Privacy policy
Ward Tech Systems LLC · Texas, USA · Effective 2026-11-10 (draft)
This policy explains how Ward Tech Systems LLC ("Ward Tech", "we") handles information when you use ClaimProof — the website at claimproof.wardtechsystems.com, the /v1 API and the customer portal (together, the "Service"). ClaimProof is a business-to-business service: our customers are insurance carriers, third-party administrators and adjusting firms ("Customers"). Photos and claim data submitted by a Customer are processed on the Customer's instructions; the Customer is the controller of that data and we are its processor.
1. What we process
- Claim photos and files submitted to the API or portal, including embedded metadata (EXIF, XMP, ICC, C2PA — which may include capture time, device identifiers and GPS coordinates).
- Claim context supplied by the Customer: claim and policy numbers, peril, loss date and location, insured name and email, expected device, free-form metadata.
- Analysis output: verdicts, scores, findings, annotated renders, perceptual hashes and claim reports derived from the above.
- Account and usage data: tenant name, contact email, hashed API keys, request logs (timestamp, endpoint, status, request id, truncated IP), usage counts for billing.
- Website data: lead-form submissions (name, company, email, role, volume, message) and standard server logs. The website sets no advertising or analytics cookies. The portal stores a session token in your browser's
sessionStoragefor the duration of the tab. - Public demo: images uploaded to the live demo are analysed in memory and discarded; neither the image nor the result is written to storage. We keep a hashed IP for one hour to enforce the demo rate limit.
2. How we use it
Solely to provide the Service: analysing photos, producing reports, delivering webhooks, enforcing quotas and rate limits, securing the platform, billing, and responding to support requests. We do not use Customer photos or claim data to train models. We do not sell personal information and we do not share it with third parties for their own marketing.
3. Retention
- Original photos and annotated renders: 90 days, enforced by a storage lifecycle rule on the bucket, plus immediate deletion when a Customer calls
DELETE /v1/claims/:id. Shorter or zero retention is available by arrangement on Enterprise contracts (it is configured for the tenant by Ward Tech, not self-service). - Analysis results, claim records and perceptual hashes: for the life of the Customer account, so that cross-claim reuse detection keeps working; deleted on account closure or on the Customer's request via
DELETE /v1/claims/:id. - Request logs: 30 days. Usage counts: 7 years for accounting.
- Lead-form submissions: until the inquiry is closed or you ask us to delete them.
4. Sub-processors
We use the following providers to run the Service. Each is bound by terms that restrict use of data to providing their service to us.
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Compute (Workers), object storage (R2), database (D1), queues, key-value store, DNS and TLS. Data at rest is stored in Cloudflare's United States region. | United States |
| OpenRouter, Inc. | Routing of the optional vision-model signal to a model provider. Receives a downscaled copy of the image (≤ 1024 px) and no claim identifiers. Requests are sent with OpenRouter's "deny data collection" routing preference, which limits them to model providers that do not log or train on inputs. The vision signal is off in the public demo and can be left disabled for a tenant on request. | United States |
| Resend, Inc. | Transactional email (lead notifications, support). | United States |
| Google LLC (Google Fonts) | Web font delivery for this website and the portal. Receives the visitor's IP address and browser headers; receives no claim data or photos. | United States |
We will update this list and notify Customers under contract before adding a sub-processor that handles claim data.
5. Security
All traffic is encrypted in transit (TLS 1.2+). API keys are stored as SHA-256 hashes. File URLs are HMAC-signed and expire after 7 days. Webhooks are signed with a per-tenant secret. Access to production systems is limited to named Ward Tech staff with multi-factor authentication, and staff access Customer data only for support at the Customer's request. ClaimProof does not yet hold a SOC 2 report; we share our current security practices and infrastructure provider attestations (Cloudflare) on request.
6. Your rights and your Customers' rights
Insured individuals whose photos appear in a claim should direct requests to the insurer handling their claim; we will assist that Customer in responding. Website visitors and portal users may ask us to access, correct or delete their contact information at support@wardtechsystems.com. We respond within 30 days. We do not knowingly process data of children under 16.
7. International transfers
The Service runs in the United States. Customers outside the US are responsible for ensuring an appropriate transfer basis; we offer a Data Processing Addendum including Standard Contractual Clauses where required.
8. Changes
We will post changes here with a new effective date and notify Customers under contract of material changes at least 30 days in advance.
9. Contact
Ward Tech Systems LLC, Texas, USA · support@wardtechsystems.com