Privacy Policy

California notice at collection

This is the notice California requires us to give you at or before the point we collect your personal information. It is placed first on purpose.

What we collect and why. When you use the EPLI pricing tool and application on this site, we collect the categories listed below for one business purpose: to prepare an employment practices liability insurance application for your business, to seek terms for it from insurance carriers and wholesale brokers, and to communicate with you about that submission. We also collect limited technical and site-usage information to keep the site working, to stop automated abuse, and to measure which pages and campaigns bring people here.

Mapped to the categories California uses:

• Identifiers — your name, business name, job title, postal address, email address, telephone number, fax number, website, and IP address.
• Customer records information — the business and employment details on the application, including your signature.
• Commercial information — the coverage you asked about, the indication generated for you, prior and current insurance, and prior claims history.
• Professional or employment-related information — employee headcounts by type and location, turnover figures, how many employees earn over $100,000, HR policies and training practices, and employment-claim history.
• Internet or other network activity — pages you view on this site, the referring source or campaign parameters that brought you here, and interactions such as starting the form or clicking the phone or email link.
• Inferences — the class and eligibility conclusions the rating tool draws from your answers, such as whether your business fits the fast-indication programme or needs a specialty market.

Sensitive personal information. This site does not ask for a Social Security number, a driver’s licence or state ID number, a financial account number, a payment card number, precise geolocation, health information, biometric data, or information about race, religion, union membership, sexual orientation, or the contents of your private communications. Please do not send any of those through this site. Because we do not collect sensitive personal information here, there is nothing to limit under California’s right to limit the use of sensitive personal information — but if you send us any of it anyway, we use it only to respond to you and for no secondary purpose.

Selling and sharing. We do not sell your personal information for money, and we never sell or disclose the contents of an insurance application to a data broker or a lead buyer. This site does carry a Google Ads conversion tag, and California treats passing an identifier to an advertising platform for conversion measurement or remarketing as “sharing” for cross-context behavioural advertising. We treat it that way too, and we honour opt-outs accordingly — see Do Not Sell or Share My Personal Information below.

How long we keep it. See How long we keep it for the period, or the criteria we use to set the period, for each category.

What we collect

Everything below is collected because a carrier needs it to price and underwrite an EPLI policy. Nothing on this site asks for more than the carrier application does.

• Indication inputs — who the cover is for, your industry or class of business, full-time and part-time employee counts, the limit you want, whether you have had an employment claim in the last three years, and whether you want the wage-and-hour option. For county we ask only which of two rating bands you are in — Los Angeles, Orange or San Francisco, or anywhere else in California — not your exact location.
• Business identity and contact details — the named insured, contact person, phone, email, mailing and street address, nature of business, entity type for tax purposes (for example C Corp, S Corp, partnership, or LLC), years in operation, website, and optional fax number.
• Workforce details — headcounts of full-time, part-time, temporary, leased and independent-contractor workers, employees by state and by city where the carrier asks for it, how many employees earn more than $100,000, franchise status and franchisor name, the name of any employee-leasing firm, and a schedule of the additional locations or entities you own, each with its own name, business description and headcounts.
• Employment-practices answers — whether you have an HR function, a written employee handbook, an EEO policy, an anti-harassment policy, harassment-prevention training, and ADA accommodation procedures.
• Turnover and workforce-change answers — voluntary and involuntary separations for the current and prior year, downsizings, closures, and pending or threatened employment litigation, where the carrier form asks for them.
• Prior insurance and loss history — whether you carry or have carried EPLI, the carrier, limits, retention, premium, expiry and continuity date, whether coverage was ever cancelled or non-renewed, claims in the last three years, and any circumstance you know of that could give rise to a claim.
• Wage-and-hour supplement — if you elect that option, the pay-practice questions on the carrier’s supplement, including whether you have carried the coverage before and the year you first bought it.
• Electronic signature record — your printed name, your title, the typed or drawn signature image you adopt, the exact consent wording you accepted and its version, the time you began reviewing and the time you consented, your time zone, how many pages of the application were rendered and whether you scrolled the whole document, and SHA-256 hashes of the signature image and of the signed PDF.
• Technical data captured on submission — your IP address, browser user-agent string, accept-language header, referring page and host. When you sign and submit, these are written into the signature audit record that is emailed to us and to you. Your IP address is also used to rate-limit requests to the form, including the review-step request described in The review step sends your answers to our server; on that request nothing is written to an audit record, because no audit record is created unless you submit.

We do not ask for, and the form has no field for, a Social Security number, an employer identification number, a bank account or card number, or the name or personal details of any individual employee.

Where it comes from

Almost everything we hold about you comes from you, typed into this site. Beyond that, the only other sources are: your browser and our host’s server logs, which supply the technical data above; the advertising or referral source that sent you here, where your browser passes it; and, if we already work with you, the file we already hold.

We may also receive information about your business from an insurance carrier or wholesale broker we approach on your behalf — for example a prior-carrier loss run, an underwriter’s eligibility note, or a quote or declination. If we or a carrier need to obtain a report about your business from anyone other than you, including from an insurance-support organisation, see the insurance notice of information practices below for what we will tell you first and what rights you have.

How we use it

We use your information to generate a pricing indication, to prepare and complete the carrier application, to submit it to insurance carriers and wholesale brokers so they can underwrite and quote it, to email you your signed copy and the signature audit record, to follow up with you about the submission and any resulting quote, to keep the records California requires a licensed broker to keep, and to detect and prevent fraud and automated abuse of the form. We use site-usage measurement to understand which pages and campaigns produce enquiries.

A pricing indication on this site is a modelled estimate on published programme rates. It is never a quote, binder, or guarantee of coverage, price, or eligibility.

Who we disclose it to

These are the actual recipients, not a category list:

• Insurance carriers and wholesale brokers — the markets we approach to seek terms for your business. They use your application to underwrite and quote it, under their own privacy notices.
• Surplus line brokers — where your risk goes to a non-admitted market. Bollinsure does not hold surplus line authority itself; any excess and surplus lines placement is made through a licensed surplus line broker, who receives the application for that purpose.
• Resend (Resend, Inc.) — our transactional email provider. Your completed application PDF, the signature audit record and the notification email pass through Resend on their way to our brokers and to your inbox.
• Vercel (Vercel, Inc.) — our hosting provider. Vercel serves this site and processes the request logs that come with it, including your IP address.
• Google (Google LLC) — through Google Tag Manager, Google Analytics 4, and the Google Ads conversion tag described in Measurement & advertising. Google receives site-usage data. It does not receive your application answers.
• Google Fonts (Google LLC) — a separate thing from the tags above. On the “Review & sign” step only, your browser downloads three handwriting fonts from fonts.googleapis.com to render a typed signature. As with any file your browser fetches, Google’s server sees your IP address and user-agent. It receives none of your answers.
• Cloudflare (Cloudflare, Inc.), with jsDelivr as a fallback — public code CDNs. On the “Review & sign” step only, your browser downloads the open-source PDF viewer (pdf.js) from cdnjs.cloudflare.com, or from cdn.jsdelivr.net if the first is unreachable. These serve a static JavaScript file and see your IP address and user-agent. Your application answers are not sent to them: the PDF is built on our server and rendered inside your browser.
• Professional advisers and regulators — our own counsel, auditors, and the California Department of Insurance, where a legal or regulatory obligation applies.
• Law enforcement or a court — when compelled by valid legal process, or where necessary to protect our rights or someone’s safety.

Our service providers act on our instructions under contracts that limit them to that purpose. We do not disclose your application to anyone else. We do not sell it, we do not licence it, and we do not pass it to a lead-generation network or to another insurance agency.

Measurement & advertising on this site

This is the complete list of measurement and advertising tags on BestEPLI. One caveat on checking it, because we would rather state it than have you catch it: only the first row is visible in the page source. The Tag Manager container ID is in the HTML of every page, and you can confirm it there. The Analytics and Ads identifiers below are configured inside that container, which is loaded from Google at runtime, so you will not find those two strings by reading the page source — you would see them in your browser’s network tab, or in a tag-inspector extension. We publish them here so you know what the container holds.

The site’s own JavaScript that emits measurement events is a single file you can read: /assets/lead-events.js. Everything in the “What it does here” column about events and their parameters is checkable there.

Consent Mode v2 is configured in the container. It sets Google’s advertising and analytics consent signals from your choices and from any opt-out signal your browser sends, so that measurement is adjusted rather than assumed.

Global Privacy Control. If your browser or extension sends a Global Privacy Control signal, we process it as a request to opt out of the sale and sharing of your personal information for that browser and device. We process it frictionlessly, in the sense California requires: we charge nothing for it, we do not change or degrade your experience because of it, we do not throw up a pop-up asking you to reconsider, and we do not make you take any additional step. Because the signal is tied to the browser, not to you, it applies to that browser and device.

What does not run here. This site has no cookie wall, no session-replay or screen-recording tool, no advertising pixel from Meta, LinkedIn, TikTok or X, no chat widget, and no A/B testing tool. It does not run Vercel Web Analytics. There is no keystroke capture and nothing reads the contents of a form field for measurement — the one thing we do record about the form is the name of the first field you click into, as set out in the table above. Your application answers are never pushed into the data layer and never reach an advertising platform.

Two non-measurement third parties. Separately from the tags above, the “Review & sign” step downloads the pdf.js viewer from a public code CDN and three handwriting fonts from Google Fonts. They are not analytics and they collect nothing about your application, but your browser does contact them and they see your IP address. They are listed in Who we disclose it to and explained in The review step sends your answers to our server.

Do Not Sell or Share My Personal Information

We do not sell your personal information for money or other valuable consideration, and we have not done so in the preceding twelve months. We do not sell or share personal information of consumers we know to be under 16.

The honest position on “sharing” is this. Because the Google Ads conversion tag described above can pass an online identifier to Google for conversion measurement and remarketing, California may treat that as sharing personal information for cross-context behavioural advertising. Rather than argue about it, we treat it as sharing and we give you the opt-out.

Three ways to opt out, all free and all honoured:

• Send a Global Privacy Control signal. Turn it on in a browser or extension that supports it. We process it automatically as an opt-out for that browser and device, with no further step from you. This is the fastest route and it needs no contact with us at all.
• Email reviews@bollinsure.com with the subject “Do Not Sell or Share”. Tell us the email address or phone number you used on the site so we can find you.
• Call 562-COVWELL (562-268-9355) and say you want to opt out of sale or sharing. We will record the request while you are on the phone.

You do not need an account, and you do not need to verify your identity to make an opt-out request — California does not allow us to require that. You may use an authorized agent. We will not treat you differently for opting out: the indication tool, the application, the pricing and the service are all identical either way.

The draft saved in your browser

So you can leave and come back, the application saves a draft in your own browser’s local storage on your own device. The draft carries a timestamp and a 7-day life: the next time you open the application after 7 days, the stored draft is found to be stale and deleted rather than offered back to you. Until that next visit it simply sits in your browser, on your device, where clearing site data for bestepli.com removes it at any time.

The draft file itself is never uploaded to us. That is not the same as saying your answers stay on your device — they do not. When you reach the “Review & sign” step, the answers currently in the form are sent to our server to build your PDF, whether or not you go on to submit. That is described in the next section, and it is the honest limit of this one.

Be aware of what the draft contains: the answers you have typed so far, including your contact details and the underwriting answers. It deliberately excludes your signature image, the printed name and title you sign with, and the consent checkboxes — those are never written to local storage and are re-entered every time. On a shared or public computer, clear it when you are done.

The review step sends your answers to our server

We would rather you read this here than discover it in the page source, so it gets its own heading.

The last step of the application shows you the actual carrier form, filled in with your answers, so you can read the document before you sign it. Your browser cannot fill a carrier PDF on its own. So the moment the “Review & sign” step opens, the answers you have entered are sent to our server — automatically, before you sign anything and before you press submit. That includes the named insured and your contact details, the business and address details, the workforce headcounts, the employment-practices answers, turnover, prior insurance and loss history, the wage-and-hour supplement if you elected it, and the schedule of additional entities.

Here is exactly what happens to it, and what does not:

• The server fills the carrier PDF in memory and returns it to your browser. That is the whole of the request.
• It is not written to a database, not written to disk, not emailed to us or to anyone, and not written to an application log. There is no code in that path that stores it. If you close the tab at the review step, no record of your application exists on our side.
• Your IP address is used, for that request as for any other, to enforce the rate limit described in How long we keep it, and the request appears in our host’s ordinary server logs.
• We deliberately do not send some things on this call, because building the PDF does not need them: your signature image, the wording of the e-sign consent, and your call-and-text (TCPA) consent record together with the phone number attached to it. Those are transmitted only when you press Sign & submit.
• Nothing about this step goes to Google, to an advertising platform, or to a carrier. Carriers receive your application only after you sign and submit.

Two other things load at this step, from outside our servers, and they see your IP address because every request does — they are listed in Who we disclose it to: the PDF viewer library, fetched from a public code CDN, and the handwriting fonts used to render a typed signature, fetched from Google Fonts. Neither receives your answers; they are static files your browser downloads.

How long we keep it

California asks us to state a retention period for each category, or the criteria we use to work one out. Here is both, honestly labelled.

Where we have written a criterion rather than a number, it is because the honest answer depends on the file — and we would rather tell you the rule we apply than publish a number we do not follow.

Security

The site is served over HTTPS. Submissions are validated and rate-limited. The signed application is generated on our server, hashed, and sent as an attachment rather than stored on the website. Access to submitted applications is limited to the licensed staff of the agency who need them to place your coverage. No method of transmission or storage is perfectly secure, which is why the form asks only for what a carrier actually needs and no more.

Your California privacy rights

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA (Civil Code section 1798.100 and following) gives you the rights below. We honour them for personal information collected through this website. Note that much of what you give us on an insurance application is also governed by the financial-privacy and insurance statutes described in the next two sections, which give you a separate and in some respects broader set of rights.

• Know and access — the categories of personal information we collected, the categories of sources, the business purpose, the categories of third parties we disclosed it to, and the specific pieces of personal information we hold about you.
• Portability — to receive the specific pieces in a portable and, where technically feasible, readily usable format.
• Correct — inaccurate personal information we hold about you.
• Delete — personal information we collected from you, subject to the exceptions California allows, which for a licensed broker mainly means records we are required to keep.
• Opt out of sale or sharing — see Do Not Sell or Share My Personal Information.
• Limit the use of sensitive personal information — we do not collect sensitive personal information through this site and do not use any for a purpose that would trigger this right, so there is nothing here to limit.
• Non-discrimination — we will not deny you service, charge you a different price, or give you a lower level of service because you exercised a privacy right.
• Authorized agent — you may use an agent to make a request. We will ask the agent for written permission signed by you and will confirm the request with you directly, except for opt-out requests, where we do not require verification.

How to make a request

Two methods, either one:

• Email reviews@bollinsure.com with “California privacy request” in the subject line.
• Call 562-COVWELL (562-268-9355) and tell us what you want. This is not a toll-free number; if you would rather not pay for the call, email us and we will call you back.

We will confirm receipt within 10 business days and tell you how we will handle it. We will respond substantively within 45 calendar days. If we need longer we will tell you why, before the 45 days are up, and take no more than 90 days in total. Requests are free unless they are manifestly unfounded or excessive, in which case we will tell you before doing anything.

Before we hand over or delete anything, we verify that you are who you say you are. For a request to know or delete we match you against what we already hold — the email address and phone number on your application — and we contact you at that address or number. For a request for specific pieces of personal information we ask for more, because the risk of getting it wrong is higher. We never ask you to create an account to make a request, and information you give us to verify a request is used for nothing else and is deleted afterwards.

Whether every CPRA obligation applies to an agency of our size is genuinely arguable, and much insurance application data is separately covered by federal financial-privacy law. We have chosen not to argue about it. We give you these rights, and this policy is our commitment to honour them.

Notice of insurance information practices

This is the notice California’s Insurance Information and Privacy Protection Act — Insurance Code section 791 and following — requires an insurance agent to give in connection with an insurance transaction. It applies to us whatever the answer to the CPRA-threshold question in the previous section.

Information may be collected from persons other than you

Personal information about your business may be collected from persons other than the individual or the business proposed for coverage. In practice, on this site, that means an insurance carrier, a wholesale or surplus line broker, an insurance-support organisation, or a public records or business-information source.

The kinds of information collected and how

The kinds are described in What we collect. Beyond your own answers, the techniques that may be used are: a request to your prior carrier for loss runs or claims history; an enquiry to an insurance-support organisation that maintains claims or underwriting records; a review of public records about your business; and, where a carrier requires it, an inspection or survey of your operations.

Investigative consumer reports

An investigative consumer report is one where information about character, general reputation, or personal characteristics is obtained through interviews with third parties. We do not order one to prepare an EPLI application, and nothing on this site triggers one. If that ever changes for your submission, we will tell you before the report is obtained, and you may then request to be interviewed in connection with it and to receive a copy of it.

Disclosures we may make without your authorisation

The statute permits certain disclosures without your specific authorisation. The ones that actually arise here are: to an insurance carrier, wholesale broker or surplus line broker for the purpose of underwriting, quoting, issuing or servicing your coverage; to a person performing a business or professional function for us under a contract that limits their use of it; to an insurance regulator or in response to legal process; and to detect or prevent fraud or material misrepresentation. Information we obtain from an insurance-support organisation may be retained by that organisation and disclosed by it to others.

Your right of access

You may make a written request for access to the recorded personal information we hold about you in connection with an insurance transaction. We will tell you the nature and substance of it, let you see and copy it or send you a copy, identify the persons to whom we disclosed it within the past two years (or, if we do not record that, the persons to whom it is normally disclosed), and give you the name and address of any insurance-support organisation whose sole source was another institution, so you can ask them directly. Medical-record information is handled through a licensed medical professional you designate. The statute sets a short deadline for this; we aim to answer within 30 business days of receiving your written request.

Your right to correct, amend or delete

You may ask us in writing to correct, amend or delete any recorded personal information we hold about you. If we agree, we will make the change and, importantly, notify onward: we will tell you, any person you name to whom we disclosed the information within the past two years, and any insurance-support organisation or carrier to which we disclosed it. If we refuse, we will tell you why in writing, and you may then file a concise statement of dispute setting out what you believe the correct information to be and why you disagree with us. We will file that statement with the information, furnish it to anyone reviewing the disputed information, and include it in any future disclosure of that information.

Adverse underwriting decisions

If coverage is declined, terminated, or written on terms less favourable than those normally applied — an adverse underwriting decision — you are entitled to a written statement of the specific reasons for it, the specific items of information that supported those reasons, and the names and addresses of the sources of that information, together with a restatement of your access and correction rights. A carrier’s declination is the carrier’s decision and it will give you its own notice; where the decision is ours, ask us at reviews@bollinsure.com and we will put it in writing. Where a declination rests on a third-party report, we will identify the source so you can go and correct it.

Send any access, correction or dispute request in writing to reviews@bollinsure.com, or to Bollinsure Insurance Services, 3625 E Thousand Oaks Blvd Ste 292, Westlake Village, CA 91362.

Financial privacy (GLBA and California)

A licensed insurance producer is a financial institution for the purposes of the federal Gramm-Leach-Bliley Act, and the nonpublic personal information you give us on an insurance application is protected under it and under California’s financial-privacy law. Our practice is simple and is designed so that no opt-out is needed:

• We disclose your nonpublic personal information only to place, service or renew the insurance you asked us to place, and only to the carriers, wholesale brokers, surplus line brokers and service providers needed for that.
• We do not disclose it to a nonaffiliated third party for that third party’s own marketing purposes. There is no joint marketing arrangement under which we hand your information to anyone.
• We do not sell it, and we do not disclose your application information to an affiliate for marketing.
• We restrict access to it to the licensed staff who need it, and we maintain physical, electronic and procedural safeguards.

These practices apply to former customers as well as current ones. If our practices ever change so that a sharing opt-in or opt-out becomes necessary, we will give you the notice and the choice California requires before making any such disclosure.

Calls, texts and email

When you give us a phone number and tick the contact-consent box next to the submit button, you are consenting to calls and text messages from Bollinsure Insurance Services at that number, including calls or texts made with automated dialling or a prerecorded or artificial voice where those are used. That box is separate from the rest of the form and is never pre-ticked. Consent is not a condition of purchasing any goods or services, and you can complete and submit the application without ticking it — we will simply reply by email instead. Message frequency varies. Message and data rates may apply.

You can withdraw consent at any time, by any reasonable means: reply STOP to any text, say so on a call, or email reviews@bollinsure.com. Reply HELP to a text for help. We honour a revocation promptly and in no case more than ten business days after we receive it, and a revocation for one channel is treated as a revocation for all of them unless you tell us otherwise. We maintain an internal do-not-call list and will add you to it on request. Calls and texts about an application you have already submitted are follow-up on your own enquiry, and a general marketing opt-out does not stop us from answering you about it — if you want us to stop entirely, say so and we will.

We record the fact and wording of your consent, the time, and the number it applies to, alongside the application it was given with. We do not record telephone calls on this line. If that ever changes, we will tell you at the start of the call and update this page first.

Children

This site is for business owners and the people who buy insurance for them. It is not directed at children, we do not knowingly collect personal information from anyone under 16, and we do not sell or share the personal information of consumers under 16. If you believe a child has given us information, email reviews@bollinsure.com and we will delete it.

This site does not bind coverage

Nothing you submit through this site is a bindable application, and no response generated by this website is a policy, binder, quote, or offer to insure. A pricing indication is a modelled estimate on published programme rates. A completed and signed application is a request that we take to market on your behalf. Coverage exists only when an authorised carrier issues it, after underwriting, and confirms it in writing. Do not cancel existing coverage until you have written confirmation that new coverage is bound.

Changes to this page

If our practices change, we will update this page and its “last updated” date before the change takes effect, and note anything material plainly at the top. We review this page at least once every twelve months whether or not anything has changed.

How to reach us

WJB Services, Inc. dba Bollinsure Insurance Services
3625 E Thousand Oaks Blvd Ste 292, Westlake Village, CA 91362
reviews@bollinsure.com · 562-COVWELL (562-268-9355)
California Department of Insurance agency licence 0D94699

Brian Bollinger, Principal Insurance Broker, licence 6013787. Aaron Bollinger, licence 4345268.

Last updated August 1, 2026. We may update this policy; the date above reflects the latest revision. See also our Terms of Service.