Privacy Policy

1. Who We Are

Commission Clarity is a specialized tool for insurance agents and brokers. For more on the terms of use and technical data protection measures, see our Terms of Service and Data Protection.

2. What Personal Data We Process

The security and privacy of your business data are core to how Commission Clarity operates. We only process data that is strictly necessary for the service:

• User account data: email address, Google account ID, encrypted authorization tokens for accessing Google Sheets / Gmail / Google Calendar, IDs of connected Google Sheets documents, and subscription status (Stripe ID).
• Metadata that you create: visit notes, task statuses, and links between tasks and clients. Where applicable, this data is synced back into your Google Sheets documents so it remains under your ownership.
• Technical data: basic error and access logs used exclusively to keep the service secure and to fix issues.

We do not store personal data about your clients, policy amounts, commission content, or other business data in our database. The application reads this data in real time directly from your Google Sheets documents.

3. How We Use Your Data

We use the data we collect exclusively to:

• sign you into the application and maintain a secure session;
• display data from your Google Sheets documents inside the application;
• process subscription billing and provide technical support;
• maintain security and reliability, and fix issues.

We do not use your data for advertising, profiling, or behavioral analytics, and we do not sell or rent it to third parties.

4. Legal Basis for Processing

Our processing of personal data is based on:

• performance of a contract (GDPR Art. 6(1)(b)) – providing the service, authentication, access to Google Sheets, subscription billing;
• legal obligation (GDPR Art. 6(1)(c)) – retention of accounting records in accordance with applicable tax law;
• legitimate interest (GDPR Art. 6(1)(f)) – technical logs for security and troubleshooting;
• explicit consent (GDPR Art. 6(1)(a)) – permission for the application to access your Google Sheets, Gmail, and Google Calendar, which you can revoke at any time.

5. Sharing With Third Parties

The application does not share personal data with third parties for marketing purposes. We use the following processors to operate the service:

• Supabase – database hosting and authentication (email sign-in links).
• Google LLC / Google Ireland – access to your Google Sheets, Gmail, and Google Calendar based on your explicit permission.
• Stripe Payments Europe, Ltd. – subscription payment processing.
• Sendinblue SAS (Brevo) – sending service and notification emails and, where you have given consent, informational emails. Brevo receives your email address, your name if you provided one, and your subscribe/unsubscribe status.
• Hosting provider (CDN) – technical hosting of the web application.

If you use the app as a member of an agency, the agency owner and its administrators can see the policies, commissions, clients, and tasks assigned to your advisor name, because those records come from the agency's own shared documents. The agency is the controller of that data; other advisors in the agency cannot see your records.

If data is transferred outside the EU/EEA, such transfers are made subject to European Commission standard contractual clauses or other appropriate safeguards.

6. Data Security

We use the following measures to protect your data:

• all communication is encrypted in transit (HTTPS/TLS);
• sign-in uses a single-use link sent to your email address, so no password is stored;
• authorization tokens are stored encrypted in the database with access restrictions (row-level security policies);
• access to your Google Sheets documents is limited to the permissions you grant;
• we do not use visitor tracking tools (Google Analytics, Facebook Pixel, etc.).

Our security approach is also described in our Terms of Service. This page is informational and does not constitute an independent security certification.

7. Your Rights

As a data subject, you have the right to:

• access your personal data;
• correct inaccurate data;
• request erasure ("right to be forgotten");
• restrict processing;
• data portability;
• object to processing based on legitimate interest;
• withdraw consent, without affecting the lawfulness of prior processing;
• lodge a complaint with your competent data protection supervisory authority.

To exercise your rights or ask questions about privacy, please contact us at info@artepin.si or by phone at +386 70 783 641.

8. Retention Periods

• Account data: for the duration of an active subscription and up to 6 months after cancellation.
• Authorization tokens: until access is revoked by the user or the token expires.
• Invoices and payment data: 10 years (in line with applicable tax law).
• Technical logs: generally up to 90 days.

9. Cookies

For a detailed description of the cookies and local storage used by the application, see our Cookie Policy. We use only strictly necessary cookies and local storage; we do not use advertising or tracking cookies.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to remain compliant with applicable law and our business practices. The date of the last update is shown at the top of this page. We recommend that you review this page periodically.

11. Contact

For any questions about privacy, data protection, or exercising your rights, please write to info@artepin.si or call +386 70 783 641.