1. Who We Are and What This Policy Covers
This policy is published by Mayflower Specialty, Ltd. (“Mayflower,” “we” or “us”), which provides AI liability insurance coverage for companies that build and deploy AI. It applies to the personal information we collect through this website (the “site”), including the contact form, the online quote application and the download of our AI Liability Supplemental Application, and to the emails you send us about them. For the purposes of European and UK data protection law, Mayflower is the controller of that information.
Most people use the site for their work, for instance as an executive, risk manager, lawyer or broker acting for a company. This policy covers the information that relates to you as an individual. Information about a company that applies for coverage, such as its financial statements or loss history, is held in confidence, as the application states, whether or not it is personal information.
If a policy is issued, the policy documents may include a separate privacy notice that applies to the policy, and that notice governs the information handled under it.
2. Information You Give Us
You give us personal information when you fill in a form on the site or write to us. What we receive depends on the form you use:
The “Talk to Us” Contact Form
The contact form collects your name, work email, company, the topic you choose and your message, and, if you choose to answer it, how you heard about Mayflower.
The Online Quote Application
The online application collects the name, work email and job title you give to start, whether you are applying for your company or as its broker, the coverage modules you choose, your answers to the application questions, the name, title and email of the officer who signs it, and any documents you upload, such as an AI governance policy, loss runs or financial statements. Your answers are saved on your device as you type and on our servers once you have started, so you can pick up where you left off. The application is mainly about the company, but answers and documents can include information about people, such as directors, officers, employees or claimants.
The Supplemental Application Download
Before the supplemental application downloads, we collect your name, work email, job title and company, and we record the version of the Limited Use License Agreement you accepted and the time you accepted it.
The Coverage Gap Check
The coverage gap check asks no personal questions and keeps your answers in your browser until you close the tab, so we never receive them; our analytics receive only a summary of the result, such as the number of gaps it found and the modules it suggests.
Email and Other Correspondence
When you email us, we receive your email address and whatever you choose to include in the message and its attachments.
Please give us only what a form asks for, and avoid including sensitive personal information about individuals, such as health information, in your answers or documents unless underwriting asks for it. If you give us information about another person, such as the officer who will sign an application, please make sure you are allowed to share it and point them to this policy.
3. Information Collected Automatically
When you visit the site, your browser sends some technical information to us and to our service providers automatically, and some tools on the site store small pieces of information in your browser.
Server and Security Information
As with any website, our servers receive your IP address, browser type and the page you asked for with every request. We use your IP address briefly to limit repeated submissions and to block abuse. When you submit a form, we store a one-way hash of your IP address and your browser’s user agent with the submission, which lets us spot abuse without keeping the address itself. When a submission is sent to HubSpot, our customer relationship management provider, it includes your IP address, which HubSpot records with it.
Analytics and Advertising Tools
The site can use the tools below, each of which we switch on separately, and the ones that set cookies follow the choice you make in the cookie banner, as section 7 explains. We record events such as button clicks, the topic chosen on the contact form, application steps completed, downloads and the summary of a coverage gap check result. We do not send your name, email address, messages or application answers to these tools.
- Google Analytics 4, loaded directly or through Google Tag Manager, records the pages you view, how you arrived, the links and buttons you click and general information about your device and location. It uses Google Consent Mode. In the European Economic Area (EEA), the UK and Switzerland, analytics and advertising storage stay off until you accept cookies; elsewhere, analytics storage is on unless you decline, and advertising storage stays off until you accept. While storage is off, Google’s tags set no cookies but may still send Google limited signals without cookie identifiers, such as the time of the visit, the referring page and the browser type, which Google uses to model overall measurements. Google states that Google Analytics 4 does not log or store IP addresses.
- Vercel Web Analytics and Speed Insights, provided by the company that hosts the site, count page views and measure how quickly pages load. Vercel designed both to work without cookies: Web Analytics identifies a visit by a hash of the request that is discarded after 24 hours, and Speed Insights records performance measurements that are not tied to an individual or an IP address.
- The LinkedIn Insight Tag tells us how our LinkedIn advertising performs and allows us to show ads on LinkedIn to people who have visited the site. It runs only if you accept cookies.
- The HubSpot tracking code connects your visits to the details you later submit in a form, so our team can see which pages were useful to you. It runs only if you accept cookies.
Information Stored in Your Browser
The items below are kept in your browser. Those set by the site itself stay on your device, and their contents reach us only when they are sent with a form you submit or, for the quote application, when your answers are saved to our servers as section 2 describes.
| Item | Purpose | How long it lasts |
|---|---|---|
mf_consentLocal storage, set by the site | PurposeRemembers whether you accepted or declined cookies. | How long it lastsUntil you clear your browsing data. |
mf_first_touch and mf_last_touchLocal storage, set by the site | PurposeRecord the campaign, referring site and landing page of your first visit and of your most recent campaign visit. They are sent with any form you submit, so we know which of our marketing works. | How long it lastsUntil you clear your browsing data. |
Keys starting with mf_quote:Local storage, set by the site | PurposeSave your quote application on your device as you type, so a reload or a dropped connection does not lose your answers, and remember the contact details you gave so a new application can be prefilled. | How long it lastsThe saved application is removed when you submit it; the contact details stay until you clear your browsing data. |
mf_supplemental_detailsSession storage, set by the site | PurposeKeep the details you typed on the supplemental application form if the page reloads. | How long it lastsUntil you close the tab. |
mf-coverage-check-v1Session storage, set by the site | PurposeKeep your coverage gap check answers if the page reloads. They are never sent to us. | How long it lastsUntil you close the tab. |
_ga and _ga_<ID>Cookies, set by Google Analytics | PurposeDistinguish visitors and sessions. | How long it lastsUp to 2 years, or less where your browser limits cookies. Set only while analytics storage is on. |
hubspotutk and related cookiesCookies, set by HubSpot | PurposeRecognize your browser so HubSpot can connect your visits to a form you submit. | How long it lastsFor the periods HubSpot sets. Set only if you accept cookies. |
| LinkedIn Insight Tag cookiesCookies, set by LinkedIn | PurposeMeasure ad conversions and build advertising audiences on LinkedIn. | How long it lastsFor the periods LinkedIn sets. Set only if you accept cookies. |
4. Information From Other Sources
We also receive personal information from a few other sources:
- Your broker: If a broker applies for coverage on your company’s behalf, the broker gives us the application, which may include information about you.
- Public sources: As the application explains, Mayflower may use publicly available information to supplement an application for purposes of risk assessment.
- Analytics and advertising providers: The tools described in section 3 give us reports about how the site and our advertising perform, which are generally aggregated.
5. How We Use Information
We use personal information for the following purposes:
- To reply to your message and continue the conversation you started.
- To review, underwrite and follow up on an application for coverage, and to work with your broker and with the insurance and reinsurance partners that back Mayflower’s coverage.
- To record your acceptance of the Limited Use License Agreement, provide the application download and enforce the agreement.
- To alert our team to new requests and applications so they can respond promptly.
- To understand how the site is used and which pages and campaigns bring inquiries, and to improve the site.
- To measure our advertising and show relevant ads, where you have accepted advertising cookies.
- To keep the site and our systems secure and to prevent spam, fraud and abuse.
- To keep business records, to meet our legal, regulatory and contractual obligations, and to establish, exercise or defend legal claims.
- To send you occasional updates about Mayflower’s coverage where the law allows it. Every such email includes a way to unsubscribe, and you can ask us to stop at any time.
6. Legal Bases in the EEA, UK and Switzerland
If you are in the EEA, the UK or Switzerland, data protection law requires us to have a legal basis for each use of your personal information. The bases we rely on are as follows:
| What we do | Legal basis |
|---|---|
| Reply to messages and inquiries | Legal basisOur legitimate interest in responding to business inquiries and building business relationships. |
| Underwrite and follow up on an application, including sharing it with insurance partners and your broker | Legal basisOur legitimate interest in assessing and placing coverage for the applicant and, where you apply for your own business, taking the steps you ask for before a contract is made. |
| Record a license acceptance and provide the download | Legal basisPerformance of the Limited Use License Agreement, and our legitimate interest in protecting our materials. |
| Keep the site secure and prevent spam and abuse | Legal basisOur legitimate interest in protecting the site, our business and the people who use it. |
| Google Analytics, LinkedIn Insight Tag and HubSpot tracking cookies | Legal basisYour consent, which you can withdraw at any time in section 7. |
| Cookieless measurement with Vercel Web Analytics and Speed Insights, and campaign attribution | Legal basisOur legitimate interest in understanding how the site performs and which marketing brings inquiries. |
| Occasional updates about our coverage | Legal basisOur legitimate interest in telling business contacts about our services, or your consent where the law requires it. |
| Keep records and meet legal obligations | Legal basisCompliance with legal obligations, and our legitimate interest in establishing and defending legal claims. |
Where we rely on legitimate interests, we have weighed them against your rights and expectations, and you can object at any time, as section 12 explains.
7. Cookies and Your Choices
The cookie banner lets you accept or decline the cookies and similar technologies that the site does not need in order to work, which are the analytics and advertising tools described in section 3. Your choice is stored in your browser, and you can change it here at any time.
You can also block or delete cookies in your browser settings, install Google’s Analytics opt-out add-on and manage LinkedIn advertising in your LinkedIn ad settings. Blocking the storage the site sets itself will stop the quote application from saving your answers on your device.
The site does not respond to “Do Not Track” browser signals, because there is no common standard for them; the controls above are the way to limit tracking on this site.
8. How We Share Information
We do not sell personal information. We share it only in the following ways:
Service Providers
Companies that run the site and parts of our business for us receive the information they need to do so, as the table below sets out.
| Provider | What it does for us |
|---|---|
| Vercel | What it does for usHosts the site and provides Vercel Web Analytics and Speed Insights. |
| Supabase | What it does for usStores quote applications, uploaded documents, license acceptances and any contact request that could not be delivered to HubSpot, in a database and private file storage. |
| HubSpot | What it does for usReceives contact requests and leads from the quote application and the application download, and provides the HubSpot tracking code. |
| What it does for usProvides Google Analytics and Google Tag Manager. | |
| What it does for usProvides the LinkedIn Insight Tag. | |
| Our team messaging and email services | What it does for usAlert our team to new requests and applications, and carry the emails we exchange with you. |
Some of these companies, notably Google, LinkedIn and HubSpot, also use information collected through their tools for their own purposes under their own privacy policies, which are published by Google, LinkedIn and HubSpot.
Insurance Partners and Your Broker
If you apply for coverage, we share the application and its documents with the insurance and reinsurance partners that back Mayflower’s coverage, and with your broker if you have one, so that the coverage can be underwritten, placed and serviced.
Professional Advisers
We may share information with our lawyers, accountants and auditors, who are bound by duties of confidentiality, when we need their advice.
Legal Requirements and Protection
We may disclose information when the law, a court order or a regulator requires it, to enforce our Terms of Use and the Limited Use License Agreement, or to protect the rights, property or safety of Mayflower, our users or others.
Business Transfers
If Mayflower is involved in a merger, acquisition, financing or sale of assets, personal information may pass to the other party, which will be required to protect it as this policy describes.
With Your Agreement
We share information in other ways when you ask us to or agree to it.
9. International Transfers
Mayflower and the service providers listed above process information in the United States and may do so in other countries. If you are in the EEA, the UK or Switzerland, this means your information is transferred to countries whose laws may not protect it in the same way as the laws where you live.
Where the law requires it, we rely on recognized safeguards for these transfers, such as the European Commission’s standard contractual clauses and the UK’s equivalent, or a provider’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. You can ask us for more information about the safeguards that apply to your information.
10. How Long We Keep Information
We keep personal information only for as long as we need it for the purposes in this policy, and then delete or anonymize it. In practice, that means the following:
- Contact requests are kept while the conversation and any resulting business relationship continue, and for a reasonable period afterward so we can answer follow-up questions.
- Applications and uploaded documents are kept for as long as we need them to underwrite and place the coverage and, if a policy is issued, for the life of the policy and the period afterward that insurance record-keeping rules and legal limitation periods require. Applications that are started but never submitted are deleted after a period of inactivity.
- License acceptance records are kept for as long as the Limited Use License Agreement can be enforced, because several of its obligations continue after the license ends.
- Analytics data is kept for the periods set in each tool; Vercel, for instance, discards its visitor hash after 24 hours.
- Information stored in your browser lasts for the periods shown in section 3.
11. How We Protect Information
We use technical and organizational measures designed to protect personal information, including the following:
- The site uses HTTPS, so information is encrypted on its way between your browser and our servers.
- Applications, license acceptances and stored contact requests are kept in a database whose access rules block all public access, so only our servers, using a private key, can read or change them.
- Uploaded documents go to private file storage through signed upload links and are never publicly accessible.
- Each quote application is tied to a random key kept on your device, and our servers store only a one-way hash of that key.
- Our own database stores IP addresses only as one-way hashes; HubSpot’s handling of the address it receives is described in section 3.
- Links to download the supplemental application are signed and expire after 15 minutes.
- Our forms have rate limits and checks that filter out automated submissions.
No website or system is completely secure, so we cannot guarantee the security of information sent to us. If a security incident affects your personal information, we will notify you and the relevant authorities as the law requires. If you believe you have found a security problem on the site, please tell us at jeremy@mayflowerspecialty.com.
12. Your Privacy Rights
Rights Everyone Has
Wherever you live, you can ask us what personal information we hold about you, ask us to correct it or ask us to delete it, and you can opt out of marketing emails at any time. We will answer every request, although the law may allow or require us to keep some information, for instance to meet insurance record-keeping duties or to defend a legal claim.
The EEA, UK and Switzerland
Where European or UK data protection law applies, you have the right to access your personal information, to have it corrected or erased, to restrict or object to our use of it (including objecting at any time to direct marketing), to receive it in a portable format and to withdraw your consent at any time, which does not affect anything we did before you withdrew it. You also have the right to complain to the data protection authority where you live or work; in the UK, that is the Information Commissioner’s Office, and the European Data Protection Board lists the authorities in the EEA. We would appreciate the chance to address your concern first.
California
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”), gives you the right to know what personal information we collect, use and disclose, the right to delete it, the right to correct it, the right to opt out of its sale or sharing, the right to limit the use of sensitive personal information and the right not to be discriminated against for using any of these rights.
We do not sell personal information, and we do not use or disclose sensitive personal information for any purpose that would give you a right to limit it. The LinkedIn Insight Tag, and Google’s advertising features when advertising storage is on, may count as “sharing” personal information for cross-context behavioral advertising under the CCPA. You can opt out of that sharing by declining cookies in the banner or in your cookie choice above. We have no actual knowledge of selling or sharing the personal information of anyone under 16.
The table below lists the categories of personal information the site collects, as the CCPA defines them, where they come from, why we collect them and who receives them. Section 10 explains how long we keep each kind of information.
| Category and examples | Sources | Why we collect it | Who receives it |
|---|---|---|---|
| Identifiers, such as your name, work email, IP address and cookie identifiers | SourcesYou, your broker and your device | Why we collect itTo reply, to underwrite applications, to secure the site, and for analytics and advertising | Who receives itService providers; insurance partners and your broker for applications; Google and LinkedIn for advertising if you accept cookies |
| Professional information, such as your job title, employer and role in an application | SourcesYou and your broker | Why we collect itTo reply and to underwrite applications | Who receives itService providers; insurance partners and your broker |
| Commercial information, such as the coverage you are interested in, application answers, prior insurance, claims history and documents | SourcesYou, your broker and public sources | Why we collect itTo underwrite and place coverage and to keep records | Who receives itService providers; insurance partners and your broker |
| Internet activity, such as pages viewed, links and buttons clicked, referring site, campaign details and browser and device type | SourcesYour device | Why we collect itFor analytics, advertising measurement and security | Who receives itService providers; Google and LinkedIn for advertising if you accept cookies |
| Approximate location, such as the country or city inferred from your IP address | SourcesYour device, through our analytics providers | Why we collect itFor analytics and security | Who receives itService providers |
Other U.S. States
Residents of other states with comprehensive privacy laws, such as Colorado, Connecticut and Virginia, have similar rights, including the right to appeal if we decline a request. We honor these requests where the law applies to us.
How to Make a Request
Email jeremy@mayflowerspecialty.com with the subject “Privacy request” and tell us what you would like us to do. We will confirm your identity before we act, usually by checking that the request comes from the email address we hold, and we may ask for more information if we need it. You may use an authorized agent, in which case we will ask for proof that you authorized them. If we decline your request, we will explain why, and where the law gives you a right to appeal, you can do so by replying to our decision. We respond within the time limits the law sets.
13. Children
The site is for businesses and their advisers. It is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, please contact us and we will delete it.
14. Changes to This Policy
We will update this policy when our practices or the law change. When we do, we will post the new version on this page and change the date at the top. If a change is significant, we will also make it prominent on the site, or tell you directly where we have your contact details.
15. Contact Us
For questions about this policy or about how we handle your information, or to make a request, email Mayflower Specialty, Ltd. at jeremy@mayflowerspecialty.com. For anything else, the contact form is the quickest way to reach the team, and our Terms of Use explain the rules for using the site.
