Privacy Policy

Last updated: October 2, 2026

1. Introduction

BenefitMax Group LLC ("BenefitMax," "we," "us," or "our"), a Delaware limited liability company, operates the BenefitMax platform and related services (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Additionally, this Policy describes personal information for which BenefitMax determines the purposes and means of processing, which is principally information about account holders, website visitors, prospective customers, and the business contacts included in MAX Leads (Section 2.5). Where our business customers (for example, brokerage firms, employers, and group health plans) upload documents or other data to the Service, we process that data as a service provider and processor on that customer's behalf under our written agreement with them, and that agreement governs.

By using the Service, you agree to the collection and use of information in accordance with this policy. Your use of the Service is also governed by our Terms of Service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

  • Name and email address
  • Company/organization name
  • Account credentials (managed securely by our authentication provider)
  • Billing information (processed securely by Stripe)

2.2 Documents and Content

When you use our document management features, we store:

  • Documents you upload to your Library
  • Documents imported from Google Drive (with your authorization)
  • AI-generated summaries and analysis of your documents
  • Chat conversations with MAX (our AI assistant)

2.3 Usage Information

We automatically collect:

  • Device information (browser type, operating system)
  • IP address and approximate location
  • Pages visited and features used
  • Date and time of access
  • Cookie, pixel, and device identifiers, referring URLs, and similar online identifiers (see Section 5)

2.4 Sensitive Personal Information

Documents and data submitted to the Service may contain sensitive personal information, including health and benefits plan information, Social Security numbers, and financial account information relating to you or to third parties such as employees and their dependents. We collect and use this information only to provide the Service and for the purposes described in Section 3. We do not use or disclose sensitive personal information for purposes other than those permitted under applicable law, and we do not use it to infer characteristics about you.

2.5 Business Contact Information (MAX Leads)

Our MAX Leads product provides subscribers with information about employee benefit plans and the businesses that sponsor them. We compile it from public Form 5500 filings and research business contact information for people associated with those businesses, such as name, job title, employer, business email address, and business phone number, from commercial data providers, company websites, and other publicly available sources. We make this information available to MAX Leads subscribers for business-to-business prospecting, under terms that prohibit resale. If you would like your information corrected or removed from MAX Leads, email privacy@benefitmax.ai.

3. How We Use Your Information

We use your information to:

  • Provide, maintain, and improve the Service
  • Process your subscription and payments
  • Provide AI-powered document analysis and chat features
  • Send you service-related communications
  • Respond to your inquiries and support requests
  • Analyze usage patterns to improve the Service
  • Detect and prevent fraud or abuse
  • Comply with legal obligations
  • Market the Service to business prospects, subject to your right to opt out of marketing emails at any time
  • Establish, exercise, or defend legal claims and enforce our Terms of Service

4. Service Providers

We use third-party service providers to operate the Service, including cloud hosting and storage, authentication, payment processing, email delivery, website analytics, and artificial intelligence model providers. These providers process information only on our behalf and under written agreements that restrict their use of it. A list of our subprocessors is available to business customers on request, subject to confidentiality.

5. Cookies and Analytics

We use cookies and similar technologies on our public website, including Google Analytics, to understand how visitors use the site, and the LinkedIn Insight Tag, to measure our LinkedIn advertising and show our ads to people who have visited our site. LinkedIn may receive information such as your browser type, IP address, and the pages you visit, and may associate it with your LinkedIn account under LinkedIn’s own privacy policy. These technologies are not used in the logged-in areas of the Service, and we do not use them to identify individual visitors. You can block or delete cookies through your browser settings, opt out of Google Analytics with Google’s browser add-on at https://tools.google.com/dlpage/gaoptout, and manage LinkedIn ad targeting in your LinkedIn advertising settings at https://www.linkedin.com/psettings/advertising.

6. Google Drive Integration

When you use our Google Drive import feature:

  • We request read-only access to your Google Drive
  • We only access files you explicitly select through Google's file picker
  • Selected files are copied to your BenefitMax Library
  • We do not modify or delete files in your Google Drive
  • You can revoke access at any time through your Google Account settings
  • Google Drive data is never used for advertising or used to train artificial intelligence models

BenefitMax's use and transfer of information received from Google APIs to any other application adheres to the Google API Services User Data Policy, including the Limited Use requirements. Consistent with those requirements, we do not use Google Workspace APIs data to develop, improve, or train generalized artificial intelligence or machine learning models, and we do not allow humans to read this data except (i) with your affirmative consent, (ii) as necessary for security purposes such as investigating abuse, (iii) to comply with applicable law, or (iv) where the data has been aggregated and de-identified.

7. AI Processing

Documents you upload and questions you submit are processed by third-party AI model providers to deliver the Service’s features. We do not use your documents to train AI models, and our AI providers are contractually prohibited from doing so. Protected health information is processed only by providers with whom we have a business associate agreement. AI output may be inaccurate or incomplete and is not a substitute for professional advice.

8. Data Sharing

We do not sell the personal information of our users. Business contact information in MAX Leads is made available to subscribers as described in Section 2.5. We have not sold or shared, and do not sell or share, the contents of customer documents, Libraries, or MAX Chat conversations. We may disclose your information:

  • With service providers who assist in operating our platform
  • Within your organization (between brokers, staff, and clients as configured)
  • To comply with legal obligations or respond to lawful requests
  • To protect our rights, privacy, safety, or property
  • In connection with a merger, acquisition, or sale of assets. We will notify you before your information becomes subject to a materially different privacy policy
  • With our affiliates and professional advisors, such as auditors and outside counsel, subject to confidentiality obligations
  • In de-identified or aggregated form that cannot reasonably be used to identify you, which we will maintain in that form and will not attempt to re-identify
  • At your direction or with your consent

9. Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, or disclosure. These currently include:

  • Encryption of data in transit (TLS/SSL)
  • Encryption of stored documents
  • Secure authentication through Clerk
  • Periodic security assessments and vulnerability testing
  • Access controls and audit logging

While we strive to protect your data, no method of transmission or storage is 100% secure. We maintain a written incident response plan and will notify affected individuals, our business customers, and regulators of a security incident within the timeframes required by applicable law, including state breach-notification statutes and, where applicable, the HIPAA Breach Notification Rule. You are responsible for safeguarding your account credentials and for promptly notifying us of any suspected unauthorized access.

10. Data Retention

We retain your data as follows:

  • Active accounts: Data is retained while your account is active
  • After account deletion: Data is deleted within 30 days
  • Billing records: Retained as required by law (typically 7 years)

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy. We may retain information longer where necessary to comply with a legal obligation, resolve disputes, enforce our agreements, or where a litigation hold applies.

11. Your Data Subject Rights

Depending on where you reside, you may have the right to:

  • Access the personal information we hold about you
  • Correct inaccurate information
  • Delete your account and associated data
  • Export your data in a portable format
  • Opt out of certain data processing
  • Withdraw consent you previously gave, without affecting processing already carried out
  • Be free from discrimination or retaliation for exercising your privacy rights

To exercise these rights, contact us at privacy@benefitmax.ai.

We will respond to your request within a reasonable time and may need to verify your identity before acting on it.

If the information you are asking about is contained in documents uploaded by one of our business customers, we act as that customer's service provider and will forward your request to them.

12. Health Information and HIPAA

Many of our customers are insurance brokers, employers, and group health plans that are covered entities or business associates under the Health Insurance Portability and Accountability Act (HIPAA). To the extent we create, receive, maintain, or transmit protected health information (PHI) on behalf of such a customer, we act as a business associate and do so only under a written business associate agreement. In that role, HIPAA and the business associate agreement, not this Policy, govern our use and disclosure of PHI.

We flow down equivalent obligations to subcontractors that may handle PHI, including our hosting, storage, authentication, and AI providers. We do not use or disclose PHI for marketing or advertising, and we do not permit advertising or identity-resolution technologies to operate on any page or data containing PHI.

13. Children's Privacy

The Service is not intended for users under 18 years of age. We do not knowingly collect personal information from children under 18. If we learn we have collected such information, we will delete it promptly. We do not sell or share the personal information of consumers under 16 years of age. Documents submitted by our business customers may contain information about dependents who are minors; we process that information solely as a service provider on the customer's behalf.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

15. Contact Us

If you have questions about this Privacy Policy, please contact us at:

Email: privacy@benefitmax.ai
Website: https://benefitmax.ai