Privacy notice

The controller is INNOV4 AI S.A.C. ("INNOV4," "we," "us"), RUC 20616317769, based in Magdalena del Mar, Lima, Peru. Estimate Radar and Radar de Estimados are trade names for the same product, operated at https://estimateradar.com.

One channel for privacy, data rights, incidents, and any question about this notice: hola@estimateradar.com. Write in English or Spanish; we answer in whichever you use.

INNOV4 is a Peruvian company. The service is sold to U.S. businesses and the infrastructure sits outside Peru. That means two legal frameworks live side by side, and further down we say exactly which one governs what.

As a CONTROLLER, we decide what the data is used for. That covers what you leave in the website form and your panel account details: email, name, and not much else.

As a PROCESSOR, we handle data on a customer’s behalf and on their instructions. That covers everything living inside the mailbox you connect and inside your CRM: the correspondence with carriers, adjuster names and email addresses, claims, and homeowner details. There, you decide and we execute.

The practical consequence: if you are a customer and you want your operational data deleted, that call is yours and we carry it out. If you are a third party who shows up in that correspondence — an adjuster, a homeowner — we route your request to the customer who connected the mailbox, because they are the controller for that data. Section 9 explains how.

From the access request form on the website: name, company, and email, which are required, plus — only if you type them — phone, U.S. state, monthly estimate volume, and your message. We also store the language you arrived in and which section of the page you submitted from. We use it to reply, schedule the guided demo, and track the conversation. None of it feeds advertising and none of it is handed to anyone.

From your panel account: name, email address, and your role within your organization. Identity is handled by Supabase Auth; we do not store your password and we never see it.

If you turn on browser notifications: the device identifier the browser generates so we can deliver the alert. It is not your phone number and not your location — it is a technical address you can revoke from the browser itself.

The public website carries no analytics, no advertising pixels, and no third-party cookies. The panel uses strictly necessary session cookies to keep you signed in: without them there is no way to know it is you.

From the Gmail mailbox you connect: when you authorize the connection, Google hands us a revocable read grant over that mailbox. We want to be precise here, because this is where most privacy notices shade the truth: the grant Google issues covers the mailbox, not a folder. What narrows the scope is not the grant — it is what our system does with it.

What our system does: it looks at new messages arriving from the moment you connect, and runs each one through a classifier to decide whether it relates to an estimate sent to a carrier. It looks at everything that arrives, including what Gmail filed as spam, but not the trash. Messages that have nothing to do with one go no further: they are marked as noise and that is the end of it.

For each message examined we store: sender, subject line, the Gmail message and thread identifiers, date, the classification result and its confidence score, and the token counts consumed. The message BODY is not stored in our database.

For estimates we detect: subject, recipients, send date, amount, state, response windows the carrier promised, and follow-up dates. For drafts: the proposed subject and text, the reason the engine proposed it, and — if you edited it before approving — your final version.

About the adjusters and carriers you correspond with: the adjuster’s name and email, the carrier they work for, its email domains, and a statistic on how long they typically take to respond. That statistic lives inside your organization and nowhere else: we do not pool it across customers, we do not publish it, and we do not sell it.

From JobNimbus, only if you switch on the integration with your own API key: claim number, project name, homeowner name, property address, CRM status, and date of loss. If you do not switch it on, none of that enters the system.

What we never touch: your Google contacts, your calendar, your Drive, your files. We do not request those permissions. We also never ask for or store your Google password, or anyone else’s.

Estimate Radar requests exactly two Gmail API scopes, and no others:

https://www.googleapis.com/auth/gmail.readonly — to read new messages in the connected mailbox and identify estimates sent to carriers and the adjuster replies to them. This is a restricted scope under Google’s classification, and without it the product has no way of knowing what happened to an estimate.

https://www.googleapis.com/auth/gmail.send — to send the follow-up inside the original email thread, and only after a person on your team has clicked approve in the panel. Without this scope the reply would have to be copied and pasted by hand, which is exactly the work the product removes.

No email is ever sent autonomously. Human approval is not a setting that can be switched off: it is a contractual obligation and it is built that way in the code. If nobody approves, nothing goes out.

You can withdraw the grant whenever you want, without telling us and without asking us, at https://myaccount.google.com/permissions, or by disconnecting the mailbox from the panel. The moment you do, we stop reading new messages and lose the ability to send anything from that account. What was already stored stays until you ask us to delete it or until the retention periods in section 12 run out.

Estimate Radar’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Concretely, so that this does not stay a formula: we use data obtained from Gmail solely to provide and improve user-facing features of the product — detecting the estimate, computing the follow-up date, proposing the draft, and sending it after your approval. We do not use or transfer it for advertising of any kind, including personalized, retargeting, or interest-based advertising. We do not sell it. We do not use it to develop, train, or improve generalized artificial intelligence or machine learning models.

No human at INNOV4 reads the content of your email, with three exceptions: when you explicitly ask us to, in order to resolve a specific problem with a specific message; when it is strictly necessary for security or to investigate abuse or a malfunction; or when a competent authority legally compels us. Outside of that, content is processed by machines and is not retained.

We transfer Gmail data only to the providers strictly necessary for the feature to exist — the ones listed in section 10 — or where the law requires it. In the event of a merger or acquisition, we would give notice first and the transfer would require your consent.

Two tasks use an Anthropic language model: classifying each inbound message, and drafting the follow-up in your own writing style.

To classify, the sender, the subject, and the body of the message are sent to Anthropic. We say "the body" plainly because that is the truth: without the text there is no way to know that the adjuster promised an answer in five days.

The Anthropic account is YOURS, not ours. You create the key, you pay the provider directly, and we take no markup on it. That is clause 11.2 of your agreement and it works in your favor: you see exactly what it costs and you can shut it off whenever you want. Your key is stored encrypted and is never displayed back on screen.

Because the processing runs under your own account, the commercial terms you accepted with Anthropic govern what that provider does with what it receives. Anthropic states in its commercial terms that it does not use API inputs or outputs to train its models; that is Anthropic’s representation, not a guarantee we can give on their behalf, and it is subject to whatever terms that provider has in force.

We do not train any model on your email, or on anyone else’s. The writing style profile the product builds so it can draft like you is stored inside your organization, used only for your drafts, and never blended with another customer’s.

The model gets things wrong. It can misread a message, misjudge a deadline, or write something you would not say. That is why the draft is shown to you to read, edit, and approve, and why the reason it was proposed is printed right next to it. The decision to send always belongs to a person.

The public site at estimateradar.com uses no analytics cookies, no advertising cookies, and no third-party cookies. There is no Google Analytics, no Meta pixel, no heatmap.

The panel uses strictly necessary cookies to keep your session alive. They do not require consent because the service cannot function without them, and they are not used to profile you.

If we ever add analytics, we will say so on this page before switching it on, and we will ask for consent wherever the law requires it.

This is the sharpest point in the product and it deserves to be said head-on. The system reads correspondence that includes people who are not our customers: carrier adjusters and, when a customer connects their CRM, homeowners.

Our position is this. That correspondence belongs to the customer. The adjuster wrote to them, about an estimate they sent, in the course of their own business. The customer already had and still has access to those messages; what we do is process them on their behalf and on their instructions. In that relationship the customer is the controller and we are the processor.

What that forbids us from doing, and we honor it: we do not use that data for any purpose of our own. We do not send marketing to adjusters or homeowners. We do not build a directory, a ranking, or a data product out of it. We do not pool it across customers: every organization is isolated, and the response statistics a customer sees for an adjuster are computed only from that customer’s own correspondence.

If you are an adjuster, a homeowner, or any third party appearing in this correspondence and you want to know what we hold about you, correct it, or have it deleted: write to hola@estimateradar.com. We will identify the customer who connected that mailbox, pass your request to them within five business days, and give them the technical support they need to act on it. The decision over that data is theirs as controller, and we will tell you who they are so you can go to them directly.

If you are our customer, the flip side is yours: by connecting a mailbox you represent that you are entitled to do so, that it is a company mailbox and not a third party’s personal account, and that you will inform your own team that this correspondence is processed with this tool.

Google LLC (United States) — OAuth authentication and the Gmail API. It has access to the messages in the mailbox you connect, because it is the mailbox Google itself hosts.

Anthropic PBC (United States) — message classification and draft writing. Receives the sender, subject, and body of processed messages, under the customer’s own account and API key.

Supabase Inc. (United States) — Postgres database and identity management. Hosts everything we store: accounts, estimates, drafts, processed-email records, and encrypted credentials.

Vercel Inc. (United States) — application hosting and execution.

JobNimbus (United States) — only if the customer switches on the integration with their own key. Receives the activity the product logs and supplies the claims and jobs that get synced.

GitHub Inc. (United States) — runs two scheduled jobs: the daily backup, which is verified by restoring it, and the vulnerability scan of our dependencies. It reaches the database during that run. It keeps no copy: the backup file is created, verified, and gone with the machine that made it.

Your browser’s push service (Apple, Google, or Mozilla, depending on the device) — only if you turn on alerts. It delivers the notification to your phone or computer. The content is end-to-end encrypted, so that service cannot read it: it only sees the device’s technical address and when an alert arrives.

This list is complete as of this version. There are no analytics, advertising, data-enrichment, or lead-selling providers, because we use none. If we add a provider that handles personal data, we will update this list on this page before putting it into production.

INNOV4 is in Peru and the entire service infrastructure is outside Peru, in the United States. Under Peru’s Law 29733 and its regulation that is a cross-border data flow.

Registration of our personal-data banks with the Peruvian data protection authority is in progress. We will publish each registration code here once it is granted.

In practice, our U.S. customers’ data is processed within the United States: that is where Google, Anthropic, Supabase, Vercel, and JobNimbus sit. Administrative access by our team happens from Peru.

With each of those providers we have accepted the data processing terms that provider offers. If you need a copy of one for your procurement process, ask and we will tell you exactly which is signed and which is not.

Website access requests: up to 24 months from our last contact with you, or sooner if you ask us to delete them.

Account and operational data — estimates, follow-ups, processed emails, adjusters, claims: for as long as the subscription is active.

After the subscription ends: we delete from active systems within 30 calendar days of your written request and, in any case, within 90 calendar days of the end of the subscription. Before deletion you can request your full export, which we deliver within 15 calendar days at no cost.

Audit log of sensitive actions: two years, which is the traceability retention period required by the Peruvian data protection regulation.

Backups: information may persist in our database provider’s backups until those roll over on their ordinary cycle. Those copies are not consulted to run the service and are not used for any other purpose.

Billing and accounting records: for the period Peruvian law requires of INNOV4, even after the relationship ends.

What exists and is verified in the code: Google OAuth tokens and the API keys you entrust to us are encrypted at rest with AES-256-GCM and are never displayed back or written to logs. Every database query filters by the organization identifier, and an automated test walks the entire codebase and fails if any query skips that filter. The entire application requires an authenticated session. Sensitive actions are written to an audit log with the identifier of the person who took them. No email is sent without explicit human approval. You can export all of your information in JSON and CSV, at no cost and without asking permission. And backups are restored and verified on every run: we do not keep a file and assume it works.

On isolation between customers, precisely: Row Level Security policies exist in the database, but they are NOT IN FORCE for the application today, because the role it connects with can bypass them. What separates one customer's data from another's is the per-organization filter every query carries, plus the automated test that watches it. While there is a single customer this changes nothing in practice; before accepting a second customer on the same database, we will turn the policies on for real. We say it here because the previous version of this paragraph claimed otherwise, and that was inaccurate.

What we do NOT have, and we would rather say it here than have you find out in a procurement questionnaire: we hold no SOC 2 or ISO 27001 certification, we carry no cyber-risk insurance, and we have not had an independent external restoration testing. If your purchasing process requires any of those three, tell us before you sign rather than after.

No security measure eliminates risk. What we can commit to is that we will not describe as existing something that does not.

We do not sell personal information — not yours, and not that of the people who appear in your correspondence. We do not share it for cross-context behavioral advertising, as those terms are defined under U.S. state privacy laws. We do not use one customer’s data to serve another. We run no targeted advertising with it, ours or anyone else’s, and we neither buy nor sell lists.

Over the data we control — your access request and your panel account — you can exercise the rights granted by Peru’s Law 29733: information, access, rectification, cancellation (deletion), objection, and portability. Exercise them by writing to hola@estimateradar.com from the address we have on file, or from another one if you let us verify your identity.

The deadlines we meet, in business days counted from the day after we receive your request: information, 8 days. Access and portability, 20 days. Rectification, cancellation, and objection, 10 days. If we need to verify your identity we will ask right away, and the clock starts when you complete it.

For data we process on a customer’s behalf, the request goes to that customer. If it reaches us instead, we forward it within five business days and tell you who to contact.

If you are a resident of a U.S. state with its own privacy statute and believe it gives you rights, write to us anyway: we will handle the request through the same channel even if the legal basis is different.

If you think we handled you badly, you can complain to Peru’s National Authority for Personal Data Protection (ANPDP, Ministry of Justice) at https://www.gob.pe/anpdp. We would rather settle it with you first, but the route exists and you are entitled to use it.

Peruvian law applies. INNOV4 is established in Lima and administers the processing from there, so Law 29733 and its regulation, Supreme Decree 016-2024-JUS, reach us in full, even though the people whose data we handle are in the United States. That is where the deadlines, rights, and obligations in section 15 come from, and where the duty to register our data banks with the Peruvian authority comes from.

On California: the CCPA, as amended by the CPRA, no longer exempts B2B context data — that exemption expired on January 1, 2023 — so a California resident’s work email is protected personal information. That said, the statute only binds businesses that cross one of its revenue or volume thresholds, and INNOV4 crosses none of them today. When we serve a customer we act as a service provider: we do not use their data for our own purposes, and we give them the support they need to answer their own consumers’ requests. If we ever cross the thresholds, we will update this notice before that happens.

On Texas: the Texas Data Privacy and Security Act exempts small businesses as defined by the federal Small Business Administration, and INNOV4 comfortably is one. That exemption does not cover the sale of sensitive data, which requires prior consent; since we sell no data of any kind, that trigger never fires. The statute also protects a person acting in an individual or household context, not one acting in an employment or commercial context: an adjuster writing from a work account is not a "consumer" under that law.

What applies regardless of any threshold: the Google API Services User Data Policy, which is contractual and which Google actively reviews; and U.S. federal rules on commercial email, compliance with which belongs to the sender — that is, to the customer.

What does not apply: we do not offer the service to consumers, in Peru or anywhere else, so there is no Peruvian consumer relationship and none of the obligations that flow from one. And we do not target the European Union market, so we do not operate under the GDPR today; if that changes, this notice changes first.

If an incident affecting personal data occurs, we notify Peru’s National Authority for Personal Data Protection within 48 hours of becoming aware of it, as the Peruvian regulation requires, and we inform affected individuals within that same window where applicable.

If the incident affects data we process on a customer’s behalf, we tell that customer without undue delay and give them the information they need to meet their own notification duties, which in the United States vary by state.

We do not promise an incident will never happen. We promise we will not hide it.

Estimate Radar is a work tool for businesses. It is not directed to anyone under 18, we do not offer it to minors, and we do not knowingly collect data about them. If we find we have received a minor’s data, we will delete it.

When we change something material, we will publish the new version on this same page with its number and date, and we will email active customers before it takes effect.

Changes that expand the purposes of processing or add a new provider are announced before they take effect, never after.

INNOV4 AI S.A.C. · RUC 20616317769 · Magdalena del Mar, Lima, Peru · hola@estimateradar.com

For anything privacy-related — a question, a right you want to exercise, an incident you want to report — that address is the channel, and a person reads it.