics providers to help us understand Service usage. Each provider is bound by contractual obligations regarding data protection consistent with this Privacy Policy. A current list of sub-processors that process Customer Content is available to customers upon request at Legal@fylz.ai.

8Cookies and Tracking Technologies

We and our service providers use cookies, pixels, and similar technologies to:

Operate the Services (essential cookies for authentication, session management, and security);
Remember your preferences (functional cookies);
Understand usage (analytics cookies measuring page views, feature adoption, and performance). You can control cookies through your browser settings, including blocking or deleting them. Disabling essential cookies may impair the functionality of the Services. Where required by applicable law, we will obtain your consent before placing non-essential cookies.

9Data Security

We maintain a comprehensive information security program designed to protect your information, including:

SOC 2 Type 2 compliance, independently audited;
Encryption of data in transit (TLS) and at rest;
Access controls, including role-based access, least-privilege principles, and multi-factor authentication for administrative access;
Logging and monitoring of systems that process Customer Content;
Vendor security review of sub-processors;
Personnel measures, including confidentiality obligations and security training;
Incident response procedures. In the event of a security incident affecting your personal information, we will notify you and applicable regulators as required by law.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

10Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. In general:

Account information is retained for the life of the account and for a reasonable period thereafter for legal, tax, and audit purposes;
Customer Content is retained in accordance with the customer's agreement and configuration, and is deleted or returned following account termination as described in our Terms and Conditions (customers may request a copy of their data within thirty (30) days of termination);
Billing records are retained as required by tax and accounting law;
Usage logs are retained for security and operational purposes on a rolling basis and then deleted or de-identified. When retention is no longer required, we delete or de-identify the information.

11Your Privacy Rights

Depending on your jurisdiction, you may have the right to:

Access the personal information we hold about you;
Correct inaccurate or incomplete information;
Delete your personal information;
Port your information to another service in a commonly used format;
Opt out of marketing communications (via the unsubscribe link in any marketing email or by contacting us);
Restrict or object to certain processing;
Withdraw consent where processing is based on consent. To exercise any of these rights, contact us at Legal@fylz.ai with the subject line "Privacy Request." We will verify your identity before acting on a request and will respond within the timeframe required by applicable law. We will not discriminate against you for exercising your privacy rights.

If your personal information appears in Customer Content uploaded by one of our customers, we will refer your request to that customer as described in Section 1.1.

12State-Specific Privacy Rights

12.1 California Residents

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) provides you specific rights, including the rights to know, delete, correct, and opt out of the sale or sharing of personal information.

We do not sell personal information and have not sold personal information in the preceding twelve (12) months.
We do not share personal information for cross-context behavioral advertising.
Categories of personal information collected in the preceding twelve (12) months: identifiers (name, email, IP address); commercial information (transaction history); internet activity (usage data); professional information (company, job title); and geolocation (general, derived from IP address).
We do not collect or process sensitive personal information for purposes requiring a right to limit under the CPRA. California residents may exercise their rights by emailing Legal@fylz.ai. You may designate an authorized agent to make requests on your behalf, subject to identity verification.

12.2 Other U.S. States

Residents of Colorado, Connecticut, Florida, Texas, Utah, Virginia, and other states with comprehensive privacy laws may have similar rights of access, correction, deletion, portability, and opt-out. We honor such rights as required by the law applicable to you. To exercise your rights or appeal a decision regarding your request, contact Legal@fylz.ai.

13International Data Transfers

The Services are hosted and operated in the United States. If you access the Services from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those of your jurisdiction. Where required by applicable law, we implement appropriate safeguards for international transfers, such as standard contractual clauses.

14Children's Privacy

The Services are business tools intended for use by adults. We do not knowingly collect personal information from children under the age of eighteen (18). If we learn that we have collected personal information from a child under 18, we will delete it promptly. If you believe a child has provided us personal information, please contact us at Legal@fylz.ai.

15Third-Party Websites and Services

The Services may contain links to, or integrate with, third-party websites, platforms, and services that we do not control — including carrier portals, agency management systems, document storage providers, and payment processors. This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party service you use in connection with the Services.

16Do Not Track Signals

Some browsers offer a "Do Not Track" (DNT) setting. There is currently no industry standard for responding to DNT signals, and our Services do not respond to them at this time. We will honor legally recognized opt-out

preference signals (such as the Global Privacy Control) where required by applicable law.

17Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will revise the "Last Updated" date at the top of this Policy and post the updated version on our websites. For material changes, we will provide additional notice, such as email notification to account holders or a prominent notice within the Services, before the changes take effect. Your continued use of the Services after the effective date of any changes constitutes acceptance of the updated Privacy Policy.

18Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, contact us at:

Wood 19, Inc.

Attn: Privacy / Legal Department

5890 Paddington Way

Boca Raton, FL 33496

United States

Phone: 212-516-3959

Email: Legal@fylz.ai