Privacy Policy

1. Introduction

Lotus Assurance ("we," "us," or "our") is an independent insurance agency licensed in Arkansas (AR License #21425205), operating at 6221 Colonel Glenn Rd, Suite 4, Little Rock, AR 72210. We provide insurance products and services including auto, home, renters, business, life, health (ACA Marketplace), and Medicare plans.

We also offer clerical document-preparation and English/Vietnamese translation services (our "Document Services"), and we provide a secure client portal — available on our website and through our Lotus Assurance mobile app — where clients can view their policies, exchange documents and messages with us, file claims, and manage their account. Our Document Services are clerical only; we are not a law firm and do not provide legal advice.

This Privacy Policy explains how we collect, use, disclose, and protect information you provide when you visit our website at lotusassurance.com (the "Site"), use our Lotus Assurance mobile app for iOS and Android (the "App"), contact us by phone, text message (SMS), or email, or submit a quote request or inquiry through the Site, the App, or in person.

By using our Site or submitting information to us, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Site or submit personal information to us.

2. Information We Collect

2.1 Information You Provide Directly

We collect personal information you voluntarily submit to us, which may include:

• Full name, date of birth, and contact information (phone number, email address, mailing address)
• Vehicle information (year, make, model, VIN, current insurer, annual mileage)
• Property information (address, property type, year built, current insurer)
• Business information (business name, type, number of employees, revenue, operations description)
• Health-related information collected in connection with ACA Marketplace or Medicare plan inquiries (see Section 8)
• Driver's license information and driving history
• Current insurance coverage details and premium amounts
• Social Security Number — only when required to bind a policy or as required by a carrier's application process
• Any other information you choose to include in a contact form, email, or phone call to our office
• Documents you upload through our client portal or otherwise submit to us for processing, such as driver's licenses, declaration pages, photos, and policy documents
• Client portal account information, including the email address and password you use to access your secure portal on the web or in our mobile App
• Mobile app information, including a device push-notification token (used to send you alerts about your account) and your in-app language and display preferences
• For our Document Services: the type of form or filing you need (for example, business-formation documents, an EIN application, or immigration forms you have already chosen to file), together with the information and documents you provide for us to type or translate
• Appointment details when you book time with us online, such as the date, time, topic, and preferred language you select
• Referral information — if you refer someone to us (or someone refers you), the name and contact information provided so we can follow up; please share another person's information only with their permission
• Promotion and giveaway entries, such as your name, business name, business address, and Google Business Profile details when you claim a promotional offer (for example, a free review stand)
• Consent records — when you opt in to receive calls, texts, or emails from us, we keep the date, time, the consent language you agreed to, and the IP address of your submission for compliance purposes

2.2 Information Collected Automatically

When you visit our Site, our web hosting platform and analytics tools may automatically collect certain technical information, including:

• IP address and general geographic location (city/state level)
• Browser type, operating system, and device type
• Pages visited, time spent on pages, and referring URLs
• Date and time of your visit

This information is collected through standard web server logs and analytics tools (such as Google Analytics). We use this data to understand how visitors use our Site and to improve its content and functionality. This data is aggregated and does not typically identify you as an individual.

2.3 Cookies and Similar Technologies

Our Site may use cookies — small data files stored on your device — to improve your browsing experience, remember your preferences, and support website analytics. We may also use tracking pixels from third-party advertising platforms (see Section 6). You can control cookie settings in your browser; however, disabling cookies may affect certain features of the Site.

2.4 Information Collected Through Our Mobile App

When you use our mobile App, we may access the following on your device — only with your permission, and only for the purpose described:

• Camera and photo library — so you can photograph or upload documents, ID cards, and policy or property photos.
• Face ID, Touch ID, or other biometrics — only if you turn on the optional app lock. Your biometric data never leaves your device and is never transmitted to or stored by us; your device returns only a pass-or-fail result.
• Push notifications — if you allow them, we send alerts about messages, documents to sign, claims, renewals, and billing. You can turn them off at any time in your device settings.

The App uses the same client-portal information described in this Section 2 and does not collect new categories of personal information beyond what is listed above.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To respond to your quote requests, inquiries, and communications
• To compare insurance options across multiple carriers and present you with coverage recommendations
• To prepare, process, and submit insurance applications on your behalf with your authorization
• To contact you about your coverage, policy changes, renewals, and service-related matters
• To maintain records of your insurance and document-services needs in our agency management and client relationship management (CRM) system
• To operate your client portal and to prepare or translate documents you ask us to process
• To operate our website and mobile App, including sending push notifications about your policies, documents, messages, claims, and billing
• To schedule, confirm, and remind you about appointments you book with us
• To administer promotions and giveaways, including verifying eligibility, programming and delivering promotional items, and following up on your entry
• To send you educational content, market updates, or information about insurance options that may be relevant to you — you may opt out at any time
• To comply with applicable laws, regulations, and licensing requirements
• To improve our Site, marketing, and client service operations
• To detect and prevent fraud or other unauthorized activities

We do not use your personal information for automated decision-making or profiling that produces legal effects concerning you without your knowledge and consent.

Text Messaging (SMS)

With your consent, we send text messages to the mobile number you provide, using messaging providers such as Twilio and RingCentral. Texts may include service and account messages — appointment reminders and policy, billing, claim, and document updates — and, if you separately opt in, occasional marketing or promotional messages. Message frequency varies and message-and-data rates may apply. You can opt out of texts at any time by replying STOP, or reply HELP for help; opting out of texts does not stop email or phone communications about your insurance policies. We do not sell or share your mobile number or your text-messaging consent with third parties for their own marketing.

4. How We Share Your Information

4.1 Insurance Carriers

With your authorization, we share your information with the insurance carriers we represent in order to obtain quotes, bind coverage, process applications, and service your policies. By requesting a quote or submitting an application through us, you authorize us to submit your information to applicable carriers.

4.2 Managing General Agents (MGAs)

We may share your information with MGAs through which we access certain carrier markets, including AUI, Burns & Wilcox, and Southern General Agency TN, when applicable to your coverage needs.

4.3 Technology Providers

We operate a proprietary agency management and CRM system to store and process your information and to power your client portal. It is hosted on the following providers, each of which maintains its own security and privacy practices:

• Supabase for our database, authentication, and encrypted document storage.
• Vercel for application and website hosting.
• Twilio for text message (SMS) delivery.
• Resend for transactional and notification emails.
• RingCentral for business phone, SMS, and communications.
• Expo and the Apple Push Notification service (APNs) for delivering mobile app push notifications.
• Cloudflare for bot and spam protection on our public forms (Cloudflare Turnstile), which processes your IP address to distinguish people from bots.
• Documenso, a self-hosted e-signature platform we run on Railway hosting, for documents you sign electronically with us.
• Google services, including Gmail and Google Cloud for agency email processing, Google Analytics for site measurement, and Firebase for Android app configuration and push delivery.
• Sentry for error and performance monitoring. We configure the application to remove request bodies, credentials, cookies, and detailed user identity before diagnostic events are sent.
• PostHog for product analytics, experiments, and masked session recordings on quote experiences. Form inputs are masked so contact and quote details are not captured in recordings.
• OpenAI for staff-requested assistance such as document extraction, call transcription and summaries, and draft content. Staff review the output before relying on or sending it.
• Deepgram for staff-requested transcription of call recordings when that integration is enabled.
• Stripe for hosted checkout and payment-status processing when online payment features are enabled; Lotus Assurance does not store full payment-card details.

4.4 Service Providers

We may engage third-party service providers who assist us in operating our website, conducting our business, or serving you, so long as those parties agree to keep your information confidential. These may include web hosting providers, email platforms, and marketing tools.

4.5 Legal Requirements

We may disclose your information when required by law, court order, or governmental authority, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

4.6 We Do Not Sell Your Information

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

5. Third-Party Websites and Links

Our Site may contain links to third-party websites, including carrier websites and informational resources. We are not responsible for the privacy practices of those websites. We encourage you to review the privacy policies of any third-party site you visit.

6. Online Advertising and Social Media

We advertise on social media platforms including Facebook and Instagram. Our advertising on these platforms is conducted under the Special Ad Category designation, which applies restrictions on audience targeting for housing, credit, and insurance-related ads. We comply with the applicable platform advertising policies.

These platforms may use cookies, pixels, or other tracking technologies on our Site to measure ad performance and deliver relevant advertising. We do not control how Facebook, Instagram, or Meta handle data collected through their tracking tools. Please review Meta's Privacy Policy for more information.

You can manage your ad preferences on Facebook and Instagram through your account settings on those platforms.

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, to service your insurance policies, and to comply with our legal and regulatory obligations as a licensed insurance agency. Arkansas law and insurance carrier requirements may mandate that we retain certain records for specified periods.

When information is no longer needed, we use reasonable measures to securely destroy or anonymize it.

8. Health and Medicare-Related Information

In connection with ACA Marketplace and Medicare plan inquiries, we may collect health-related information including age, health conditions, prescription medications, and household income. This information is used solely to help identify suitable coverage options and is shared with carriers and government programs (such as HealthCare.gov) only with your authorization and as required to complete an enrollment application.

To the extent we function as a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA) in connection with certain transactions, we handle protected health information in accordance with applicable HIPAA requirements. If you believe your health information has been handled improperly, you may contact the U.S. Department of Health and Human Services Office for Civil Rights.

9. Data Security

We take reasonable administrative, technical, and physical precautions to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These measures include:

• Limiting access to personal information to employees and contractors who need it to perform their job functions
• Using secure, password-protected systems for storing client records
• Conducting our quote and application processes through carrier portals that use industry-standard encryption
• Storing client records and uploaded documents in access-controlled systems with encryption in transit and at rest
• Restricting document access through per-account permissions and serving files only through short-lived, secure links

However, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security of your information. If you believe your information has been compromised, please contact us immediately at (501) 476-4445 or robert@lotusassurance.com.

10. Children's Privacy

Our Site is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected information from a child under 13, please contact us immediately and we will take steps to delete it.

11. Your Rights and Choices

Access and Correction

You may request access to the personal information we hold about you and ask us to correct any inaccurate information. To make such a request, contact us at the information in Section 13.

Opt-Out of Marketing Communications

If you receive marketing emails or text messages from us, you may opt out at any time by following the unsubscribe instructions in the message or by contacting us directly. Opting out of marketing does not affect our ability to send you service-related communications about your insurance policies.

Account Deletion

You can delete your Lotus Assurance client portal account at any time:

• In the mobile App: open Settings → Delete account and confirm. This immediately revokes your client portal and App access.
• By request: email robert@lotusassurance.com or call (501) 476-4445 and ask us to delete your portal account.

Deleting your account removes your access to the client portal and mobile App. As a licensed insurance agency, we may be required to retain certain underlying policy, transaction, and communication records to comply with Arkansas law, insurance-carrier requirements, and our legal obligations (see Section 7, Data Retention); those records are kept only as long as required and are not used to restore portal access after deletion.

Do Not Track

Some browsers send "Do Not Track" (DNT) signals. Our Site does not currently respond to DNT signals. We will update this policy if our practices change.

State Privacy Rights

Certain states have enacted consumer privacy laws that may grant residents additional rights — such as the right to request deletion of personal data. While Arkansas has not yet enacted a comprehensive consumer privacy statute, we are committed to responding reasonably to privacy requests from all individuals. Please contact us to make any such request.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or business operations. When we make changes, we will update the "Last Updated" date at the top of this policy and post the revised version on our Site. We encourage you to review this policy periodically.

Continued use of our Site or services after a policy update constitutes your acceptance of the revised policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact us:

---

This policy was last reviewed July 25, 2026. © 2026 Lotus Assurance. All rights reserved. AR License #21425205.