LIT Insurance Technologies LLC - Last updated: October 11, 2026
This Privacy Policy explains how LIT Insurance Technologies LLC collects, uses, discloses, protects, and retains information in connection with LIT/AMS, including the website, the LIT-AMS mobile apps for Android (Google Play) and iOS (Apple App Store, planned), and related public pages. One policy covers the website and the apps.
We may collect account information, contact details, login and security data, company and workspace information, billing and subscription information, support communications, device and usage data, and information submitted through forms, invitations, public agent pages, onboarding flows, sales tools, HR tools, training tools, service workflows, statements, uploads, notes, and reporting modules.
Customer data may include personal information about agents, employees, prospects, customers, policyholders, appointment contacts, service cases, and other individuals entered by users.
Account and profile: name, email, phone, time zone, country, role, password (stored only as a one-way hash), and, if you add them, a profile photo, company logo and branding, license numbers and license documents (PDF or image), and your public Web Profile.
Leads and clients: contact details (such as name, phone, email, address and date of birth), lead source, lead form answers received from sources you connect (for example Meta lead forms, GoHighLevel or webhooks), notes, appointments and status history.
Sales and policies: carrier, product, policy and premium details, commissions, chargebacks, overrides and payroll records, and carrier statements you upload (PDF).
WhatsApp: if you connect a WhatsApp number, the text of messages and captions exchanged with your leads and your replies. Photos, voice notes and other media are not downloaded or stored; they appear only as a label of the message type.
Insurance Estimator: the client details you enter (such as age, sex, state, height and weight, tobacco use, health conditions and medications) and the analyses you save on the website. The estimator in the mobile app does not save the inputs and does not send them to an AI provider.
HR and team tools, if your company uses them: employee profiles, attendance and training records, and HR documents uploaded by the company.
Payment reminders: the client email and the reminder settings and delivery records for clients you mark as having agreed to receive reminders.
Security and records: sign-in activity, IP address and browser or app identifier (user agent), and records of which version of our terms you accepted, when, in which language and from which channel (website or app).
We do not record calls or store call audio, we do not collect biometric data or precise location, and the platform does not ask for Social Security numbers.
The Apps are free to download and connect to the same account and data as the website. They ask only for internet access and, if you allow it, permission to show notifications. They do not access your camera, microphone, photos, contacts or location. In the Apps you can view your leads, sales and commissions, record a new sale (the client and policy details you type are saved to your workspace, as on the website), and upload a carrier statement: the App opens your device's file picker and reads only the PDF you choose, which is then stored and processed like a statement uploaded on the website.
Staying signed in: the App keeps a random sign-in credential on your device, encrypted with the device keystore. Our servers store only a hashed copy, the device name and model, platform, App version, and creation, last-use and expiry dates. The credential expires after 90 days without use, up to 5 devices can stay signed in, and signing out of the App revokes it. The Android App opts out of cloud backup so the credential is not copied to other devices.
Push notifications: if you allow notifications, the App registers a push token with Google Firebase Cloud Messaging (Android) or, for the iOS App, Apple Push Notification service, and we store that token with your device record. When a new lead is assigned to you, we send a notification through that service. On Android, the lock screen shows only "New lead"; on iPhone, what appears on the lock screen follows your Show Previews setting (by default, details appear only after you unlock). Inside the notification it may show the lead's first name and last initial, lead source and state. Phone numbers and email addresses are not included. You can turn notifications off at any time in your device settings.
No purchases and no ad or analytics SDKs: the Apps do not sell anything or show prices; plan changes happen on our website. The only third-party SDK in the Apps is Google Firebase Cloud Messaging, used to deliver notifications (on iPhone it delivers through Apple Push Notification service). The Apps contain no advertising, analytics, session-recording or crash-reporting SDKs.
The website uses first-party cookies that are needed to run it: a session cookie that keeps you signed in and protects forms, and a cookie that remembers your language. We measure product use with our own first-party event log stored on our servers. It records a fixed list of product events with pseudonymized account identifiers and does not record the contents of your workspace.
We do not use advertising pixels (such as the Meta Pixel or Google Ads tags), Google Analytics, session-replay tools or cross-site tracking on the website or in the Apps. Some public pages load fonts from Google Fonts and code libraries from a public content-delivery network, and tutorial videos embedded from YouTube or Vimeo may set their own cookies when played; those providers receive your IP address as part of delivering that content.
We use information to provide, operate, secure, personalize, support, troubleshoot, analyze, and improve the service; process account setup and invitations; manage subscriptions; send administrative messages and app notifications you allowed; prevent abuse; keep records of acceptance of our terms; and comply with legal obligations.
Enterprise and company customers control the data they and their users submit to their workspaces. We process that data to provide the service according to our Terms, this Privacy Policy, and any applicable Data Processing Addendum.
Data in an agency, company or enterprise workspace belongs to that agency or company and stays with it when an individual agent leaves, is removed or closes an account.
We may share information with service providers and subprocessors that help us host, secure, email, process payments, support, analyze, or operate the service. We may also disclose information when required by law, to protect rights and security, in connection with business transfers, or with your direction or consent.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
Our current service providers are: Verpex (hosting, database, file storage and hosted email); Cloudflare (website delivery and security); Stripe (payments and billing portal; card details are collected and stored by Stripe, not by us); OpenAI (AI features such as Detailed Analysis); EmailJS (transactional email); and Google Firebase Cloud Messaging (app notifications), plus Apple Push Notification service when the iOS App is available. The current list is on our Subprocessor List.
Services you or your company connect, such as Meta (WhatsApp and Facebook lead forms), a WhatsApp API provider, GoHighLevel, your Google or other email account, or webhooks, receive or send information because you instructed them to, under their own terms and privacy policies.
We use reasonable safeguards designed to protect information, including encryption in transit (HTTPS), hashed passwords and app credentials, and role-based access controls. We retain information for as long as needed to provide the service, maintain records, comply with legal obligations, resolve disputes, enforce agreements, and maintain backups and security logs, as described in the next section.
If we confirm a security breach affecting personal data, we notify the affected customers without undue delay and in any event within 72 hours after confirming it (or sooner if a law requires), as described in our Terms of Service. Customers notify their own clients where the law places that duty on them.
Closing your account. You can close your LIT-AMS account yourself at any time from your account settings on the website or in the mobile app. Instructions are also published at lit-ams.com/account_deletion.php. When you close your account, you lose access immediately and every signed-in browser and device is signed out. If you have a paid plan, its renewal is canceled as part of closing (or you will be asked to cancel it first) so that no further renewal charges occur; amounts already paid are not refunded except as stated in the Subscription & Billing Terms. If you own a company workspace that other users still use, you must transfer ownership or contact us before closing.
Thirty days to change your mind. Within 30 days after closure, sign in, complete any required verification and explicitly choose "Reopen my account" to restore access. Signing in alone does not reopen it. After the recovery window, the daily deletion process permanently removes your personal account data, including your login, profile, personal workspace records, uploaded files and app sign-in and push tokens. Failed deletion steps are retried; contact support if a request is delayed. Once deleted, the account cannot be restored.
Inactive free accounts. Eligible free Individual Lite accounts may be closed after at least 90 days without activity on the website or in the app. We normally send warnings around days 60, 75 and 85; closure requires a successfully sent final warning and at least five days to act on it. The separate 30-day recovery window starts when the account is actually closed, so permanent deletion is normally no earlier than day 120 of inactivity, on a subsequent daily run. Using the account before closure resets the inactivity clock; after closure, explicitly choose "Reopen my account" within the recovery window. Paid accounts, company owners and active company members are excluded. Accounts still linked to a Stripe subscription and designated internal, test or retained accounts are also excluded.
Canceling a paid plan is not closing your account. If you cancel Individual Plus or Team, your account moves to the free plan when paid access ends and your data is kept.
Company records. Closing your individual account does not delete records the agency independently controls, such as its sales, commissions or payroll. They remain under the agency's retention instructions and applicable legal recordkeeping duties, not an unlimited exemption from privacy rights. We retain a disabled "Deleted user" reference where company records need it; the company's records may still name you. Ask the agency about its retention period or contact support@lit-ams.com for help with a request.
Billing records. Our personal account billing links are removed at deletion. Stripe may retain invoices, payments and associated identifiers under its own privacy policy and applicable tax, accounting, fraud-prevention and legal obligations. A payment dispute, audit or legal hold can require longer retention. We do not store card numbers; account deletion does not erase records Stripe is required to retain.
Deletion evidence. A permanent audit record keeps closure/deletion dates, actions and record counts linked to a one-way account code, without the account name or email in that record. This is pseudonymous proof of the request and its outcome, not a retained usable account.
Agreement evidence. We retain the accepted document version, acceptance time and related identity/security evidence while needed to establish the agreement, meet applicable recordkeeping duties or resolve or defend claims. There is no single automatic expiry for these records. A verified deletion request includes review of whether identifying fields are still necessary; unnecessary fields are removed or de-identified. A specific legal hold lasts until the hold or claim is resolved and the applicable retention duty ends.
Security and delivery logs. These can retain limited account identifiers, network details and message-delivery events after active account deletion. Retention depends on the unresolved security, fraud, delivery-dispute or legal issue for which a record is needed. Not all logs have an automatic expiry. On a verified request we review relevant logs and remove or de-identify unnecessary personal information; material still needed for an identified investigation or legal hold remains restricted until that purpose ends.
Backups and development archives. Registered server backups, database exports, restore points and development copies are checked hourly and expire after 30 days from their recorded age. Copying or renaming a registered copy does not restart that period. Failed cleanup is retried and reported; our operational escalation deadline is 35 days, not an extra routine retention period. Registered workstation copies are checked while the workstation is available; a missed check is flagged after 26 hours and requires follow-up. We review other discovered locations before treating them as covered. On October 2, 2026, our unmanaged VPS hosting provider confirmed that it does not hold server snapshots, disaster-recovery backups or off-server historical copies for this service. Any future external backup service must have its actual expiry verified before use. Offline storage cannot meet an automatic deadline while unavailable and must not be used to bypass expiry; a missed workstation check requires prompt reconnection and cleanup. Verified deletion requests include review and provider follow-up as needed. An automated restore that predates a deletion is blocked; older copies require isolated recovery and reconciliation of completed deletions before returning data to use. Legally required records and agency-controlled records follow the separate criteria above.
Depending on your location and role, you may have rights to access, correct, delete, export, or object to certain processing of personal information. Requests can be sent to support@lit-ams.com. We may need to verify identity and may direct workspace-level requests to the relevant company or enterprise administrator. We will not discriminate against you for making a request.
You can turn off app notifications in your device settings and revoke an app sign-in at any time by signing out of the App.
If an insurance agent or agency uses LIT-AMS to keep your information, that agent decides what is collected and how it is used, and their privacy notice applies. To access, correct or delete your information, or to stop receiving messages, please contact the agent. If you contact us instead, we will forward your request to the agent and help where required. Payment-reminder emails come from your agent's mailbox; you can stop them by replying or by telling your agent.
When you use an AI feature, information supplied to that feature may be transmitted to our configured AI provider to process the request and generate a response. Submit only information needed for the task and that you are authorized to share. Connected email or other integrations may transmit information to the provider selected for that connection. Review the Subprocessor List and the applicable provider terms; AI outputs require independent verification.
Specifically, the basic Insurance Estimator calculates from rate tables on our own servers and does not use AI. If a user requests a Detailed Analysis on the website, the client profile entered, which can include the client's name, age, sex, state, height and weight, tobacco use, health conditions and medications, is sent to OpenAI to generate the analysis. Estimate links shared with a client expire after 24 hours.
U.S.-based customers may authorize staff or contractors located abroad to access their workspace. Information may consequently be accessed or processed outside the United States. Customers are responsible for deciding who may access their data and for providing required notices, permissions and safeguards. This policy does not promise that all information is stored or accessed only in the United States.
Users should only submit information they are authorized to process. If a customer believes legal, insurance, employment, health, financial, or other regulated data obligations apply, the customer is responsible for determining those obligations and configuring use of the service accordingly.
We are not a HIPAA covered entity and do not act as a HIPAA business associate unless we sign a separate written Business Associate Agreement. Health details entered into the Insurance Estimator are used only to produce the estimate or analysis the user requested.
The service, including the Apps, is for businesses and for users 18 and older. It is not directed to children and we do not knowingly collect personal information from children. If you believe a minor has created an account, contact us and we will delete it. Agents may enter information about minors as part of a client record (for example, a beneficiary); that information is controlled by the agent or agency that entered it.
We may update this Privacy Policy from time to time. Material changes will be posted through the service or public website, and we may ask you to review the updated policy the next time you sign in. If this policy is shown in Spanish, the Spanish version is provided for convenience; if there is a conflict, the English version controls.
Questions about privacy can be sent to support@lit-ams.com.
Questions about these policies? Contact webmaster@lit-ams.com.
