Privacy

1. Who is responsible for what

Where consumer data sits inside an operator tenant, the operator is the controllerand Underwrite Compliance is a processor acting on the operator's documented instructions. We do not decide which consumers are enrolled, what is disputed, or what is sent. Where you are a visitor to this website or a prospective customer, we are the controller for that limited relationship.

2. What the platform processes for an operator

• Consumer identity fields, encrypted separately from case history and resolvable only by the seat that opened the case.
• Case data: disputed items, the basis stated, states, statutory clocks and their evidence pointers.
• Generated documents and their delivery receipts, including the hash of the document actually delivered.
• Correspondence metadata and attached evidence, including article numbers and acceptance scans.
• Audit entries, which record actor, event, rule and subject for every write, including refused writes.

3. What we process as controller

Contact details you send us through this site or by mail, the content of that message, and ordinary server logs. We use them to reply, to run the relationship, and to keep the service secure. We do not sell them, and we do not use them to train anything.

4. What this website stores in your browser

This site sets no advertising or analytics cookies. It writes two keys tolocalStorage, both of which stay in your browser and are never transmitted:

• uw.tenant.v1 holds the tenant configuration you set in the panel on the right edge: name, contact details, brand seeds, typeface and colour scheme. Clearing it is the Reset button in that panel.
• uw.role.v1 holds whether you last viewed the site as an operator or as a compliance officer, so the navigation stays where you left it.

If a configuration arrives in a link, its values are validated, written to that key and re-serialised into the address bar. Values that do not validate are dropped rather than stored.

5. Retention

Retention inside a tenant is set per class, and the platform will not accept a period below a floor that a rule sets. Defaults are published on theaudit trail page. Enquiry correspondence with us is kept for twenty four months and then deleted.

6. Deletion requests

A consumer deletion request reaches us through the operator, because the operator is the controller. Executing it removes identity fields. The tokenised case history, the clocks and the audit entries survive, because deleting them would destroy the operator's own evidence of having complied with obligations that were owed to that same consumer. We will say this in writing to an operator's counsel on request.

7. Subprocessors

We use subprocessors for hosting, object storage, transactional mail and error monitoring. The current list, with locations and roles, is provided in the data processing addendum and is updated with thirty days notice before any addition. Ask[email protected] for the current version.

8. International transfers

The default deployment is a single United States region. Single tenant residency is available on the Platform plan and the residency choice is recorded on the tenant rather than held in a support ticket.

9. Security

Controls, recovery objectives and the incident record are on thesecurity page. Report a vulnerability to[email protected]. We acknowledge inside one business day and we do not require an agreement before receiving a report.

10. Your rights

Depending on where you live you may have rights to access, correct, delete or port your data, and to object to certain processing. For data inside an operator tenant, exercise them with that operator. For data we hold as controller, write to[email protected] and we will respond within five business days.

11. If you are a consumer

We do not hold consumer credit files and we cannot act on a dispute. Contact the operator you engaged. You may also dispute directly with each consumer reporting agency at no cost, and your free annual file disclosure is atannualcreditreport.com.

12. Changes

Material changes are notified to tenant administrators thirty days ahead. The review date at the top of this page is the date the text last changed.