Who we are
Holloway, including Riley and this website at holloway.tech, is published by Holloway Labs, Inc., a Delaware corporation based in Indianapolis, Indiana, USA.
Riley is an AI employee for independent property and casualty insurance agencies in the United States. Its first job is Renewals Coordinator: it works each commercial renewal from 120 days out, drafts the emails for a person at the agency to approve, and keeps a record of every step.
Riley is in development. It has no customers yet, and it isn't emailing any agency's clients. We let agencies in from the waitlist a few at a time. When it's an agency's turn, it gets a 30-day free trial with no card. Where this policy describes something that is planned or still being built, it says so.
In this policy, “we”, “us” and “our” mean Holloway Labs, Inc. “Agency” means an insurance agency or other business that uses Riley, including during a free trial or a slip check. “Clients” means that agency's customers and their contacts.
United States only. Holloway is offered only to businesses in the United States.
Our two roles
The law treats us differently depending on whose information it is. This matters for everything below.
Our website, waitlist and emails: we decide
When you visit holloway.tech, join the waitlist, use the contact form or write to us, we decide how your information is used. This policy is our notice to you about it.
An agency's data in Riley: we work for the agency
When an agency uses Riley, the agency decides how its data is used. We process it on the agency's behalf, as its service provider, only under its instructions and our agreement with it. The agency owns its data.
An agency's client and policy information is “nonpublic personal information” under the Gramm-Leach-Bliley Act and the state insurance privacy laws that carry it out. State insurance data security laws also expect an agency to choose service providers that protect that information. So, for an agency's data, we:
- use and disclose it only to provide Riley for that agency;
- don't reuse it or share it for our own purposes;
- protect it with administrative, technical and physical safeguards suited to how sensitive it is (see section 10 for what is built and what isn't yet);
- tell the agency without unreasonable delay if a security incident affects it;
- sign a written service-provider or data processing agreement if the agency asks.
The agency's own privacy notice tells its clients how the agency uses their information. Under state privacy laws such as California's, this makes us the agency's “service provider” or “processor”, not a business that decides how that data is used.
What we collect on our website
This section covers holloway.tech, the waitlist, the contact form and email. At a glance, then in more detail.
| When | What | Where it's kept |
|---|---|---|
| Visiting our website | Your IP address and basic browser and device details, which our website host processes to deliver pages and protect the site. Page views and page speed, counted by Cloudflare Web Analytics without cookies. Your invite code, if you came through an invite link, kept in your browser until you close the tab | Processed by Cloudflare. Not added to our waitlist or contact records |
| Joining the waitlist | Your email, first name and role, who you're joining for, where renewals slip at your agency (if you tell us), the page you joined from, your invite code and the one you came with, your place in line, when you joined, whether and when you confirmed, and which version of our Terms you agreed to. No IP address | Our waitlist database at Cloudflare. Resend sends our emails and, once you confirm, keeps your name and email on our waitlist mailing list |
| Contact form | Your name, email, topic and message, your agency's name, team size and management system if you give them, the page you wrote from, and the time | Our contact database at Cloudflare |
| Emails you send us | Your email address, name and message, when you write to [email protected] or reply to one of our emails | Forwarded by Cloudflare's email routing to our inbox, which Microsoft hosts (Microsoft 365) |
The waitlist
On the home page you can start with just your email. We save it at once and send the confirmation email, then add your first name and role when you give them. We email you a link to confirm your address. Your spot counts once you confirm. Only then do we add you to our waitlist mailing list, and our own inbox gets a short notice with your first name, email, role and who you're joining for.
Keeping the forms safe
To stop automated sign-ups, the forms use a hidden field that bots fill in, a site-wide limit on new sign-ups and messages in any ten minutes, and a check that your email's domain can receive mail. Nothing from the domain check is stored. Cloudflare may also limit how often one connection can send a form. We may use Cloudflare Turnstile on our forms to tell people from bots. When it's on, Cloudflare runs a check in your browser and receives your IP address and browser details to do it.
Please don't put client names, policy details or other personal information about anyone else in our forms.
The free slip check
If you ask for a slip check, we write back with how to send the renewal file. Nothing is sent until your agency says so in writing. A file your agency sends is the agency's data, and we handle it as section 04 describes, only to make the one-page report.
What Riley handles for an agency
Riley reads what an agency sends it, and nothing more. It has no access to the agency's management system. We handle all of this as the agency's service provider (section 02).
- The renewal list. A book report or CSV the agency exports from its management system and emails or uploads to Riley: insureds, contacts, policies, terms, carriers, premiums, renewal dates and the account manager on each policy.
- Riley's own mailbox. Messages to and from Riley's address on the agency's domain, with their attachments. The agency adds a few DNS records so Riley can send from that address.
- Emailed book reports. A book report sent to the agency's private report address, which our email provider hosts, is read into the renewal list. We plan to delete the stored copy of the email, with the report attached, 90 days after Riley handles it.
- Emails the agency forwards. Carrier renewal offers, quotes, dec pages and loss runs. Riley pulls out figures such as the premium, dates, payroll, revenue and vehicles, and shows where each one came from. These documents can include claim details.
- Client replies. Whatever clients write back to Riley's requests.
- The team list. Staff names, emails and roles, so people can sign in and approve Riley's drafts.
- Setup details. The agency's house rules and its carrier contacts.
- The activity log. Every send, approval, rule change, login and export, and who did it. It is only added to, and the agency can export it as the Renewal record for its E&O file.
- Text messages, when texting is available. Riley doesn't send texts today. Texting comes once carrier registration clears. Then Riley would handle client phone numbers and texts, a client must reply YES before Riley sends one, and STOP ends it. We don't share mobile numbers or text opt-in information with anyone for their marketing.
What Riley never asks for
Riley never asks clients for Social Security numbers, birth dates or driver's license numbers by email. A secure upload form for sensitive items is planned, not built. Agencies shouldn't upload health information, payment card numbers or government ID numbers to Riley. If a client sends them anyway, the agency decides how to handle them under its own policies, and can ask us to remove them.
What Riley doesn't connect to
- The management system. Riley works from the book report or CSV the agency sends. A direct connection is planned, and it would only be switched on if the agency opts in.
- Your own mailboxes. Riley doesn't sign in to the agency's Microsoft 365 or Google mail. People forward to Riley from their own mail, and that provider's own terms and privacy policy cover those mailboxes.
A person decides
Riley tells clients it is an AI employee in the first message of every thread and in its signature. Client emails stay held until a lawyer has reviewed the templates and disclosures, and while Riley is in training every email waits for the agency's account manager. Both are being built as hard stops in the software.
How we use it
Website, waitlist and email
- Run the waitlist: confirm your email, keep your place, let agencies in, and see which sign-ups came through your invite link.
- Email you about your spot, your trial and Riley. You can unsubscribe at any time (section 11).
- Answer your messages and run the slip check you ask for.
- Decide what Riley does next, from what people tell us about where renewals slip.
- Keep the site and forms safe, and meet our legal obligations.
An agency's data
Only to provide Riley for that agency: to set it up, read the renewal list, offers and replies, draft and send the emails the agency approves, keep the record, support the agency, and keep Riley safe and working. We also use it where the law requires.
What we never do
- We don't sell personal information.
- We don't use it for advertising, and we don't share it for targeted advertising.
- We don't use an agency's data to train AI models for other customers or anyone else.
- We don't use an agency's client data to contact its clients for our own purposes.
AI processing
Riley uses an AI model from an outside AI provider to read offers and replies and to draft emails. We send the provider only the text a task needs, such as a client's reply, the part of a carrier offer to read, or the facts for a draft. The website and its forms don't send anything to the AI provider.
What we're still confirming. We're asking our AI provider for a written promise not to keep what we send it, and an agreement not to train its models on it. Neither is in place yet. Until both are in place, we don't send any real agency's data to the AI provider.
We keep records of Riley's AI requests and answers (AI traces) and crash reports, with outside companies, to check and fix Riley's work. Masking personal data in those records is planned, not built, so until then they can contain an agency's data. They're used only for that work.
AI output can be wrong. That's why a person approves Riley's emails while it is in training, and why Riley shows the sentence each number came from.
Where it's stored
- Website, waitlist and email. With Cloudflare, Resend and Microsoft, as section 07 describes. Cloudflare's network serves pages around the world, so website requests may be processed outside the United States.
- An agency's data. In Holloway's cloud service, with the providers in section 07. We plan to keep the database and the app in the United States (US East). We are still confirming the production regions, and document storage is still to be set up in that region.
- Documents. Dec pages, quotes and loss runs are being built to be stored privately, with no public links. A document opens only through a short-lived signed link, filed under the agency that owns it.
Keeping and deleting it
Website, waitlist and email
- Waitlist. Kept while the waitlist and trials run, or until you ask us to delete it. If you don't confirm your email, we plan to delete your sign-up after 90 days. Until that runs automatically, we do it by hand.
- Contact messages and emails you send us. Kept for up to 2 years after our last reply, then deleted.
- Unsubscribing stops our emails. To have your details deleted too, write to [email protected].
An agency's data
- While the agency uses Riley. Kept so Riley can do its work and the record stays complete. The agency can export it at any time: CSV files, PDFs and a mail archive, plus the activity log as the Renewal record for its E&O file.
- When a trial or subscription ends. The agency can export its data for 30 days. After that, we plan to delete it within 90 days: database records, documents and Riley's mailbox. Backups are deleted as they expire. A legal hold, or anything the law requires us to keep, overrides deletion.
- What isn't built yet. The automated deletion job is still being built. How the activity log is handled when an agency leaves is still being decided. The agency's agreement with us sets the details.
- Keep your own copy. An agency's own record-keeping duties still apply to it, so it should keep its own export.
- On request. An agency can ask us to remove an item, such as a slip-check file or a Social Security number a client sent anyway.
Security and incidents
Our Security page lists what is in place, what is designed and being built, and what isn't done yet. In short:
- In place on this website. HTTPS only, security headers on every page, no advertising trackers, no IP address stored with waitlist sign-ups, and abuse checks on the forms.
- Riley, by design and being built. Encrypted connections only, each agency's data kept apart at the database level, roles enforced on the server, private documents, an activity log that is only added to, no login to the management system, and a person approving every email in training.
- Planned. Extra encryption of sensitive fields, personal data masked in logs, a secure upload form, and a written breach response plan.
- Still to confirm. Encryption of stored data on our own accounts, where the data lives, and who on our side can use the support role and how that is logged.
- Not held. We have no SOC 2 or ISO 27001 certification, and no outside penetration test has been done.
No system is perfectly secure, so we can't promise that information will never be accessed without permission.
If something goes wrong
If we learn of a security incident that affects your information, we'll tell you without unreasonable delay, and within the time the law where you live requires. For Indiana residents that is no more than 45 days after we find it, and we'll also tell the Indiana Attorney General when the law requires.
If an incident affects an agency's data, we'll tell the agency without unreasonable delay, with what we know, so it can meet its own duties to its clients and its regulators. Some state insurance laws give an agency only a few days to notify its regulator, so we'll move quickly.
To report a security issue, write to [email protected] with “Security” in the subject.
Your choices and rights
Emails from us
Every email we send about the waitlist or Riley says how to stop them. Reply and say unsubscribe, or write to [email protected]. We act on it within 10 business days. We may still send messages you need about a trial or account you have with us.
Anyone can ask
Wherever you live, you can ask us what personal information we hold about you, ask for a copy, and ask us to correct or delete it. Write to [email protected]. We may need to confirm it's you first. We answer within 45 days, and if we need more time we'll tell you why. We won't treat you differently for asking. If we turn down a request, you can appeal by replying to our answer, and if you're still not satisfied you can contact your state attorney general.
US state privacy rights
Some states, including California, Virginia, Colorado, Connecticut, Texas and Indiana, give residents rights over their personal information. Depending on the state, these include the right to know what is collected and how it is used, to get a copy, to correct it, to delete it, to opt out of its sale, sharing or use for targeted advertising or profiling, to limit the use of sensitive information, and not to be treated differently for using these rights. These laws apply only to businesses over certain size thresholds, and many of them don't cover information protected by the Gramm-Leach-Bliley Act or people acting in a business role. We honor these requests from anyone, whether or not a law requires it. You can use an authorized agent to make a request for you.
We don't sell or share personal information or use it for targeted advertising, so there is nothing to opt out of. If that ever changes, we'll update this policy first and honor opt-out signals such as Global Privacy Control.
If you work at an agency that uses Riley
Your agency controls the team list and the role each person has. Ask your agency's owner or manager to change them, or write to us.
If you're a client of an agency that uses Riley
Riley works for your agency, and your agency decides how your information is used. Please contact your agency first, about your information or about the emails Riley sends. If you write to us, we'll pass your request to your agency and help it answer, as our agreement with it allows.
If you're in the EU, UK or Switzerland
Holloway isn't offered there. If you gave us your details, for example by joining the waitlist, write to [email protected] and we'll delete them.
Children
Riley is a business service, and the people who use it must be 18 or older. Our website isn't meant for children, and we don't knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us information, write to [email protected] and we'll delete it.
Changes to this policy
We'll update this policy as Riley is built. When we do, we'll post the new version here and change the “Last updated” date. If a change is significant, we'll tell people on the waitlist and agencies using Riley by email before it takes effect. We won't use information we already have in a materially different way without your consent where the law requires it, and a change to this policy never overrides our agreement with an agency about its data.
Contact us
For privacy questions or requests, to ask for our data sheet, or to report a security issue, write to us. We read every message.