Privacy Policy

1. Scope and controller

Art State of Mind ("Company," "we," "us," or "our") operates artstateofmind.com and related member services. We act as the data controller for personal information processed through our websites and applications, except where we process data solely on behalf of an employer group or agency partner under a separate agreement—in which case that party may be a co-controller or controller for specific processing activities.

This Privacy Policy applies to visitors, applicants, policyholders, claimants, newsletter subscribers, and business contacts. It does not apply to third-party websites linked from our Services. Insurance transactions are also subject to financial privacy notices delivered with your policy where required.

2. Categories of information we collect

2.1 Information you provide

• Identity and contact data: name, email, mailing preferences, and account credentials.
• Application and policy data: date of birth, household composition, property details, vehicle information, business activities, beneficiary designations, and coverage selections.
• Claims data: incident descriptions, photos, repair estimates, medical billing details when applicable, and communications with adjusters.
• Payment data: bank or card details processed by PCI-compliant payment vendors; we do not store full card numbers on our servers.
• Communications: messages submitted through forms, chat transcripts, and call recordings where notice is provided.

2.2 Information collected automatically

• Device and usage data: IP address, browser type, operating system, referring URLs, pages viewed, and approximate location derived from IP.
• Cookies and similar technologies: session identifiers, preference cookies, analytics pixels, and fraud-prevention signals.
• Telematics and IoT data when you enroll in usage-based auto programs or connected home devices associated with discounts.

2.3 Information from third parties

We may receive motor vehicle records, CLUE or similar loss history reports, credit-based insurance scores where permitted, property data aggregators, identity verification services, publicly available sanctions lists, and information from healthcare providers or employers when you authorize coordination of benefits.

3. Purposes of processing

We process personal information to:

1. Provide quotes, underwrite risk, issue policies, endorse coverage, and process renewals.
2. Administer claims, detect fraud, and comply with legal and regulatory obligations.
3. Operate member portals, authenticate users, and provide customer support.
4. Send transactional notices, including billing, policy changes, and security alerts.
5. Deliver marketing communications when you opt in, and measure campaign performance.
6. Improve website usability, conduct analytics, and develop new products.
7. Protect the security and integrity of our systems and users.
8. Exercise or defend legal claims and cooperate with regulators.

Where required, we rely on consent, contract performance, legal obligation, vital interests, or legitimate interests balanced against your rights. You may withdraw consent for marketing at any time via Unsubscribe without affecting lawfully processed data before withdrawal.

4. Sharing and disclosure

We do not sell personal information for money. We may share data with:

• Insurer and reinsurer partners that bear underwriting risk and process claims.
• Licensed agents and brokers assisting with your application or service.
• Service providers under contract, including cloud hosting, payment processors, mail vendors, adjusters, medical bill reviewers, and IT security firms.
• Fraud prevention networks and industry databases to reduce misrepresentation and duplicate claims.
• Regulators, courts, and law enforcement when required by law or to protect rights and safety.
• Business transferees in connection with merger, acquisition, or asset sale, subject to confidentiality commitments.

Aggregated or de-identified data that cannot reasonably identify you may be used for research, benchmarking, and public reporting on claims metrics.

5. International transfers

Our servers and service providers may operate in multiple countries. When personal information is transferred across borders, we implement appropriate safeguards such as standard contractual clauses, adequacy decisions, or other mechanisms recognized under applicable privacy laws. Copies of relevant safeguards may be requested through the contact form where permitted.

6. Data retention

We retain personal information for as long as necessary to fulfill the purposes described in this policy, including servicing policies, resolving disputes, enforcing agreements, and meeting statutory retention periods for insurance records, tax, and anti-fraud requirements. Retention schedules vary by data category; claim files and underwriting worksheets may be kept for multiple years after policy termination as required by regulation and litigation holds.

When data is no longer needed, we delete or anonymize it using secure processes. Backups may persist for a limited period before cyclic deletion.

7. Security measures

We employ administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, role-based access controls, multi-factor authentication for administrative systems, vulnerability scanning, and employee privacy training. No method of transmission or storage is completely secure; you share information at your own risk and should protect your account credentials.

In the event of a data breach affecting your information, we will notify you and regulators as required by applicable law, describing the nature of the incident and remedial steps.

8. Your rights and choices

Depending on your location, you may have rights to access, correct, delete, restrict, or port certain personal information, and to object to processing based on legitimate interests or for direct marketing. You may also lodge a complaint with a supervisory authority.

To exercise rights, submit a verifiable request through the Contact Us form with the subject line "Privacy Request." We will respond within statutory timelines. We may need to verify identity before fulfilling requests. Authorized agents may submit requests with proof of authority.

Browser controls allow blocking cookies; some site features may not function without essential cookies. See your device settings for limiting ad tracking.

9. Children's privacy

Our Services are not directed to children under 16, and we do not knowingly collect their personal information except as a dependent on a guardian's policy. If you believe we collected a child's information improperly, contact us for deletion.

10. Sensitive information

Health-related data processed for claims or supplemental products receives additional protections. We limit internal access to workforce members with a business need and contractual confidentiality obligations. Genetic information is not used for underwriting unless explicitly authorized and permitted.

11. Automated decision-making

We may use automated tools to flag potential fraud, triage claims, or suggest coverage tiers. These tools support human review and are not the sole basis for adverse enrollment decisions where prohibited. You may request human review of significant automated outcomes where applicable law provides that right.

12. Changes to this policy

We may update this Privacy Policy to reflect legal, technical, or business developments. The effective date at the top will change, and material updates may be highlighted on the homepage or sent to registered users. Continued use after updates constitutes acknowledgment unless consent is specifically required.

13. Contact

Privacy questions, data subject requests, and complaints may be submitted via the Contact Us page. Please include sufficient detail for us to locate records related to your inquiry while avoiding sending full payment card numbers or medical records through unsecured channels.