Agent Data Handling Policy

Effective Date: May 18, 2026

iBundl.ai — SBA Loans Today LLC

This Agent Data Handling Policy is pending attorney review. iBundl.ai intends to have this policy reviewed by a licensed Colorado insurance and technology attorney prior to broad public launch. By subscribing to the Platform during the founding member period, you acknowledge this disclosure.

1. Purpose

This Agent Data Handling Policy ("Policy") governs how licensed insurance agents who subscribe to the iBundl.ai platform ("Agents") may access, use, store, and protect consumer information received through the Platform. This Policy is a binding agreement between each Agent and SBA Loans Today LLC, the operator of iBundl.ai. Violation of this Policy may result in immediate termination of Platform access and liability for damages as described herein.

2. What Consumer Information Agents Receive

Upon a consumer's verified selection of an Agent through the Platform, iBundl delivers the following consumer profile information:

Identity information:

•First name, last name, date of birth, gender, marital status

•Co-applicant information if provided (name, DOB, gender)

Contact information:

•Phone number (verified via SMS)

•Email address (verified via email link)

•Residence address

Coverage and property information:

•Primary coverage types selected (home, renters, landlord, auto)

•Property details: address, type, year built, square footage, roof age, dogs

•Vehicle details: year, make, model, primary use, primary driver

•Additional household members: name, DOB, gender, relationship, licensed driver status

•Bundle interest flags: motorcycle, RV, toys, life, umbrella, mortgage protection, commercial, business

iBundl does not collect or transmit: Social Security numbers, driver's license numbers, credit information, prior claims history, medical history, or financial account information. Agents who require this information must collect it directly from the consumer.

3. Permitted Uses of Consumer Information

•Contacting the consumer to discuss insurance coverage options and to prepare and deliver insurance quotes;

•Following up with the consumer regarding quotes previously delivered;

•Binding insurance coverage at the consumer's request;

•Servicing an active insurance policy obtained through the Platform introduction.

Agents must not use consumer information for any other purpose, including:

✗Selling or cross-marketing non-insurance financial products without explicit consumer consent;

✗Adding consumers to general marketing lists or automated email sequences unrelated to the specific quote request;

✗Any purpose unrelated to the insurance needs identified in the consumer's iBundl profile.

4. Prohibited Uses — Strict Prohibitions

The following uses of consumer information are strictly prohibited and constitute material violations of this Policy:

Selling consumer data to any third party

Consumer data is provided exclusively for quote delivery. Sale constitutes breach of contract and may violate state and federal privacy law.

Sharing consumer data with other agents or agencies

Each consumer chose specific agents. Routing their data elsewhere violates the consumer's explicit intent.

Using consumer data to solicit on behalf of another agent

Platform introductions are exclusive to the agent selected by the consumer.

Uploading consumer data to shared CRM systems accessible by non-enrolled agents

Consumer data must remain within the Agent's direct control.

Contacting consumers for purposes unrelated to their stated insurance needs

Consumers consented to insurance contact only. Unrelated outreach may violate TCPA.

Retaining consumer data beyond the permitted retention period

Extended retention without purpose increases breach risk and regulatory exposure.

Prohibited Action

Why It Matters

5. Data Security Requirements

•Store consumer information only on password-protected devices or secure cloud systems;

•Not share login credentials to any system containing consumer data;

•Promptly notify iBundl at info@ibundl.ai if consumer data received through the Platform is involved in any actual or suspected security breach;

•Comply with all applicable state data breach notification laws.

6. Data Retention

Agents may retain consumer information only for as long as necessary:

→

Active quote process: Retain for the duration of the quoting and potential binding process.

→

Active policy: Retain for the duration of any insurance policy bound, plus any legally required retention period.

→

No policy bound: Delete or destroy consumer data within 12 months of the introduction date if no policy is bound and no active quote process is ongoing.

Agents must securely destroy consumer data (shredding physical records; permanent deletion of digital records) at the end of the applicable retention period.

7. Compliance with Applicable Law

•The Telephone Consumer Protection Act (TCPA) — governing calls and text messages to consumers;

•The CAN-SPAM Act — governing commercial email communications;

•The Colorado Privacy Act (CPA) and any other applicable state privacy laws;

•All state insurance regulations governing agent conduct and consumer privacy;

•The Gramm-Leach-Bliley Act (GLBA) to the extent applicable to the Agent's licensed activities.

8. Consequences of Violation

•Immediate suspension or permanent termination of Platform access without refund;

•Forfeiture of any remaining subscription period without compensation;

•Civil liability for damages caused by the violation, including actual damages, consequential damages, and reasonable attorneys' fees;

•Reporting of the violation to the applicable state insurance department;

•Any other remedies available at law or in equity.

Liquidated damages note: The parties acknowledge that actual damages from unauthorized disclosure or misuse of consumer data may be difficult to quantify. A specific liquidated damages amount will be specified in a subsequent amendment to this Policy following attorney consultation. Until such amendment, actual damages, consequential damages, and equitable relief remain available remedies.

9. Agent Representations

•They have read and understand this Policy in full;

•They have the authority to bind themselves and their agency to this Policy;

•They will train any staff with access to consumer data on the requirements of this Policy;

•They will immediately notify iBundl of any change in their license status.

10. Updates to This Policy

iBundl reserves the right to update this Policy at any time. Agents will be notified of material changes by email to the address on file. Continued use of the Platform after the effective date of any update constitutes acceptance of the revised Policy.

11. Contact

Questions, concerns, or breach notifications related to this Policy should be directed to: iBundl.ai — SBA Loans Today LLC Email: info@ibundl.ai Website: ibundl.ai