Privacy Notice

Numerisk operates a proposal delivery platform used by insurance brokers to share proposals with their clients. This notice explains what information is collected when you view a proposal, why we collect it, and how it is handled.

This notice is provided in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

When you open a proposal link we may collect:

• IP address — recorded server-side when the proposal link is accessed, used to detect approximate location and prevent abuse.
• User agent — the browser and operating system string sent by your browser, used to ensure the proposal renders correctly on your device.
• Email address — if your broker shared the link with you by email, we may associate your address with your viewing session.
• Viewing behaviour — with your consent, we record events such as when you opened the proposal, how far you scrolled, and which sections you spent time reading. This is used to give your broker feedback on engagement.

We do not collect payment information, health data, or government identifiers.

We use a session cookie (via iron-session) to keep your viewing session secure. This cookie is strictly necessary for the service to function and does not require your consent under Australian privacy law.

If you accept analytics tracking, we record viewing events (scroll depth, section dwell time) using a server-side API — no third-party analytics cookies are set.

When a broker is signed in to the Numerisk application (not the proposal viewer), we record masked session analytics using Microsoft Clarity to understand how the product is used and to improve it. Clarity captures interactions such as clicks, scrolling and navigation, and may include a session replay.

Recordings are configured with strict masking: text inputs, client and proposal content, and other sensitive fields are hidden before anything leaves the browser, so the replay shows layout and interaction, not the underlying data.

This applies to broker users only. Brokers are shown a notice on first use and can opt out at any time from that notice; opting out stops session recording for that browser. This section does not apply to clients viewing a proposal.

We use the information above to:

• Deliver the proposal securely to the intended recipient.
• Provide the broker with analytics on how the proposal was received (open rate, engagement, acceptance/decline).
• Diagnose technical issues with proposal rendering.
• Detect and prevent unauthorised access or abuse of proposal links.

Note: Specific retention periods are pending legal review and will be published here once confirmed. As an interim measure, proposal data and associated viewing events are retained for the duration of the broker's active subscription and deleted within 90 days of account closure.

We share data with the following third parties:

• Supabase — our database and storage provider, hosted in ap-southeast-2 (Sydney, Australia). Proposal content and viewing events are stored here.
• Anthropic — if your broker uses AI-assisted features (such as AI-generated proposal content), prompts and relevant context are sent to Anthropic's API. No personal data from viewers is sent to Anthropic.

We do not sell your data to third parties and do not use it for advertising.

Under the Privacy Act 1988 you have the right to:

• Access personal information we hold about you.
• Request correction of inaccurate information.
• Complain about a breach of the APPs.

To exercise these rights, contact your broker or reach Numerisk at privacy@numerisk.com.au.

If you have questions about this notice, please contact us at privacy@numerisk.com.au.