1.Who we are and what this policy covers
Pikorua Security Private Limited ("Pikorua Security", "we", "us") is a private limited company incorporated in India that builds software for verifying Certificates of Insurance (COIs), insurance endorsements and vendor insurance compliance. Our engineering headquarters is at Shop No-131, LSC-02, Vasundhara Enclave, East Delhi, Delhi 110096, India. US customer data is hosted on Amazon Web Services in the United States.
This policy explains how we handle personal data when you visit pikoruasecurity.com, create or use a Pikorua Security account, upload documents through a broker or vendor upload link, contact us, attend our events or apply for a job. It covers personal data for which Pikorua Security decides the purposes and means of processing. In that role we are a "business" under the California Consumer Privacy Act, a "controller" under the GDPR and a "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023.
When a customer, such as a general contractor or a property manager, uploads vendor certificates, contracts and broker contact details into its Pikorua Security workspace, the customer decides why that data is processed. For that data we act as a service provider and processor under our Terms of Service and Data Processing Addendum. If you are a vendor, subcontractor or broker whose information appears in a customer's workspace, that customer's privacy notice governs. Send us your request and we will route it to the customer and help them answer it.
2.Personal data we collect
We collect the categories below. Some come from you directly, some are generated when you use the service, and some are provided by our customers or by their vendors and brokers.
Account and contact data
Name, work email, job title, company, phone number, password hash or single sign-on identifier, multi-factor authentication settings, your role (Project Manager, Risk Manager, Accountant, Admin or Broker guest) and the projects, properties or entities you can access.
Vendor COI and compliance data
Customers and their vendors upload ACORD 25 Certificates of Liability Insurance, ACORD 28 Evidence of Commercial Property Insurance, state workers' compensation forms, endorsement pages and contract insurance exhibits. These documents are mostly business records, but they can contain personal data:
- Named insured names, which for sole proprietors and single-member LLCs are often an individual's own name
- Producer and broker contact names, email addresses and phone numbers printed on the certificate
- Policy numbers, insurers, NAIC numbers, effective and expiration dates, limits, and endorsement form numbers and editions
- Vendor federal employer identification numbers (FEINs) or taxpayer identification numbers, which for a sole proprietor may be a Social Security number
- Signatures of authorized representatives and certificate holder details
Upload link data
When a broker or vendor uses a zero-login upload link, we record the email address the link was sent to, the files uploaded, the time, the IP address and the browser type. This gives the customer a reliable chain of custody for each document it may later rely on in a tender.
Usage and device data
Pages viewed, features used, searches inside the app, sign-in times, IP address, browser, operating system, device identifiers and approximate location derived from the IP address. Our Cookie Policy lists the cookies and local storage keys involved.
Communications, billing and recruiting data
Messages you send to support, sales or security, call notes, chat transcripts, survey answers and event registrations. Billing contact, company name, billing address and tax details; card payments are handled by Stripe, and we receive only the card brand, last four digits and expiry date. If you apply for a role, your resume, work history, education, interview notes and, where lawful and only after an offer, background verification results.
3.How we use personal data
We use personal data for the following purposes:
- Provide the service: read and extract data from certificates and endorsements, compare them with contract requirements, send deficiency notices and renewal requests, and apply the payment holds or access locks the customer has configured.
- Secure the service: authenticate users, enforce role-based permissions, detect abuse and fraud, investigate incidents and keep audit logs.
- Support customers: answer tickets, troubleshoot connections to Procore, Yardi, AppFolio and other systems, and set up new workspaces.
- Bill and administer accounts: invoices, payment processing, tax compliance and contract notices.
- Improve the product: measure feature use and performance and fix defects, using aggregated usage data wherever we can.
- Communicate with you: product updates, security notices and, where permitted, marketing such as The Risk Transfer Brief newsletter. You can unsubscribe from marketing at any time.
- Meet legal obligations: respond to lawful requests, keep tax and accounting records and enforce our agreements.
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Pikorua Security flags deficiencies; a person at the customer decides whether to hold a payment or restrict site access.
4.AI processing and model training
Pikorua Security uses document AI models to read certificates and endorsement pages. Those models run inside our own AWS environment in the United States. No third-party AI service receives your documents.
We never use customer documents, including COIs, endorsements and contracts, to train or fine-tune our models. Our models are trained on synthetic certificates we generate from blank ACORD layouts and on form templates we license. Customer files are processed in an isolated tenant, the extracted fields are written only to that customer's workspace, and the files are never copied into a training dataset.
We may produce aggregated statistics, such as how often a given endorsement is missing across all reviews, from which no customer, vendor or individual can be identified. Those statistics are never used to train models.
6.How long we keep data
We keep personal data only as long as we need it for the purposes in this policy. Our default periods are:
- Account data: for the life of the account, then deleted within 30 days of closure.
- Customer workspace data, including COIs, endorsements and audit logs: under the customer's retention settings. The default is 7 years after a policy expires, because additional insured tenders can arrive years after a loss. When a subscription ends, the customer has 30 days to export; we then delete the data from production within 30 days and it ages out of encrypted backups within a further 35 days.
- Usage logs: 13 months. Security logs: 1 year online and up to 7 years in encrypted archive.
- Billing and tax records: 7 years, or longer where tax law requires.
- Marketing contacts: until you unsubscribe, or after 24 months without engagement.
- Recruiting data: 24 months after the role closes, unless you ask us to delete it sooner.
7.How we protect personal data
We run an information security program audited every year under SOC 2 Type II. Data is encrypted at rest with AES-256 using keys held in AWS Key Management Service, and in transit with TLS 1.3. FEINs and taxpayer IDs are encrypted at the field level and masked in the interface, and every unmasked view is written to the audit log. Access is role-based, protected by multi-factor authentication and reviewed every quarter. Our Security page and Security Policy describe the program in detail.
No system is free of risk. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.
8.Where we process data
Customer data is hosted on AWS in us-east-1 (N. Virginia) with failover to us-west-2 (Oregon). Our engineering and support teams work from Delhi, India, and from the United States. They access customer data remotely only when needed to support or secure the service, through role-limited sessions that are logged.
When personal data of residents of the European Economic Area, the United Kingdom or Switzerland is transferred to the United States or India, we rely on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), the UK International Data Transfer Addendum and the Swiss equivalents. Remote access by our team in India is covered by the same clauses and by confidentiality obligations in every employment contract.
9.Your rights under US state privacy laws
If you live in California, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) gives you the following rights:
- Right to know and access the categories and specific pieces of personal data we collect, its sources, our purposes and the categories of recipients.
- Right to delete personal data we collected from you, subject to legal exceptions.
- Right to correct inaccurate personal data.
- Right to opt out of sale or sharing. We do not sell or share personal data, and we treat a Global Privacy Control signal as a valid opt-out regardless.
- Right to limit use of sensitive personal information. We use sensitive data, such as account credentials and any Social Security number used as a taxpayer ID, only to provide the service and for the security and legal purposes the law permits.
- Right to non-discrimination for exercising any of these rights.
Categories collected in the past 12 months
In the past 12 months we collected the categories below, as the CCPA defines them. We do not draw inferences to build profiles about you.
- Identifiers: name, email address, IP address, account ID
- Customer records described in Cal. Civ. Code § 1798.80: name, phone number, signature, insurance policy numbers
- Commercial information: subscription and billing history
- Internet or other electronic network activity: usage data described above
- Professional or employment-related information: job title, employer, and for applicants, work history
- Sensitive personal information: account log-in credentials, and Social Security numbers where a sole proprietor uses one as a taxpayer ID
Residents of other states
Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island have similar rights under their state privacy laws, including rights to access, correct and delete personal data, to obtain a portable copy, and to opt out of targeted advertising, sale and profiling. We extend these rights to every US resident, whatever state you live in.
How to make a request
Email dpo@pikoruasecurity.com or call 1800-425-0619. We verify your request by matching details you give us with what we hold, usually your email address plus one other detail. An authorized agent must provide written permission signed by you, and we may ask you to confirm your identity with us directly. We respond within 45 days and may extend once by another 45 days where reasonably necessary, telling you why.
If we decline your request, you can appeal by replying to our decision or by writing to privacy@pikoruasecurity.com with the subject line "Privacy appeal". A member of our legal team who did not handle the original request will respond within 45 days. If you are not satisfied, you may contact your state attorney general.
10.Rights for visitors from the EU, UK and Switzerland
Our service is built for US organizations, but people in the European Economic Area, the United Kingdom and Switzerland visit our website and write to us. For their personal data, Pikorua Security Private Limited is the controller.
Legal bases
- Contract: to provide the service and to act on requests you make before signing up.
- Legitimate interests: to secure the service, improve the product and send business-to-business communications, balanced against your rights and freedoms.
- Consent: for optional cookies and certain marketing, which you can withdraw at any time.
- Legal obligation: for tax, accounting and regulatory records.
Your rights
You have the right to access, rectify and erase your personal data, to restrict or object to processing, to data portability and to withdraw consent. You can object at any time to processing for direct marketing. You may also lodge a complaint with a data protection authority, such as the authority in your country of residence or, in the UK, the Information Commissioner's Office.
Contact our data protection officer at dpo@pikoruasecurity.com. We respond within one month, which the GDPR allows us to extend by two further months for complex requests.
11.Rights in India under the DPDP Act
We process the digital personal data of employees, job applicants, contractors and website visitors in India under the Digital Personal Data Protection Act, 2023 and the rules made under it. For that data, Pikorua Security acts as a Data Fiduciary.
- Notice and consent. We tell you what we collect and why before or when we collect it. Where we rely on consent, you can withdraw it as easily as you gave it; withdrawal does not affect processing already done.
- Legitimate uses. Some processing, such as employment-related processing and compliance with law, relies on the legitimate uses recognized by the Act rather than on consent.
- Your rights. You can ask for a summary of the personal data we process and our processing activities, ask us to correct, complete, update or erase it, and nominate another person to exercise your rights in the event of your death or incapacity.
- Grievance redressal. Write to our Grievance Officer at dpo@pikoruasecurity.com or at our registered office in Delhi. We acknowledge grievances within 2 business days and resolve them within 30 days. If you are not satisfied with our response, you may approach the Data Protection Board of India.
12.Children
Pikorua Security is a business service. It is not directed to children, and we do not knowingly collect personal data from anyone under 16, or under 18 in India. If you believe a child has given us personal data, contact dpo@pikoruasecurity.com and we will delete it.
13.Changes to this policy
We post every update on this page and change the date at the top. If a change materially affects how we use personal data, we email account administrators at least 30 days before it takes effect. Earlier versions are available on request.
14.Contact us
Pikorua Security Private Limited, Attn: Data Protection Officer, Shop No-131, LSC-02, Vasundhara Enclave, East Delhi, Delhi 110096, India.
Email dpo@pikoruasecurity.com for data protection requests (our Data Protection Officer also serves as Grievance Officer for India), or privacy@pikoruasecurity.com for general privacy questions. Toll-free support: 1800-425-0619, 24 hours a day, Monday to Friday.