Privacy Policy

1. Introduction

Welcome to ApprUmp ("Service"), a property loss appraisal management application operated by Tekhnelysi LLC ("Company," "we," "us," or "our"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our web application at apprump.com and any associated mobile applications.

By using ApprUmp, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

2. Information We Collect

2.1 Account Information

When you register for an account, we collect:

• Full name
• Email address
• Password (stored as a salted hash — we never store plaintext passwords)
• Professional title and license information (optional)
• Company name and contact information (optional)
• Phone number (optional)
• Business address (optional)

2.2 Appraisal Data

In the course of using ApprUmp, you may enter data related to your insurance appraisal practice, including:

• Insured party names and contact information
• Property addresses and loss details
• Claim numbers, policy numbers, and carrier information
• Panel member details (appraisers, umpires, attorneys)
• Milestone dates, status updates, and activity logs
• Financial data including time entries, expenses, invoices, and payments
• Notes, correspondence, and appraisal narratives

2.3 Files and Documents

You may upload files to ApprUmp, including:

• Xactimate estimates and other PDF documents
• Photographs of property damage
• Correspondence and legal documents
• Generated forms (Declaration Of Appraisers, Awards, Retainer letters, etc.)
• Invoices and financial documents

Files are stored in Cloudflare R2 cloud storage. Access is isolated by organization and controlled by member permissions; authorized colleagues can access files on appraisals shared within their organization.

2.4 Automatically Collected Information

When you use ApprUmp, we automatically collect:

• IP address and approximate geographic location
• Browser type and version
• Device type and operating system
• Pages visited and features used
• Date and time of access
• Referring URL

2.5 Connected Mailboxes and Mobile Apps

If you connect a Gmail or IMAP mailbox on the web, ApprUmp stores messages and attachments from the folders you choose to sync, including sent mail, and makes them available through your account and permitted appraisal records. The mobile apps display this backend email data; they do not read your device’s mailboxes.

Mobile account information, appraisal records, photos, documents, financial entries, signatures and push tokens are linked to your account. Crash reports are collected when crash reporting is enabled; mobile performance tracing is disabled. The mobile apps do not collect device GPS location or use advertising or cross-app tracking. Property addresses you enter are appraisal data, distinct from device location.

3. How We Use Your Information

3.1 Providing the Service

We use your information to:

• Create and manage your account
• Store and display your appraisal data
• Generate documents, invoices, and forms
• Process inbound emails and file attachments
• Provide calendar scheduling and event management
• Enable search, filtering, and reporting features
• Deliver push notifications and task reminders

3.2 Communication

We may use your email address to:

• Send calendar event invitations and notifications to attendees you designate
• Deliver system notifications about your account
• Respond to your support inquiries
• Send important service announcements (e.g., security alerts, terms updates)

3.3 Service Improvement

We use aggregated, anonymized usage data to:

• Understand how features are used and identify areas for improvement
• Monitor and improve system performance and reliability
• Diagnose technical problems

3.4 Security

We use technical information to:

• Detect and prevent unauthorized access or abuse
• Enforce rate limits and account lockout policies
• Monitor for suspicious activity

3.5 Legal Compliance

We may process your information as required to comply with applicable laws, regulations, legal processes, or governmental requests.

4. AI Processing

4.1 Email Event Extraction

When you forward emails to ApprUmp or connect a Gmail or IMAP mailbox, incoming email content and attachments may be processed by AI models (currently Google Gemini and OpenAI GPT) to suggest calendar events such as site visits, deadlines and meetings. Processing runs in background jobs and the extracted data is stored with the email record.

4.2 Appraisal Field Extraction

When you use AI-assisted features, the following content may be processed by AI models to extract structured data:

• Forwarded and synced emails: Assignment emails forwarded to ApprUmp or received through a connected Gmail or IMAP mailbox are processed to extract appraisal fields such as insured name, property address, claim number, and carrier information. This creates a draft appraisal for your review.
• Uploaded documents: Xactimate estimate PDFs and other documents uploaded to ApprUmp may be processed by AI to extract line items, section structures, and coverage details for use in the Estimate Differences Reports feature.

For these features, AI-extracted data is presented for your review before being applied. You can modify or discard any AI-generated results.

4.3 AI Data Handling

• AI processing is performed via API calls to Google (Gemini) and OpenAI (GPT). We send only the specific email content needed for extraction — not your entire account data.
• We do not use your data to train AI models. We use paid commercial API tiers for both Google Gemini and OpenAI, under terms that exclude submitted data from model training or improvement. Neither provider uses API data submitted through paid tiers to train or improve their models.
• AI-extracted data is always presented for your review before being used. You can modify or discard any AI-generated suggestions.
• A circuit breaker mechanism prevents excessive AI API calls during service issues.

5. How We Store and Protect Your Data

5.1 Data Storage

• Database: Your account and appraisal data is stored in a PostgreSQL database hosted on Railway's infrastructure.
• Files: Uploaded files and generated documents are stored in Cloudflare R2 object storage. Storage paths identify the uploader; access follows organization and appraisal permissions.
• Region: Data is primarily stored and processed in the United States.

5.2 Security Measures

We implement industry-standard security measures including:

• HTTPS/TLS encryption for all data in transit
• HSTS with 2-year max-age and preload directive
• Content Security Policy (CSP) with nonce-based script sources
• Salted scrypt password hashing
• Rate limiting on authentication endpoints
• Account lockout after 10 failed login attempts (15-minute cooldown)
• JWT tokens with issuer/audience claims and short expiration (15-minute access tokens)
• Webhook authentication for inbound email processing
• Organization-level data isolation with per-member permissions controlling access to shared and individually assigned records
• SHA-256 file deduplication to prevent redundant storage

5.3 Data Encryption

• All data in transit is encrypted via TLS 1.2+
• Google OAuth tokens are encrypted at rest using a dedicated encryption key
• Passwords are stored as salted scrypt hashes, never as plaintext; password submissions are protected in transit by HTTPS

6. How We Share Your Information

6.1 Third-Party Service Providers

We share limited data with the following third-party providers who help us operate the Service:

Provider	Purpose	Data Shared
Railway	Application hosting & database	All application data (encrypted at rest)
Cloudflare R2	File storage	Uploaded files and generated documents
Postmark	Inbound email processing	Email content forwarded to ApprUmp addresses
Google (Gemini API)	AI event/field extraction	Email body text and uploaded document content for extraction
OpenAI (GPT API)	AI event/field extraction (fallback)	Email body text and uploaded document content for extraction
Google Maps	Address autocomplete & geocoding	Address strings entered in forms
Gmail and connected IMAP/SMTP providers	Mailbox connection and sending	Account connection credentials, messages and attachments for the mailbox you connect
Sentry	Crash reporting for the mobile apps and the web service, when enabled	Crash data; mobile performance tracing is disabled; no personal data by default
Google Calendar	Calendar sync (user-initiated)	Calendar event details (if sync is enabled)
Firebase (FCM)	Push notifications	Device tokens and notification payloads

6.2 Calendar Event Invitations

When you schedule events and add attendees, ApprUmp sends email invitations via Postmark to the email addresses you provide. These invitations contain event details (date, time, location, description) and the names of other attendees. You control who receives these invitations.

6.3 No Sale of Personal Data

We do not sell, rent, or trade your personal information to third parties for marketing or advertising purposes.

6.4 Legal Requirements

We may disclose your information if required to do so by law, or in the good faith belief that such action is necessary to:

• Comply with a legal obligation or valid legal process
• Protect and defend the rights or property of Tekhnelysi LLC
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of users or the public

7. Calendar Event Invitations

ApprUmp allows you to send calendar event invitations and notifications to professionals, companies, and other contacts in your directory. When you send an invitation:

• The recipient receives an email with event details (date, time, location, description) and an iCal attachment
• Recipients designated as "attendees" receive RSVP-enabled invitations
• Recipients designated as "notify" receive informational notifications without RSVP
• You can customize invitation templates with merge fields from your appraisal and contact data
• Recipients can unsubscribe or request removal by contacting you or us directly

8. Cookies

ApprUmp uses the following cookies:

• Session cookie: Required for authentication. Contains an encrypted session identifier. Expires when you close your browser or after inactivity.
• "Remember me" cookie: Optional persistent cookie for staying logged in across browser sessions.
• Preference cookies: Store your UI preferences (e.g., dashboard day-range selection, dark mode toggle). These are first-party cookies and do not track you across sites.

We do not use third-party tracking cookies, advertising cookies, or analytics cookies.

9. Your Rights and Choices

9.1 Access Your Data

You can access all data you've entered into ApprUmp through the application interface at any time. This includes appraisals, contacts, files, invoices, calendar events, and activity logs.

9.2 Update Your Data

You can update your account information, professional profile, and all appraisal data through the application at any time.

9.3 Export Your Data

You can export your data using the following built-in features:

• Download uploaded files individually or in bulk
• Export invoices as PDF or Excel files
• Download generated documents (DOA/SOU, Awards, Retainer letters) as PDF or DOCX
• Subscribe to your calendar feed via iCal URL

For a complete export of all your data, contact us at privacy@apprump.com.

9.4 Delete Your Data

You can delete individual records (appraisals, contacts, files, invoices, etc.) through the application. To request deletion of your ApprUmp account and associated data, use Settings → Delete Account in the mobile app and confirm your password, or contact us at privacy@apprump.com. We will process deletion requests within 30 days. If you are your organization's last administrator or its billing owner and your organization has other members, you first hand those roles to another member, and the 30 days count from that handover. If no one has taken them over within 30 days of your request, we will contact your organization and complete your request within a further 30 days. See Delete Account for the request steps and retention details.

9.5 AI Processing Controls

Settings → AI Processing controls automatic calendar-event extraction from incoming email and appraisal field extraction from forwarded assignment emails. It does not disable every AI feature: assignment detection on incoming mail (forwarded or from a connected mailbox) and document analysis have separate processing paths.

Alternatively, if you prefer to keep AI processing enabled for some workflows, you can simply ignore or dismiss any AI-generated suggestions (extracted fields, calendar events, estimate analysis results) on a suggestion-by-suggestion basis without disabling the feature entirely.

10. Data Retention

10.1 Active Accounts

We retain your data for as long as your account is active and you continue to use the Service.

10.2 Inactive Accounts

If your account is inactive for 12 consecutive months, we may send a notification to your registered email address. If no response is received within 30 days, we reserve the right to delete the account and associated data.

10.3 After Account Deletion

When your account is deleted (either by your request or due to inactivity):

• Your personal data and appraisal records are permanently deleted from our database within 30 days
• Your files are permanently deleted from cloud storage within 30 days
• Backups are rotated on a fixed schedule: daily backups are kept for 30 days and one backup per month for 12 months, after which any copy of your data they contain is overwritten

10.4 Legal Holds

We may retain data beyond the normal retention period if required by law, legal proceedings, or regulatory requirements.

11. Children's Privacy

ApprUmp is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

12. State-Specific Privacy Rights

12.1 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect and how it is used
• Request deletion of your personal information
• Opt out of the sale or sharing of personal information (we do not sell your data)
• Non-discrimination for exercising your privacy rights

To exercise these rights, contact us at privacy@apprump.com.

12.2 Other States

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws may have similar rights. We will honor all valid privacy requests regardless of your state of residence. Contact us at the email above to exercise your rights.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Notify you via email or a prominent notice within the Service
• Give you the opportunity to review the changes before they take effect

Your continued use of ApprUmp after changes are posted constitutes acceptance of the updated Privacy Policy.

14. Contact Information

If you have questions about this Privacy Policy or our data practices, please contact us: