Privacy Policy

1. Our Roles#

We handle personal information in three different roles, and this Policy says which applies:

• Our own customers and visitors. For account holders, their users, Payers, website visitors, people who contact us, and prospective clients, we decide how the information is used (we are the "controller" or "business").
• Our customers' data. For the contacts, claimants, and other people whose information a customer uploads to or creates in the Service, and for outreach our assistants perform in a customer's name, the customer decides how the information is used and we process it for the customer (we are its "processor" or "service provider"). Those people should contact the customer about their information.
• Our lead database. For property owners and others whose public-record and contact information we compile into Licensed Data, we decide what is compiled and license it to our customers. Section 7 explains this.

2. Information We Collect#

2.1 Information you give us#

• Account and profile: name, email address, telephone number, business name, states of operation, login credentials (stored hashed), and team and organization settings.
• Billing: billing name and address, payment history, and, for any Payer who is not the account holder, the Payer's name, contact details, and payment history. Card numbers are handled by our payment processor, a PCI DSS Level 1 service provider; we do not store full card numbers or security codes.
• Customer Data: contacts, cases, notes, documents, templates, and other content you upload or create.
• Communications content: texts, call audio and recordings, voicemail, emails, letters, and e-signed documents sent or received through the Service.
• AI interactions: prompts, voice input, and other inputs you give our AI features.
• Inquiries: what you send us through our contact forms, chat, email, or calls.

2.2 Information collected automatically#

• Device and log data: IP address, browser and device type, operating system, access times, pages and features used, referring pages, and error logs.
• Approximate location: derived from IP address. We do not collect precise GPS location.
• Evidence records: we record the IP address, browser, and time at sign-in, periodically during sessions, and at legally significant actions, including acceptance of our Terms, attestations, overrides of do-not-call flags, sending of mail, database pulls and imports, and payments.

2.3 Records of our dealings with you#

• Call and meeting records: recordings, transcripts, notes, and summaries of our calls and online meetings with customers, prospective clients, and Payers (Section 8.1).
• Assistant work records: records of the work our assistants perform on an account, such as calls, messages, and notes and the consent, compliance, and attestation boxes they tick for a customer, and, for assistants on our time clock, the hours they clock.
• Text message consent records: for anyone who opts in to texts from us, the mobile number, the date and time, the IP address and browser, the page and version of the consent wording shown, and any later opt-out or help request.

2.4 Information from others#

The identity provider you choose to sign in with, our payment processor, our telephone and messaging carrier, email accounts you connect, public records and courts, and commercial data providers used to compile Licensed Data.

3. Mobile App Permissions#

The mobile app asks for device permissions only when you use a feature that needs them, through the operating system's prompt, and you can revoke them in your device settings. The camera is used only when you choose to scan or photograph a document; the photo library only when you pick a photo or save a document we generated; the microphone only during calls placed in the app and when you use voice features; and push notifications, delivered through the push notification service of your device's operating system, only if you enable them. The app does not collect precise or background location, your device contacts or calendar, health data, or advertising identifiers, and does not track you across other companies' apps or websites.

4. How We Use Information#

• To provide, operate, secure, and support the Service and our professional services.
• To process payments, bill, collect amounts owed, and respond to payment disputes and chargebacks.
• To communicate with you about your account, billing, security, and changes to our terms, and, where permitted, to email you about our services. You can opt out of promotional email at any time. We never send promotional text messages.
• To send the text messages you opted in to (Section 9).
• To improve the Service, including through analysis of aggregated or de-identified usage.
• To detect and prevent fraud, abuse, and unauthorized or automated access, and to enforce our Terms and Acceptable Use Policy.
• To keep business records and to establish, exercise, or defend legal claims. We may use account activity, access, communications, call, assistant work, and billing records as evidence in payment disputes, arbitration, and legal proceedings concerning an account.
• To comply with law and legal process.

For people in the European Economic Area, the United Kingdom, or Switzerland, our legal bases are performance of a contract, legitimate interests (such as security, fraud prevention, service improvement, and defending claims), legal obligation, and consent where we ask for it.

5. Artificial Intelligence#

The Service's AI features, including the Ivy assistant, case research, message drafting, voice features, and import column mapping, send the information needed for the request to our AI providers in the United States: a primary provider, and a second provider used as a fallback and for import mapping, speech-to-text, and text-to-speech. That can include your prompt, case details you attach, your organization's templates and saved settings, voice input, and the name of the user making the request. We do not attach payment card data, passwords, or your IP address to prompts. AI processing happens when you use an AI feature, and in features that run on their own, such as voicemail transcription, daily team summaries, and quality reviews of calls. A third provider may be used for speech-to-text when the second is unavailable, and AI requests may pass through our cloud infrastructure provider. Our AI providers are bound by their business or API terms not to use our customer data to train their models.

Our own staff may also use AI tools to help summarize our calls and meetings and to draft emails and texts to customers and prospective clients.

6. How We Share Information#

6.1 Service providers#

We share information with the service providers below. Those that process it for us do so under written terms that limit their use to providing their service to us, require security, and prohibit selling it:

• An authentication, database, and file storage provider (United States).
• A website and application hosting provider (United States).
• A payment processor (United States): billing and payment processing.
• A communications platform and carrier (United States): calls, texts, phone numbers, call recording, and voicemail.
• A transactional email provider (United States).
• Email and calendar integration providers (United States and France): connection of email accounts and calendars you choose to link.
• A spreadsheet provider (United States): shared lead sheets you choose to use.
• A print and mail vendor (United States): printing and mailing of letters you send.
• AI providers (United States): AI features (Section 5).
• An error reporting provider (United States), which may record a small sample of sessions, with text and inputs masked, to diagnose errors.
• A cloud infrastructure and security provider (United States): storage of call recordings and files, routing of AI requests, speech-to-text, and protection of sign-up.
• The operators of the mobile app platforms (United States): sign-in and push notifications.
• A website analytics and ad measurement provider (United States): the Surplus Funds website only (Section 12).
• An affiliate referral provider (United States): records which partner referred a sign-up.
• A hosted browser service (United States): collecting public records.
• Providers of public-record, skip-trace, and do-not-call lookup data used to compile Licensed Data.
• The video meeting, calling, and note-taking tools we use for our own calls and meetings with you.

6.2 Other disclosures#

We also disclose information: when required by law, subpoena, court order, or other legal process; when reasonably necessary to protect our rights, enforce our terms, prevent fraud or harm, or establish or defend legal claims, including to card issuers, card networks, payment processors, arbitrators, and courts in a payment dispute; to a successor in a merger, acquisition, financing, or sale of assets, with notice to you; and with your consent.

6.3 No sale of customer information#

We do not sell the personal information of our customers, their users, Payers, or website visitors. We do not use advertising tools in the Service. On the Surplus Funds website we use a website analytics service and may use an ad measurement service, as described in Section 12. Some state laws may treat those website tools as "sharing" for cross-context behavioral advertising or as targeted advertising; Section 12 explains how they are switched off for you. Section 7 describes the separate licensing of our lead database.

6.4 Mobile information and text message consent data#

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. The categories of sharing described in Sections 6.1, 6.2, and 7 exclude text messaging originator opt-in data and consent. Our SMS provider receives a mobile number and message content only to deliver the messages the person asked to receive. This Section 6.4 controls over any other part of this Policy.

7. Property Owner Information in Our Lead Database#

To help our customers find people who may be entitled to Excess Proceeds, we compile information about former property owners and related people, such as names, property and mailing addresses, sale and case details, estimated amounts, and telephone numbers and email addresses. It comes from public records, court and county files, auction results, and commercial data providers. We license it to our customers for their own surplus funds recovery business, under terms that forbid resale, bulk extraction, and use after their license ends. Our customers, not Excess Quest, decide whether and how to contact the people in it.

Some state privacy laws may treat this licensing as a "sale" of personal information. Some states also require a business that licenses information about people with whom it has no direct relationship to register as a "data broker", and such a law may apply to our lead database. Whether or not a law applies to you, you may ask us to stop contact made through our platform, to stop including your contact information in future deliveries, which we also treat as a request to opt out of any sale, or to remove your information. You can do this on our stop-contact and removal page, or by writing to privacy@surplusfundslist.com. You may also ask us what we hold about you and ask us to correct it. To stop contact or opt out of any sale, we do not ask you to prove who you are. We send a one-time code to the email address you give us only to confirm the request came from you, and you can also write to privacy@surplusfundslist.com. Requests to see, correct, or remove information may need verification. We act on requests within the time the law requires.

When we remove your information, we erase your personal information from our lead database and our internal lists. We keep only what we need to honor your request: a one-way hash of your telephone number and email address (a scrambled form of each) and the reference to the property case, which we keep only for that purpose and never use for outreach or license to anyone. Copies that our customers already hold in their own workspaces are records they control. We block calls, texts, emails, and letters to you through our platform from those copies, and where the law requires it, we pass your request on to them. We will tell you which kinds of companies hold a copy and, where we can, how to reach them.

8. Calls, Messages, and Recordings#

8.1 Our calls and meetings with you#

Calls and online meetings with customers, prospective clients, and Payers may be recorded where recording is turned on, and recordings may be transcribed and summarized using software, including the AI tools in Section 5. We use recordings, transcripts, and summaries to provide and support the Service, to keep a record of what was discussed and agreed, and to establish, exercise, or defend legal claims, including payment disputes. Our service providers may use recordings, transcripts, and summaries only to provide their services to us. If you do not want to be recorded, tell us and we will stop recording or continue another way. We keep these records, and the emails and texts we exchange with you, as business records under Section 10.

8.2 Your communications through the Service#

When you use the Service to call, text, email, or mail people, we store call details, recordings you enable, message content, delivery status, and mail records, and for letters, the IP address and browser of the user who sent them. You are responsible for the notices and consents the law requires for those communications, including call-recording consent in states that require the consent of all parties. We do not review your communications except to provide support at your request, to comply with legal process, or to investigate suspected violations of our terms.

9. SMS / Text Messages#

If you opt in to Excess Quest Account and Support Messages, by ticking the optional text message box when you create a Surplus Funds account, or when you send the contact form or the enterprise form on the Surplus Funds website or on the Excess Quest website, we send you non-promotional messages: replies to inquiries and support requests, account notifications, security codes, billing notices, and service updates. We never send marketing or promotional text messages. Message frequency varies. Msg & data rates may apply. Consent to receive text messages is not a condition of purchase or of any service, and sending a form or creating an account without ticking the box is not consent to receive them. Reply STOP to opt out, HELP for help, or write to support@surplusfundslist.com. Carriers are not liable for delayed or undelivered messages.

The box names Excess Quest LLC as the sender. At Surplus Funds sign-up and on the Surplus Funds website it also says that Excess Quest LLC is the company that operates Surplus Funds. Section 18 of our Terms and Conditions quotes how the box begins in each place.

When you opt in, we record the mobile number you entered, the date and time, the IP address and browser used, the page, and the exact consent wording shown and its version, and we keep a record of any later opt-out. We use these records only to send the messages you asked for, to honor opt-outs, and to show that consent was given.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. Section 6.4 applies.

10. Retention and Legal Holds#

We keep personal information for as long as your account is active and afterwards for as long as needed for the purposes in this Policy. When an account is closed, we remove it and its personal information from active systems within thirty (30) days, except as follows:

• Dispute and legal hold. We suspend deletion of an account's records, including acceptance, access, activity, communications, call, assistant work, and billing records, for as long as any of these applies: (a) fewer than one hundred twenty (120) days have passed since the last charge to the account; (b) a payment dispute, chargeback, pre-arbitration, or arbitration concerning the account is open, or closed fewer than one hundred twenty (120) days earlier; (c) we have received a preservation request or legal process, or reasonably anticipate a legal claim, concerning the account; or (d) the law requires us to keep them. Held records are access-restricted and used only for these purposes.
• Legal and financial records. Tax, accounting, and payment records are kept for the periods the law requires. Assistant time clock records and pay records are kept for six (6) years after the work is performed, and billing records are kept for six (6) years by us or our payment processor. Records of the calls and texts our assistants make for a customer (numbers, dates, times, durations, the assistant, and the caller ID used, but not recordings or message content) are kept for five (5) years, including after the account is closed or deleted.
• Customer Data. Recordings and messages with the people our assistants contact for a customer are that customer's data and follow the customer's account.
• Carriers and backups. Call detail records held by our carrier follow its retention schedule and telecommunications recordkeeping rules. Backups roll off on their normal cycle.
• De-identified data. Aggregated or de-identified data that no longer identifies anyone may be kept.

If an account stays locked for non-payment, or suspended, for twenty (20) days, we may close it, and this Section then applies to it.

11. Security#

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit (TLS 1.2 or higher), encryption of designated data at rest, hashed passwords, role-based access with least privilege, monitoring, and periodic security reviews. No system is completely secure. You are responsible for keeping your credentials confidential. If a breach affects your personal information, we will notify you and regulators without unreasonable delay and as the law requires.

12. Cookies and Analytics#

We use cookies that are necessary for sign-in, security, and the Service to work, and cookies that remember your preferences. We also use an affiliate referral service that sets a cookie to record which partner referred a sign-up. The Service and the Excess Quest website do not use advertising or analytics cookies from other companies. On the Surplus Funds website we use Google Analytics, a service of Google LLC, to measure visits in aggregate, and we may use Google Ads measurement to learn whether our ads lead to visits and sign-ups. These Google tools set cookies and send Google information such as the pages you visit, your device, and your approximate location. Google explains how it collects and uses that information at How Google uses information from sites or apps that use our services. If your browser sends a Global Privacy Control signal, the Surplus Funds website does not load them. You can also block them in your browser settings or with Google's opt-out tools, or ask us for help at privacy@surplusfundslist.com. Blocking necessary cookies will stop the Service from working. Because there is no common standard, we do not respond to browser "Do Not Track" signals.

13. Your Rights and Choices#

13.1 Your rights#

Depending on where you live, you may have the right to know what personal information we hold about you and how we use it, to get a copy in a portable format, to correct it, to delete it, to restrict or object to certain uses, to withdraw consent, to opt out of any sale or sharing of your personal information or of targeted advertising, to appeal our decision on a request, and, in some states, to get a list of the third parties to which we disclosed it. These rights come from laws such as those of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, and of other states with similar laws as those laws take effect, and from the laws of the European Economic Area, the United Kingdom, and Switzerland. California residents also have the right to limit use of sensitive personal information and not to be treated differently for exercising their rights. We do not make decisions that produce legal or similarly significant effects based solely on automated processing.

13.2 How to make a request#

Write to privacy@surplusfundslist.com. If you are in our lead database, you can also use our stop-contact and removal page, which sends a one-time code to the email address you give us only to confirm the request came from you. We will verify your identity where the type of request requires it (a request to stop contact or to opt out of any sale does not), respond within the time the law requires (for California requests, within 45 days, extendable once by 45 days with notice), and may keep information the law allows us to keep, including records under a legal hold. You may use an authorized agent where the law allows. If we deny your request, you may appeal by replying to our decision or by writing to privacy@surplusfundslist.com with "Appeal" in the subject, and we will answer within the time the law requires. If you are in the European Economic Area, the United Kingdom, or Switzerland, you can exercise your rights to restrict or object to our use of your personal information, and to withdraw your consent, by writing to privacy@surplusfundslist.com. You can withdraw consent as easily as you gave it, and withdrawing it does not affect the lawfulness of processing based on that consent before you withdrew it. You may also complain to your data protection authority.

13.3 Deleting your account#

You can delete your account in the app at Settings, Personal, Delete Account, or by writing to privacy@surplusfundslist.com. A public page on the Surplus Funds website explains what is deleted and what is kept, without signing in. Deletion follows Section 10.

13.4 Sensitive information#

We collect sensitive personal information only where needed to provide the Service, such as account login credentials, and we do not use or disclose it to infer characteristics about anyone or for any purpose that would give you a right to limit its use under California law.

13.5 Categories of information (California and other states)#

In the past twelve (12) months we collected these categories of personal information: identifiers (such as name, email address, telephone number, and IP address); customer records and commercial information (such as billing and purchase history); internet and network activity (Section 2.2); approximate location; audio and electronic information (such as call recordings); and professional information (such as business name and states of operation). The sources are described in Section 2, the purposes in Section 4, and the recipients in Section 6. For our lead database, we collected identifiers, property and sale records, and contact information from the sources in Section 7, and disclosed them to our customers under license as described there.

14. International Transfers#

We store personal information mainly in the United States. Some of our service providers process it in other countries, for example an email integration provider in France. Some of our staff and assistants work outside the United States and access personal information remotely to provide the Services, under the safeguards in Section 11. Where the law of the European Economic Area, the United Kingdom, or Switzerland requires a safeguard for a transfer, we use one that the law recognizes, such as the European Commission's Standard Contractual Clauses.

15. Children#

The Service is for adults acting for a business purpose. We do not knowingly collect personal information from anyone under 18 who uses our websites or the Service, and we do not knowingly sell or share the personal information of anyone under 16. If we learn that we have collected it, we will delete it.

16. Changes to This Policy#

We may change this Policy. We will post the new version with a new effective date and keep previous versions on file. For a material change we will give at least thirty (30) days' notice by email to account owners and in the application, and we may ask you to acknowledge it in the application. We will ask for your consent before using personal information already collected in a materially different way where the law requires it.

17. Contact#

Excess Quest LLC, 8 The Green, STE A, Dover, DE 19901, United States

Privacy requests and questions: privacy@surplusfundslist.com

General support: support@surplusfundslist.com

We answer privacy questions within the time the law requires. This Policy is available in English and Spanish. If the two versions differ, the English version controls.