Privacy Policy.

This Privacy Policy describes how Open Management Group LLC (“Open Management Group,” “OMG,” “we,” “us,” or “our”) collects, uses, discloses, retains, and otherwise processes personal information in connection with ExploreMyInsuranceOptions.com and related services (collectively, the “Services”).

The Services include educational content, advertising and insurance-agency directory services, an online contact-request process, and technology used to facilitate communications between consumers and participating licensed insurance agencies.

OMG operates the Site and determines the information practices described in this Privacy Policy. A participating licensed insurance agency may separately determine how it uses information it receives to respond to your request and provide insurance-related services. That agency’s own privacy notice may also apply to its independent processing.

Questions about this Privacy Policy may be sent to privacy@openmanagementgroup.com.

CALIFORNIA NOTICE AT COLLECTION

For California consumers, this section provides our Notice at Collection. References to rights under the California Consumer Privacy Act (“CCPA”) apply to the extent the CCPA applies to OMG and the information at issue.

Categories of Personal Information We May Collect

Additional Telephone-Compliance Information

When you provide a telephone number, we may obtain telephone-compliance and validation results associated with that number from a service provider, currently RealPhoneValidation. Results may include National and state do-not-call indicators, Direct Marketing Association preference indicators, telephone type, a known-litigator or similar compliance-risk indicator, and related validation or response information.

Purposes of Collection and Use

We use the categories above for purposes including:

• operating, maintaining, and securing the Services;
• processing Contact Requests;
• identifying and displaying an eligible participating licensed insurance agency;
• facilitating communications requested by consumers;
• documenting disclosures, privacy choices, and consent;
• telephone and do-not-call compliance;
• fraud prevention and risk management;
• internal analytics where affirmatively enabled;
• advertising measurement and optimization where affirmatively enabled;
• complaint investigation;
• legal and regulatory compliance; and
• establishing, exercising, or defending legal claims.

Sale and Sharing

OMG does not sell personal information for monetary payment under its current business model.

When you affirmatively select a privacy choice that permits advertising, and no applicable Global Privacy Control signal, Do Not Sell or Share request, or other controlling opt-out prevents the processing, OMG may share limited identifiers, Internet/network activity information, advertising/click identifiers, ZIP/state matching information, and derived conversion/value metadata with Meta Platforms, Inc. for advertising measurement, attribution, audience creation, optimization, and cross-context behavioral advertising.

OMG does not send Meta raw insurance-question responses, raw claims-history responses, roof-age responses, year-built responses, building-size responses, call recordings, transcripts, voicemail contents, text-message contents, or email-message contents for behavioral advertising.

Retention

We retain each category according to the retention criteria described in Section 13.

Your Right to Opt Out

Where applicable, you may opt out of sale or sharing through:

• a qualifying Global Privacy Control (GPC) signal;
• our Do Not Sell or Share My Personal Information page or controls; or
• other privacy controls made available through the Site.

1. INFORMATION WE COLLECT

The information we collect depends on how you interact with the Services and the privacy choices you make.

1.1 Information You Provide

We may collect information you voluntarily provide during the Contact Request process, including:

• first and last name;
• telephone number;
• email address;
• ZIP code;
• property type;
• current insurance situation;
• current insurance carrier or coverage information where requested;
• property-insurance claims history;
• roof age;
• building square footage or size;
• number of building stories;
• year built;
• communication preferences;
• scheduling information; and
• other information you voluntarily provide in connection with your request.

We may also collect information contained in or generated by communications involving OMG or the participating licensed insurance agency identified during the Contact Request process, including:

• telephone-call recordings;
• call transcripts or summaries;
• voicemail;
• text-message communications;
• email communications;
• scheduling information;
• call-routing and transfer records; and
• information you voluntarily provide during those communications.

1.2 Technical and Operational Information

Certain technical information is processed as reasonably necessary to operate, secure, maintain, and provide the Services. Depending on how you use the Services, this may include:

• Internet Protocol address;
• browser type and user-agent information;
• device characteristics and operating system;
• timestamps;
• requested pages and URLs;
• referring URL and landing-page information;
• URL query parameters and advertising click identifiers where permitted;
• security, fraud-prevention, system, and error information;
• session or distinct identifiers; and
• information necessary to remember and enforce your privacy choices.

Optional analytics and advertising processing are governed separately by the choices described below.

2. INFORMATION WE RECEIVE FROM OTHER SOURCES

We receive limited information from third parties where reasonably necessary for telephone compliance, validation, communications, fraud prevention, advertising attribution, or operation of the Services.

2.1 Telephone Compliance and Validation

When you provide a telephone number, we may submit it to a telephone-compliance and validation provider, currently RealPhoneValidation. The provider may return information associated with that number, including:

• National do-not-call indicator;
• state do-not-call indicator;
• Direct Marketing Association preference indicator;
• whether the number is cellular or another telephone type;
• whether the number is associated by the provider with a known TCPA litigator or similar risk indicator;
• related validation information; and
• response or processing codes.

We may associate these results with the applicable Contact Request or lead record. We use them for communications compliance, risk management, fraud prevention, and administration of communications made on behalf of the identified participating licensed insurance agency.

A vendor result does not, by itself, determine whether a particular communication is legally permitted or prohibited.

2.2 Advertising and Traffic Sources

When advertising processing is permitted, we may receive advertising click identifiers, campaign parameters, referral information, or similar attribution data contained in a URL or provided through an advertising platform or traffic source.

2.3 Participating Agencies and Communications Providers

We may receive communication status, scheduling, call-routing, transfer, recording, transcript, summary, or other service information from participating licensed insurance agencies and communications or technology providers when we process those services on behalf of the identified agency.

Under our current practices, we do not purchase generalized social-media profiles, employment histories, or unrelated consumer-marketing dossiers merely because a consumer submits a Contact Request.

3. HOW WE USE PERSONAL INFORMATION

We may use personal information for the following purposes.

3.1 Provide and Operate the Services

We may use information to:

• operate and secure the Site;
• process your Contact Request;
• identify an eligible participating licensed insurance agency;
• display that agency before final submission;
• transmit your Contact Request to that agency after you submit it;
• facilitate requested communications;
• provide support; and
• maintain service functionality.

3.2 Identify and Allocate a Participating Insurance Agency

Before final submission, OMG may use information such as ZIP code, property type, and the applicable insurance/business category to identify participating licensed insurance agencies eligible to receive a Contact Request.

Eligibility may depend on factors including geography, licensing, insurance business focus, and operational availability. Among eligible participating agencies, traffic may be allocated or weighted according to each participating agency’s share of the applicable advertising campaign budget.

This is a paid advertising and traffic-allocation mechanism. It is not a determination that a particular agency is best for you, that an insurance product is appropriate for you, that you qualify for insurance, or that a particular insurer will accept your risk.

The specific participating licensed insurance agency receiving your Contact Request is identified before final submission. The final Contact Request is provided only to that identified agency and is not later rerouted or resold to a different insurance agency without a new consumer request or authorization.

3.3 Compliance and Consent Documentation

We may process information to:

• document disclosures and affirmative choices;
• maintain communications- and TCPA-consent records;
• maintain privacy-choice records;
• conduct telephone and do-not-call screening;
• verify Contact Requests;
• investigate complaints;
• prevent fraud and abuse;
• respond to legal or regulatory inquiries; and
• establish, exercise, or defend legal claims.

3.4 Security and Fraud Prevention

We may process information to secure the Services, identify malicious or fraudulent activity, investigate suspicious submissions, protect consumers and participating agencies, and maintain system reliability.

3.5 Internal Analytics

If you affirmatively select Analytics Only or Accept All, and no controlling privacy signal or preference disables analytics, we may use internal product analytics to understand Site use, diagnose errors, improve user experience, evaluate funnel performance, and measure Site performance.

We currently use Mixpanel, Inc. as a service provider for this internal analytics function. Analytics events are delivered to Mixpanel from our server. Under our current implementation, we instruct Mixpanel not to use the consumer’s IP address for geolocation enrichment and do not send Meta advanced-matching information to Mixpanel. Analytics information may include an internal/distinct identifier, event names, event properties, current URL, and user-agent information.

If you select Reject All, or if an active GPC signal causes the Site to operate in Reject All (essential only) mode, optional analytics is disabled.

3.6 Advertising and Advertising Measurement

If you affirmatively select Accept All, and no controlling privacy opt-out prevents the processing, we may use limited information for advertising measurement, campaign attribution, optimization, audience creation, and targeted or cross-context behavioral advertising.

4. YOUR WEBSITE PRIVACY CHOICES

The Site is designed so that optional analytics and advertising processing does not begin until you make the applicable affirmative choice.

Accept All

Enables:

• essential technologies;
• optional internal analytics; and
• permitted advertising and advertising-measurement processing.

Analytics Only

Enables:

• essential technologies; and
• optional internal analytics.

Advertising-partner sharing remains disabled.

Reject All

Uses technologies and processing reasonably necessary to operate and secure the Site, remember and enforce privacy settings, prevent fraud, and perform other necessary functions. Optional analytics and advertising remain disabled.

You may manage available selections through our Privacy Preferences controls.

A privacy choice concerning analytics or advertising is separate from consent to TrustedForm session documentation, submission of a Contact Request, and communications consent provided to the specifically identified insurance agency.

5. META ADVERTISING AND MEASUREMENT

OMG currently uses Meta Platforms, Inc., including Facebook and Instagram advertising services, for advertising measurement and campaign optimization.

Under our current implementation, OMG does not load a Meta browser Pixel. Eligible Meta events are transmitted server-to-server through Meta’s Conversions API.

5.1 When Meta Processing Is Permitted

OMG does not transmit advertising events to Meta merely because you visit the Site.

Meta advertising processing becomes eligible only when:

• you have affirmatively selected a privacy setting permitting advertising, such as Accept All; and
• no applicable GPC signal, Do Not Sell or Share request, site-level advertising opt-out, or other controlling privacy preference prevents the processing.

5.2 Information That May Be Sent to Meta

Depending on the event and your privacy choices, eligible Meta events may include:

• event name or type;
• page or funnel-event information;
• event identifier;
• the URL associated with the event;
• IP address and user-agent information attached by our server;
• permitted advertising/browser or click identifiers;
• hashed identifiers used for advertising matching; and
• derived conversion or event-value metadata.

When you submit a Contact Request and advertising processing is permitted, matching information may include hashed forms of:

• first and last name;
• email address;
• telephone number;
• state associated with the ZIP code you provided;
• ZIP code; and
• country.

OMG may calculate numeric conversion or event-value metadata from certain funnel responses. This derived value may be sent to Meta when advertising processing is permitted.

OMG does not send Meta the raw contents of insurance responses, raw claims-history responses, roof age, year built, building size, number of stories, call recordings, transcripts, voicemail contents, text-message contents, or email-message contents for behavioral advertising.

Depending on applicable law, the Meta processing described in this section may constitute “sharing,” targeted advertising, or another regulated form of advertising processing.

6. GLOBAL PRIVACY CONTROL AND OTHER OPT-OUT PREFERENCE SIGNALS

We recognize qualifying Global Privacy Control (GPC) signals and other opt-out preference signals where required by applicable law.

6.1 Effect of GPC

Under our current implementation, when an applicable GPC signal is detected:

• optional advertising is disabled;
• optional analytics is disabled;
• applicable advertising and analytics storage is disabled or cleared;
• the browser operates using essential technologies only; and
• the Site displays an indication that the opt-out request was received and honored.

GPC overrides a conflicting Site preference that would otherwise permit sale or sharing subject to the signal.

6.2 GPC Does Not Block the Underlying Contact Request

A GPC or sale/sharing opt-out does not, by itself, prevent you from using the underlying Site or submitting a Contact Request.

TrustedForm session documentation remains a separate affirmative-consent choice. A consumer using GPC may choose whether to provide that separate consent. Where an alternative telephone path is displayed, a consumer may also contact the identified participating insurance agency by telephone.

6.3 If GPC Later Disappears

If a GPC signal later ceases to be detected, OMG does not automatically restart optional analytics or advertising merely because the signal disappeared. The affected categories remain disabled until a subsequent consumer choice permits them in accordance with applicable law.

You may also exercise applicable sale/sharing rights through our Do Not Sell or Share My Personal Information controls.

7. TRUSTEDFORM SESSION DOCUMENTATION

Certain portions of the online Contact Request process use ActiveProspect, Inc.’s TrustedForm technology.

ActiveProspect processes information as a service provider in connection with OMG’s use of TrustedForm.

TrustedForm supports session documentation, consent verification, fraud prevention, regulatory and legal compliance, complaint investigation, recordkeeping, and related purposes.

7.1 Separate Affirmative Consent

TrustedForm does not begin documenting the covered Contact Request interaction through our implementation until you take the affirmative action identified in the applicable session-documentation disclosure, such as clicking “Agree & Continue.”

If you consent, TrustedForm may document information concerning your subsequent interaction with the Contact Request process, including:

• page content and disclosures presented;
• form selections and entries or representations of entries as configured;
• clicks;
• keystrokes or related interaction data as configured;
• scrolling;
• timestamps;
• IP address;
• page URL;
• referral information;
• browser information;
• device information; and
• related session activity.

TrustedForm may generate a consent certificate, session replay, or similar compliance record. Certain form fields may be designated by our implementation for masking, hashing, or other protective handling.

We may use TrustedForm records to document disclosures and consent, verify the Contact Request, prevent fraud, investigate complaints, demonstrate compliance, maintain business records, and establish, exercise, or defend legal claims.

TrustedForm consent is separate from:

• advertising consent;
• analytics consent;
• GPC or a sale/sharing opt-out;
• submission of the final Contact Request; and
• communications consent provided to the identified participating insurance agency.

If you do not consent to TrustedForm, you may decline the online Contact Request process and use an available telephone number to contact the identified agency directly.

8. PARTICIPATING INSURANCE AGENCIES AND PROCESSING ROLES

Participating licensed insurance agencies may contribute funds toward advertising campaigns and may pay OMG for advertising-management, technology, communications, and related services.

Before final submission:

• OMG identifies an eligible participating licensed insurance agency;
• that agency is displayed to you;
• you decide whether to request communication from that agency; and
• the final Contact Request is transmitted only after you submit it.

By submitting the Contact Request, you direct OMG to provide the submitted information to the specifically identified participating insurance agency.

The identified participating agency may independently use your information to respond to your request and provide insurance-related services. OMG may also process information on behalf of that agency as a provider of communications technology, telephone services, AI technology, scheduling, call routing, transcription, hosting, compliance systems, and related services.

The identified agency’s own privacy notice may apply to its independent processing.

9. TELEPHONE, TEXT, EMAIL, AND AI COMMUNICATIONS

OMG may facilitate telephone, text-message, email, scheduling, and AI-assisted communications on behalf of the specific participating licensed insurance agency identified during the Contact Request process.

Depending on the separate consent you provide, communications may use:

• telephone calls;
• text messages;
• email;
• automated technologies;
• automatic telephone dialing technology;
• prerecorded messages;
• artificial voices; and
• AI-generated or AI-assisted voices.

OMG currently uses Vapi to support certain AI communications. Vapi is currently configured to use OpenAI as an AI model provider. We may test, add, replace, or use additional AI model or technology providers in the future, subject to applicable contractual and privacy requirements.

Our automated communication tools do not independently provide insurance quotes, recommend insurance coverage, determine insurance eligibility, make underwriting decisions, negotiate policy terms, accept insurance applications, bind coverage, or issue insurance policies.

10. CALL RECORDING AND TRANSCRIPTION

Where separately disclosed and permitted by applicable law, telephone calls may be recorded, transcribed, summarized, analyzed, and retained.

These records may be used to:

• respond to your request;
• confirm information;
• schedule appointments;
• route or transfer calls;
• monitor service quality;
• document disclosures and consent;
• maintain compliance records;
• prevent fraud;
• investigate complaints;
• secure the Services; and
• establish, exercise, or defend legal claims.

Recorded calls facilitated through the Services are intended to include an audible recording disclosure. Written recording or transcription consent may also be obtained during the Contact Request process.

OMG does not sell or share call recordings, call transcripts, voicemail messages, text-message contents, or email-message contents for cross-context behavioral advertising.

11. SERVICE PROVIDERS AND OTHER RECIPIENTS

We may disclose information to vendors and service providers that process information for OMG or on behalf of a participating insurance agency. Depending on the Service, these may include providers of:

• cloud hosting and data storage;
• telecommunications, telephone, email, and messaging services;
• AI and language-model services;
• transcription;
• consent documentation;
• telephone validation and DNC compliance;
• fraud prevention and security;
• internal analytics;
• website infrastructure; and
• other operational services.

Current providers may include ActiveProspect/TrustedForm, RealPhoneValidation, Mixpanel, Vapi, OpenAI, telecommunications providers such as Twilio, cloud/service infrastructure providers, and other vendors used to operate the Services.

Where required by applicable law, we use contracts designed to restrict service providers to permitted purposes and require appropriate privacy protections.

Meta as an Advertising Recipient

Meta is treated separately from ordinary operational service providers when we transmit personal information for advertising measurement, audience creation, optimization, or cross-context behavioral advertising. That processing occurs only as described in Section 5 and is subject to applicable privacy choices and opt-outs.

12. OTHER DISCLOSURES OF INFORMATION

We may also disclose personal information:

At Your Direction

For example, when you submit a Contact Request directing us to provide your information to the specifically identified participating licensed insurance agency.

For Legal, Security, and Compliance Purposes

We may disclose information when reasonably necessary to comply with law, respond to legal process or governmental requests, enforce agreements, protect rights or safety, investigate fraud or security incidents, or establish, exercise, or defend legal claims.

Business Transactions

Information may be disclosed or transferred as part of a merger, acquisition, financing, restructuring, sale of assets, bankruptcy, or similar transaction, subject to applicable law.

13. HOW LONG WE RETAIN INFORMATION

We retain personal information only for as long as reasonably necessary and proportionate to fulfill the purposes for which it was collected, another disclosed compatible purpose, or applicable legal and compliance requirements.

The applicable retention period depends on the nature of the information and why it is maintained. In determining retention, we consider:

• the time reasonably necessary to process and document Contact Requests;
• advertising and participating-agency contractual requirements;
• the need to document disclosures, consent, communications authorization, and privacy choices;
• TCPA, telemarketing, DNC, privacy, insurance, communications, and other compliance obligations;
• complaint and dispute investigation;
• security and fraud-prevention needs;
• regulatory inquiries;
• applicable statutes of limitation;
• preservation of evidence and legal holds;
• establishment, exercise, or defense of legal claims;
• contractual and recordkeeping obligations; and
• technical backup and disaster-recovery practices.

Examples include:

Contact Request and lead information: retained while reasonably necessary to administer and document the request, provide contracted services, support compliance, investigate complaints, and protect legal rights.

TrustedForm and consent records: retained while reasonably necessary to demonstrate disclosures, document consent, investigate complaints, satisfy compliance obligations, and protect legal rights.

Call recordings and transcripts: retained while reasonably necessary for communications services, quality assurance, compliance, complaint handling, and legal purposes.

Privacy-rights and opt-out records: retained for applicable compliance periods. Where the CCPA applies, records of CCPA consumer requests and responses are maintained for at least the period required by applicable regulation.

Security and operational logs: retained according to operational, security, fraud-prevention, and legal requirements.

When personal information is no longer reasonably necessary for an applicable purpose, we delete or deidentify it, subject to legal holds and reasonable backup or archival processes.

14. SECURITY

We maintain administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, acquisition, disclosure, alteration, destruction, and misuse.

No Internet transmission, telecommunications system, or data-storage system can be guaranteed to be completely secure.

15. CHILDREN

The online Services and Contact Request process are intended for adults who are at least 18 years old.

We do not knowingly solicit or collect personal information through the Contact Request process from persons under 18. If we learn that we have collected personal information from a person under 18 in circumstances inconsistent with this Policy, we will take reasonable steps to delete it where appropriate.

16. CALIFORNIA PRIVACY RIGHTS

Subject to applicable law, exceptions, and verification requirements, California consumers may have rights to:

• know whether and how we process personal information;
• request access to categories and specific pieces of personal information;
• request correction of inaccurate personal information;
• request deletion;
• opt out of sale or sharing;
• receive information about categories of sources, purposes, and recipients; and
• exercise CCPA rights without unlawful retaliation or discrimination.

Qualifying GPC signals may be used to communicate an opt-out of sale or sharing.

We do not use communication contents or other sensitive personal information for cross-context behavioral advertising. If we use or disclose sensitive personal information in a manner that triggers a right to limit under applicable California law, we will provide the required mechanism.

17. PRIVACY RIGHTS IN OTHER U.S. STATES

Residents of certain U.S. states may have additional privacy rights under applicable state law. Depending on your jurisdiction and the law applicable to OMG, these may include rights to:

• access personal data;
• correct inaccuracies;
• request deletion;
• obtain a portable copy;
• opt out of targeted advertising;
• opt out of sale;
• opt out of certain profiling; and
• appeal certain privacy-rights decisions.

The availability and scope of these rights vary by state.

18. EXERCISING YOUR PRIVACY RIGHTS

You may submit an applicable privacy request by:

• using the Data Subject Access Request form on the Site’s Privacy Preferences page;
• emailing privacy@openmanagementgroup.com;
• visiting the Site’s Contact page; or
• using an applicable Privacy Preferences or Do Not Sell or Share mechanism.

We may need to verify your identity before fulfilling certain requests. Information provided for verification will be used only for purposes reasonably related to processing and securing the request.

Where applicable law permits an authorized agent to submit a request, we may require appropriate proof of authorization and verification.

19. APPEALS

If applicable state law provides a right to appeal a privacy-rights decision, you may submit an appeal by emailing privacy@openmanagementgroup.com. We will respond as required by applicable law.

20. DO NOT TRACK

Some browsers provide a traditional Do Not Track (DNT) setting. Because ordinary DNT is distinct from legally recognized opt-out preference signals and does not operate as a uniform legal mechanism, OMG does not treat ordinary DNT as equivalent to GPC unless applicable law requires otherwise.

We recognize qualifying GPC and other opt-out preference signals as described in Section 6.

21. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect changes in our Services, technologies, vendors, information practices, or applicable legal requirements.

The “Last Updated” date identifies the most recent revision. Where applicable law requires additional notice or a new affirmative choice for a material change, we will provide the required notice or obtain the required choice before engaging in the affected processing.

22. CONTACT US

Questions about this Privacy Policy or our privacy practices may be directed to:

privacy@openmanagementgroup.com