Fast Loss Runs
Privacy Policy
Last updated October 26, 2026
This policy explains what information Fast Loss Runs collects, how we use and share it, and the choices you have. The short version: we use your information to run the service for your agency, we do not sell it, and anything we receive from your Google account is used only to send and track your loss run requests.
1. Who we are and what this covers
Fast Loss Runs (“Fast Loss Runs”, “we”, “us”), based in Michigan, United States, provides software that helps insurance agencies request loss run reports from insurance carriers, collect the insured’s signed authorization, and organize the reports that come back. This policy covers our website at fastlossruns.com, the Fast Loss Runs application, and the emails and signing and upload pages it sends.
Our customers are insurance agencies (each an “organization”). An organization decides what information about its insureds, policies and carriers it puts into Fast Loss Runs, and we process that information on its behalf to provide the service. If you are an insured or a carrier contact and have a question about information an agency holds about you, please contact that agency; we will also help if you write to us.
2. Information we collect
Account information
When you create an account or are invited to one: your name, email address and password (or the email address of the Google account you sign in with), your organization’s name, and the profile details you choose to add, such as phone number, mailing address, return fax and email, the time zone you choose for showing times, and your email signature (including any images in it).
Information agencies add
Records an organization enters or imports: insured companies and their USDOT numbers, contact names, email addresses, phone numbers and addresses; policies (numbers, coverages, dates, carriers, premiums); carrier contact details; request messages, templates and schedules; and the loss run reports received, which can include claim details and claimant names. We also store our reading of the figures in those reports and any corrections an agent makes.
Signing and upload pages
When an insured signs an authorization, we record the signer’s name and title, the signature image, the consent text, the time, the browser’s user agent and, where our hosting provides it, the IP address, and we record when the signing page was first opened. These details form the audit trail of the signed document. The agency that sent the link also sees when it was first opened (the time only, not the address or browser), so it knows whether the invitation has been seen. Files an insured uploads through an upload link are stored for the agency that sent the link.
Replies from carriers and insureds to the reply address on a request, including their attachments, are stored with that request. If you connect a mailbox, see Google user data and connected mailboxes for exactly what is accessed.
When an email a request sent comes back undelivered (a bounce) or is marked as spam by its recipient, we record that with the request: the address, the reason the receiving mail server gave, and when. For email sent from request@fastlossruns.com our email provider reports this, along with whether a message was delivered; for email sent from a connected mailbox, the mail server’s notice comes back to that mailbox. Reminders to an address that bounced or reported spam stop. An address that bounces is also kept out of the shared carrier directory; no organization is told about another organization’s email.
Billing
Payments are handled by Stripe. Stripe collects card details directly; we never see or store full card numbers. We receive and keep the plan, subscription status, invoice amounts and the billing contact.
Usage and technical information
Records of actions taken in the application (an audit log, for example when a request is sent or a document is signed), and the technical information any website receives, such as IP address and browser type, which our hosting provider may log.
3. How we use information
- To provide the service: sending requests and signing invitations, recording signatures, matching replies to requests, and showing an organization its own records.
- To read the figures in received loss runs and build loss summaries for the agency (see AI processing).
- To look up public FMCSA insurance filing records for a USDOT number an agent enters.
- To send account emails (sign-in links, invitations) and the notifications members choose in their settings.
- To bill organizations and keep their subscription in good standing.
- To keep the service secure, prevent abuse, investigate problems and meet legal obligations.
- To understand whether our advertising leads to sign-ups (see Cookies and advertising).
4. Google user data and connected mailboxes
A member can connect their own mailbox so that requests go out from their address. Connecting is optional; without it, requests are sent from request@fastlossruns.com under the agency’s name.
What we access
- Sending (Gmail scope
gmail.send). Used only to send the request, signing and upload emails the member creates or schedules in Fast Loss Runs, from the member’s own address. This scope cannot read the mailbox, and we read nothing with it. We also read the connected account’s email address (userinfo.email) to confirm which mailbox was connected. - Watching for replies (Gmail scope
gmail.readonly), only if the member turns it on. Some carriers reply to the member’s own address instead of the request’s reply address. If the member chooses to have Fast Loss Runs watch their mailbox, we search it for messages whose subject carries a Fast Loss Runs request or upload code, and for mail servers’ delivery failure notices (bounces), received within a limited window (at most 90 days back). For each candidate we first read only its headers (subject, sender, recipients, date and message identifiers). Only a message that matches a request that member sent is read in full (its text and attachments) and saved to that request. A delivery failure notice whose headers name no request is read in full to see whether it returns an email the member sent through Fast Loss Runs; one that matches is recorded on that request as a delivery failure (the address and the server’s reason), not saved as a reply. Messages that do not match are discarded and not stored. We never change, label, move or delete messages, and never mark them read.
How it is stored
Access and refresh tokens are encrypted on our servers with AES-256-GCM and are never shown to anyone, including other members of the organization and its administrator. Only replies matched to a request, and their attachments, are stored, with that request, as are delivery failures matched to a request (the address and the reason the mail server gave).
How it is shared
Matched replies and their attachments are visible to the members of the member’s organization as part of that request. Received loss run attachments are read by the AI processing described below. We do not sell Google user data, use it for advertising, or use it to train AI models, and no person at Fast Loss Runs reads it except with the member’s permission, for security purposes, or where the law requires.
Turning it off
A member can stop watching or disconnect the mailbox at any time in Settings. Disconnecting erases the stored tokens. You can also remove Fast Loss Runs’ access from your Google Account at myaccount.google.com/permissions.
Fast Loss Runs’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Mailboxes connected by SMTP or IMAP are treated the same way: credentials are encrypted with AES-256-GCM, IMAP folders are opened read-only, and only messages matched to a request are stored.
5. AI processing of loss runs
To summarize received loss runs, we send the report files to AI models through OpenRouter. Every request is limited to providers that keep no copy of the data and do not use it for training (zero data retention). The models only transcribe the figures; totals and counts are calculated by our own code, and agents can correct any reading. Files an insured uploads are not read until an agent assigns them to policies. We never log the content of these documents.
AI readings can contain mistakes. Agents should review them before relying on them.
8. Security
Mailbox credentials are encrypted with AES-256-GCM on our servers. Stored files are kept in private storage that is encrypted at rest. Connections to mail servers use TLS. Every organization’s records are separated from every other organization’s by access rules enforced in the database. Signing and upload links are long, random and stored only as hashes.
No system is perfectly secure. Some details, such as file names, recipients and subjects, are stored as ordinary database records so they can be searched, and email to carriers travels over standard email transport. If we learn of a breach that affects your information, we will notify you as the law requires.
9. How long we keep information
We keep an organization’s information for as long as its account exists, so its records, requests and signed authorizations stay available to it. An organization that stops paying becomes read-only; nothing is deleted. Signing links expire after 45 days, upload links after 30 days and invitations after 7 days.
To have an account or an organization deleted, the organization’s administrator can write to support@fastlossruns.com. We will delete it within 30 days, except where we must keep something to meet a legal obligation, resolve a dispute or enforce our agreements, and except for copies in backups, which are overwritten over time.
10. Your choices and rights
You can view and update your profile in Settings, disconnect a mailbox, and choose which notifications you receive. Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, and to object to or restrict some processing. To make a request, write to support@fastlossruns.com. If the information belongs to an agency’s records (for example, you are one of its insureds), we may refer you to that agency, which controls it.
11. Children
Fast Loss Runs is a business service and is not directed to children. We do not knowingly collect information from anyone under 16.
12. Where information is processed
We and our service providers process information in the United States and other countries where they operate. By using Fast Loss Runs, you understand that your information may be processed outside your country.
13. Changes to this policy
We may update this policy. We will change the date at the top when we do, and tell organization administrators by email or in the application before a material change takes effect.
14. Contact
Questions or requests about privacy: support@fastlossruns.com.