Privacy Policy.

01Who We Are

Onyx Claims is a documentation-preparation business that produces Xactimate® scope-of-loss estimates for residential and small-commercial contractors based exclusively on photographs, measurements, and other information that contractors submit to us. Our customers are contractor businesses ("Contractors"). We do not provide services directly to property owners, and we are not a public adjuster, insurance adjuster, attorney, or party to any insurance claim.

For privacy questions, contact us at Estimates@onyxclaims.com.

02Scope of This Policy

This Policy describes how we handle personal information about:

• Contractors and their personnel — the individuals who create accounts, submit jobs, and communicate with us;
• Visitors to onyxclaims.com; and
• Third parties whose information appears in Contractor-submitted materials — most commonly the property owner at the loss location (names, addresses, photographs of the property, claim-related information).

For third-party information, the Contractor — not Onyx Claims — has the direct relationship with that third party and is responsible for obtaining any consent or notice required under applicable law before sharing the information with us. See Section 11 of the Terms of Service.

03Information We Collect

A. Information you provide to us

• Account information. When you register for an account: name, business name, email address, phone number, password (stored hashed, never in clear text), and any optional profile fields you choose to add.
• Brand profile. If you set up a brand profile for cover-page branding of deliverables: business name, logo image, business address, business phone, business email, and any other branding fields you provide.
• Payment information. Payment card or bank details are entered into and processed by our third-party payment processor. We do not receive or store full payment card numbers on our own systems. We do receive and store limited payment metadata — such as the last four digits of your card, card brand, expiration month/year, billing zip code, and a customer identifier — for fraud prevention, billing history, and tax purposes.
• Job submission content. When you submit a job: property address, photographs, measurements, sketches, claim-related notes, the type and scope of damage, any add-on selections, and any other materials or instructions you provide.
• Communications. When you email or otherwise contact us: your message and any attachments, plus our reply.

B. Information collected automatically

• Log and device data. When you use the Services, our servers and hosting providers automatically log certain information including IP address, browser type and version, operating system, referring URL, pages visited, timestamps, and approximate location derived from IP.
• Cookies and similar technologies. We use first-party cookies and similar technologies that are strictly necessary to authenticate your session, remember your preferences, and operate the Services. If we use any non-essential analytics or performance cookies, we will disclose that and provide an opt-out where required by applicable law.

C. Information from third parties

We may receive information about you from our payment processor (e.g., payment confirmations, dispute notices, fraud signals) and from email or anti-abuse providers we use to operate the Services.

D. Sensitive personal information

We collect a limited category of "sensitive personal information" as that term is defined under the California Privacy Rights Act ("CPRA"): account log-in credentials (your password, stored hashed) and limited financial account information (the metadata our payment processor passes back to us). We use this information only for the purposes for which it was collected — operating your account and processing payments — and not for the purpose of inferring characteristics about you. We do not use or disclose sensitive personal information beyond the purposes permitted by Cal. Civ. Code § 1798.121.

04How We Use Information

We use the information described above to:

• create, authenticate, and maintain your account;
• prepare, quality-check, and deliver Xactimate® estimates and other deliverables based on your job submissions;
• apply your brand profile to deliverables when you have requested branding;
• process payments, calculate volume-tier discounts, generate invoices and receipts, and maintain billing records;
• respond to your support requests and other communications;
• send transactional messages (account notices, job confirmations, delivery notifications, billing notices, security alerts, and changes to legal terms);
• detect, prevent, and investigate fraud, abuse, unauthorized access, and violations of the Terms;
• operate, maintain, monitor, secure, and improve the Services;
• comply with applicable law, respond to valid legal process, and enforce our Terms.

We do not use Contractor-submitted job content (photos, measurements, addresses, claim notes) for marketing, profiling, automated advertising, or any purpose unrelated to producing your deliverable and operating the Services.

05How We Share Information

We share personal information only as follows:

• Service providers. We share information with vendors that operate parts of the Services on our behalf, under written contracts that limit their use of the information to providing services to us. This includes our payment processor, hosting and cloud-storage providers, email and notification providers, anti-abuse and security providers, and the developers and operators of Xactimate® and any other estimating tools we use to produce deliverables.
• Delivery of work product. Job content is processed and used internally to produce the deliverable that is then returned to you.
• Legal and safety. We may disclose information when we reasonably believe disclosure is required by law, valid legal process (such as a subpoena or court order), or governmental request; to enforce our Terms; to protect our rights, property, or safety, or those of our Contractors, employees, or the public; or to investigate fraud, abuse, or security incidents.
• Business transfers. If Onyx Claims is involved in a merger, acquisition, financing, reorganization, sale of assets, or bankruptcy, your information may be transferred to the acquiring or successor entity, subject to the protections of this Policy.
• With your consent. With your prior consent or at your direction.

06We Do Not Sell Personal Information; We Do Not "Share" for Cross-Context Behavioral Advertising

Onyx Claims does not sell personal information for money or other valuable consideration, and does not "share" personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act ("CCPA") and CPRA. We have not done so in the preceding 12 months.

We do not use Contractor-submitted job content to train any third-party advertising, recommendation, or generative-AI model that is not under our control and not subject to confidentiality obligations consistent with this Policy.

07Data Retention

We retain personal information for as long as it is needed to provide the Services and to satisfy the purposes described in this Policy, including:

• Account data: for the life of your account, plus a reasonable wind-down period after closure.
• Job submissions and deliverables: for the life of your account, so that you can access your order history. We may retain copies in backup systems for a limited period after deletion.
• Payment records and tax records: for the period required by applicable tax, accounting, and anti-fraud laws (generally up to seven years).
• Support communications and legal records: for as long as reasonably necessary to address the matter and to defend potential claims, consistent with the limitation periods in our Terms.

When personal information is no longer needed, we delete, de-identify, or aggregate it, or, if deletion is not technically feasible (e.g., in encrypted backups), we securely isolate it until deletion is feasible.

08Data Security

We use commercially reasonable administrative, technical, and physical safeguards to protect personal information, including encryption in transit (TLS), hashing of passwords, access controls limited to personnel with a need to know, and ongoing monitoring of our systems.

No method of transmission or storage is perfectly secure. We cannot guarantee absolute security and will not be liable for unauthorized access, disclosure, alteration, or destruction caused by third parties or by events beyond our reasonable control.

If we become aware of a personal-information breach that affects you, we will notify you and any applicable regulator as required by law.

09Your Privacy Rights

A. Rights available to all Contractors and visitors

You may, at any time:

• update your account information by signing in to your account;
• close your account by emailing Estimates@onyxclaims.com;
• ask us a question about how we handle your information by emailing Estimates@onyxclaims.com.

B. California residents (CCPA / CPRA)

If you are a California resident, you have the following rights with respect to personal information we maintain about you:

• Right to know / right of access. You may request that we disclose the categories of personal information we have collected about you, the categories of sources, the categories of third parties to whom we have disclosed it, our purposes for collecting it, and the specific pieces of personal information we have about you.
• Right to delete. You may request that we delete personal information we have collected from you, subject to exceptions allowed by law (for example, to complete a transaction, detect fraud, comply with a legal obligation, or maintain records required for tax or accounting purposes).
• Right to correct. You may request that we correct inaccurate personal information about you.
• Right to opt out of sale or "sharing." As stated in Section 06, we do not sell personal information and do not "share" it for cross-context behavioral advertising, so there is nothing to opt out of. We will treat any future change in our practices as a material update to this Policy.
• Right to limit use of sensitive personal information. You may request that we limit our use of sensitive personal information to the purposes permitted by Cal. Civ. Code § 1798.121. As described in Section 03(D), we already limit our use to those purposes.
• Right to non-discrimination. We will not discriminate against you for exercising any of these rights.

C. How to exercise your rights

To submit a verifiable consumer request, email Estimates@onyxclaims.com with the subject line "Privacy Request" and tell us which right(s) you wish to exercise. We will need to verify your identity, which generally means confirming control of the email address associated with your account and may require additional information for sensitive requests.

You may use an authorized agent to submit a request on your behalf; we will need written proof of authorization plus verification of your identity. We will respond to verifiable requests within the timelines required by applicable law (generally 45 days, extendable by another 45 days where permitted).

10Children's Privacy

The Services are intended for use by contractor businesses and are not directed to children. We do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, please contact us at Estimates@onyxclaims.com and we will take appropriate steps to delete it.

11Do Not Track and Global Privacy Control

Some browsers transmit "Do Not Track" or "Global Privacy Control" (GPC) signals. Because we do not sell personal information and do not "share" it for cross-context behavioral advertising, these signals do not currently change our practices. If our practices change, we will treat GPC signals as a valid opt-out request to the extent required by law.

12Third-Party Links and Services

The Services may link to third-party websites or services (for example, our payment processor's hosted payment page). We are not responsible for the privacy practices of those third parties. Their handling of your information is governed by their own privacy policies, and we encourage you to review them.

13Geographic Scope

Onyx Claims is based in the United States and operates the Services from the United States. We do not market the Services to residents of the European Union, the United Kingdom, or other jurisdictions outside the United States, and we ask that you not submit personal information to us from those jurisdictions. If you nevertheless do so, you acknowledge that your information will be processed in the United States, which may not provide the same level of data protection as the laws of your country.

14Changes to This Policy

We may update this Privacy Policy from time to time. The current version is always available at onyxclaims.com with the "Last Updated" date shown above. Material changes will, where practicable, be communicated by email to the address on file for active Contractors or by a notice posted on the Services. Your continued use of the Services after the effective date of a change constitutes your acceptance of the updated Policy.

15Contact Us

If you have questions, concerns, or requests regarding this Policy or our handling of personal information:

Onyx Claims
Email: Estimates@onyxclaims.com
Subject line for privacy requests: "Privacy Request"