Privacy Policy

1. Who processes data

The operator of polisi.ge is LLC INAVI, identification code 404815875, registered at Guram Rcheulishvili Street N17, Apt. N28, Mtatsminda District, Tbilisi, Georgia.

For questions or data-protection requests, write to corporate@inavi.ge.

2. What data we collect

We may collect: full name, phone, email, preferred language and preferred contact channel.

When a visitor sends a Contact-page message, we collect the submitted name, email address, message text and selected language.

We may collect request data: insurance category, company/person details, field of activity, description of the insured object or risk, location, desired limits, deductible, existing insurance, claims history, turnover, number of employees, security measures, files/photos if uploaded, and other details entered by the user.

We may collect technical and analytics data: IP address, device type, browser, language, cookie/analytics identifiers, advertising identifiers (for example ad click identifiers), UTM and source data, and — if the user accepts cookies — how pages are used: clicks, scrolling, mouse movement and the page layout, recorded by Microsoft Clarity as session recordings and heatmaps.

At MVP stage the platform may allow photos/files of the object or risk to better describe the request, while final document requests, inspection, risk assessment and underwriting are carried out by the selected insurance partner.

If the user chooses to fill in a form from a photo of a document, the photo of the vehicle registration certificate, identity card or passport is used only to read the fields shown next to the button: the plate number, make, model, year, body type and engine type of the vehicle, or the first name, last name, personal or document number, date of birth and sex of the owner. The photo itself is not stored; only the values the user keeps in the form become part of the request.

3. Why we process data

Data is used to operate the request form, prepare comparison results, route the user's request to the insurance providers assessed for it, create a PDF summary, support, security, fraud prevention, analytics and site improvement, advertising measurement where the user accepts cookies, recording which link, advertisement or website a request came from, and legal/audit purposes.

Contact-page message data is used to review and respond to the question and provide support.

The platform must not use the data to make the final insurance underwriting or policy-issuance decision about the user.

Automated processing notice: the platform may use automated processing and comparison logic to prepare estimated categorization, a request summary, partner-fit indicators and informational matching outputs. These processes are used for informational purposes only.

4. Who data may be shared with

With the consent given at the contact step, an administrator routes the request to insurance providers whose products fit it. More than one provider — in some cases every active provider in the relevant category — receives the request so that comparable terms can be offered. Providers that are not chosen still receive the request data they needed in order to quote.

Providers receive the request details and the answers given in the funnel. Except for personal car insurance (CASCO) requests (below), they do NOT receive the name, phone number or email address until the user accepts that provider's offer.

Personal car insurance (CASCO) requests: the name, contact details (phone number and email address), personal ID and date of birth are sent with the request to every provider it is sent to, so that the provider can verify the customer and prepare an offer. The user agrees to this separately when submitting the request.

Data is also processed by the technical providers listed in "Technical providers" below.

Data may be disclosed to a public authority or court where required by applicable law.

5. Technical providers

Google Cloud (Ireland/Belgium, region europe-west3) — application hosting and the database in which requests, accounts and offers are stored.

Google Cloud Vertex AI, Gemini models (regions europe-west4 and europe-west1) — generates the informational assistant answers and the plain-language policy summaries. Questions typed into the assistant are sent to this service. When the user chooses to fill in a form from a document photo, that photo is sent to this service, in the same regions, only to read the form fields; the platform does not store it.

Brevo (France) — transactional email: verification codes, offer notifications, account messages and internal notifications about Contact-page messages.

smsoffice.ge (Georgia) — SMS delivery of verification codes.

Meta Platforms Ireland (WhatsApp Business Cloud API) — where a user or provider continues a conversation over WhatsApp.

Sentry (Ireland) — error monitoring. Diagnostic data is scrubbed of personal identifiers before it is sent.

Telegram (Telegram Messenger) — the team's internal daily report of submitted requests, sent by a Telegram bot to Polisi staff: the number of requests per product and the website's visitors by source and, only to staff whose phone number Polisi has authorised, each customer's name and the channel the request came from. No contact detail, personal ID or answer is sent. Telegram delivers the report under its own terms, not under a data-processing agreement.

S3-compatible object storage — documents uploaded by providers and administrators.

Plausible Analytics — cookieless usage statistics, where enabled.

Google Tag Manager, Google Analytics and Google Ads (Google Ireland Limited / Google LLC) — consent-gated usage analytics and advertising measurement. These Google tags do not load unless the user accepts cookies. When a request is sent, Google Analytics receives a "request sent" event that names the insurance category only, with no answer, name, price or contact detail. Clicks on blog and price-card buttons are counted too: they send where the button was, the article or the product, the insurer and the package and, on travel prices, the trip type and zone chosen. Google receives no contact details: the site keeps Google's consent for user data (ad_user_data) denied, so contact details that Google's tag could detect on a page are not sent to Google.

Meta Pixel (Meta Platforms Ireland Limited) — consent-gated advertising measurement, loaded through Google Tag Manager only after the user accepts cookies. The pixel also sends the same event data (for example the event name, the page address and the Meta browser identifier) to a Meta Conversions API Gateway, a server hosted on Amazon Web Services and Google Cloud in the United States, which passes the events to Meta; like any web server, it also receives the visitor's IP address and browser details. When a request is sent, the pixel also receives Meta's standard "Lead" event, which names the insurance category and carries the request's random reference, so that the event and its gateway copy are counted once; it carries no answer, name, price or contact detail.

Microsoft Clarity (Microsoft Ireland Operations Limited / Microsoft Corporation) — consent-gated session recordings and heatmaps, loaded through Google Tag Manager only after the user accepts cookies. We partner with Microsoft Clarity and Microsoft Advertising to capture how users use and interact with our website through behavioural metrics, heatmaps and session replay, in order to improve and market our services. Website usage data is captured using first- and third-party cookies and other tracking technologies; we also use this information for site optimisation, fraud and security purposes, and advertising. Except on the public information pages (the home page, how it works, the blog, the FAQ, about us, contact, the insurance directory, the benefits programme and the legal pages), text and images are masked in the browser before anything is sent, and what users type is never recorded. Clarity also receives a pseudonymous identifier derived from the Google Analytics client identifier, and the Google Analytics session identifier, so that a recording can be matched with the same visit in Google Analytics. For more information about how Microsoft collects and uses data, see the Microsoft Privacy Statement (https://www.microsoft.com/privacy/privacystatement).

Unless stated otherwise above, each provider acts on our instructions under a data-processing agreement and may use the data only to deliver its service to us. Google (for Google Ads and the advertising features of Google Analytics), Meta (for the pixel and its Conversions API Gateway) and Microsoft (for Clarity) also use the data their tags collect for their own purposes, under their own terms and privacy statements.

6. Consent and withdrawal

At the contact step the user separately confirms that their request may be shared with insurance providers, and — where the funnel collects health answers — separately again for that special-category data.

Consent may be withdrawn by writing to corporate@inavi.ge. Withdrawal does not affect processing already carried out based on consent before withdrawal, and it does not reach a provider that has already received the request — that provider must be contacted directly.

7. Retention

Requests that are started but never completed, and that are not attached to an account, are deleted 90 days after they were last changed. This includes any names, personal identification numbers, dates of birth and health answers entered before the contact step.

Verification codes are deleted once they expire and are swept at least daily.

Sign-in sessions and single-use links are deleted when they expire.

Questions asked of the assistant are retained for service quality and abuse prevention; the IP address recorded alongside them is anonymised.

Document photos used to fill in a form are not stored. A record of each reading attempt (its time, the document type and the network address, without the photo or the values read) is kept for 2 days to prevent abuse and is then deleted.

Messages submitted through the Contact page are deleted after 365 days.

A message log records that an email or SMS of a given kind (for example "request received" or "offers ready") was sent to a customer or insurer account and whether the provider accepted it. It stores no phone number, email address or message text. Each record is deleted after 90 days, or earlier with the request or account.

Microsoft Clarity keeps session recordings for 30 days; recordings we mark as favourites and a random sample of recordings are kept for up to 9 months, and heatmaps are available for up to 9 months.

Consent records are kept as evidence that consent was given, including the exact text shown and the version accepted. The IP address and browser identifier stored with a consent record are erased after 365 days; the record itself is kept for the period required to defend a legal claim.

Account data is kept while the account exists. Deleting the account removes the account, its requests, its leads and its uploaded documents; consent records are retained as legal evidence with the link to the deleted account removed.

Data already transferred to an insurance provider is retained by that provider under its own policy, which we do not control.

8. Security

The platform uses reasonable technical and organizational measures to protect data, including access control, logging, encrypted connection and least-privilege access.

No online system is absolutely secure; users should not enter unnecessary or unrequested sensitive information.

9. User rights

Within applicable law, users may have the right to receive information about data processing and to request access, correction, deletion, restriction, objection, or the exercise of other rights.

Requests are sent to corporate@inavi.ge. The operator responds within the period set by applicable law.

A user who considers that their data has been handled unlawfully may complain to the Personal Data Protection Service of Georgia (personaldata.ge) or apply to a court.

10. Cookies and analytics

The platform uses necessary cookies for service functionality. Plausible may provide cookieless usage statistics where enabled.

If a visitor arrives through a link carrying campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term) or an advertising click identifier (Meta's fbclid, or Google Ads' gclid, gbraid or wbraid), the first-party __Host-polisi-src cookie keeps those tags, whether a Meta or a Google Ads click identifier was present (not its value), the page the visitor arrived on and the time, for 30 days, so that a request sent in that time records which link or advertisement it came from. Polisi sets it whether or not the user accepts cookies: it holds no identifier of the visitor, is not shared with any analytics or advertising provider, and is not replaced by a later visit.

If a visitor arrives from another website without such a link (for example from a search engine or a link on another site), the first-party __Host-polisi-ref cookie keeps only that website's domain (never the address of the page or what was searched), the page the visitor arrived on and the time, for 30 days, so that a request sent in that time records which website it came from. A request uses it only when there is no __Host-polisi-src cookie, so an advertisement clicked later still counts. Polisi sets it on the same terms: whether or not the user accepts cookies, with no identifier of the visitor, not shared with any analytics or advertising provider, and not replaced by a later visit. Both cookies rest on Polisi's legitimate interest in knowing which channels bring requests.

Google Tag Manager, Google Analytics, Google Ads, the Meta Pixel and Microsoft Clarity do not load until the user accepts cookies in the cookie banner; declining keeps them all off. Google's tags also run under Google Consent Mode v2, with analytics and advertising storage denied until that acceptance, and Clarity is told of the acceptance through its consent interface.

The choice is stored for 12 months in the first-party polisi-consent-v3 cookie. A user can change it by deleting the site cookie in their browser, after which the banner is shown again.

Accepting also enables advertising cookies so that Polisi can measure which ads bring visitors and show relevant ads (Consent Mode grants ad_storage and ad_personalization; ad_user_data stays denied, so Google receives no contact details); declining keeps them denied.

If the user accepts, Microsoft Clarity sets the first-party cookies _clck (a pseudonymous Clarity identifier) and _clsk (joins the pages of one visit into one recording), and Microsoft may set the third-party cookies MUID, CLID, MR, SM and ANONCHK, which recognise browsers across Microsoft services, including for advertising.

If JavaScript is disabled, the consent banner cannot operate. There is no Tag Manager fallback, so with JavaScript disabled no Google, Meta or Microsoft tag loads.

11. International transfers

Application hosting and the database are located in the European Union (Google Cloud, region europe-west3). The assistant and policy-summary models run in the European Union (regions europe-west4 and europe-west1). Document photos used to fill in a form are read by the same models in the same regions.

Brevo, Sentry and Meta Platforms (for WhatsApp) process data in the European Union. smsoffice.ge processes data in Georgia. Telegram, which delivers the internal staff report, processes data outside Georgia.

If the user accepts cookies, site-usage and advertising data is processed through Google Tag Manager, Google Analytics, Google Ads, the Meta Pixel (including its Conversions API Gateway, hosted in the United States) and Microsoft Clarity, and may be processed on Google, Meta and Microsoft (Microsoft Azure) servers in the European Union and the United States. For users in the European Union, Clarity is provided by Microsoft Ireland Operations Limited, which transfers data to Microsoft Corporation in the United States under standard contractual clauses.

Transfers outside Georgia are made in accordance with the Law of Georgia on Personal Data Protection: to countries with an appropriate level of data protection, or with the safeguards of each provider's data-processing agreement or terms (including standard contractual clauses) and, for the consent-gated tags, on the basis of the user's consent.

12. Minors

The platform is intended for adults researching insurance products. Minors should not use the platform without a parent/legal representative.

13. Changes

This policy may be updated. The new version will be published on the website or app with its effective date.

Electronic records notice: electronic consent records, timestamps and communication logs may be retained for audit and compliance purposes.