Privacy Policy

This Privacy Policy explains how Flying Goat Leads ("we", "us", or "our") collects, uses, shares, and retains personal information in connection with the Flying Goat Leads marketplace (the "Marketplace"). It covers both the consumers whose insurance inquiry records ("Leads") we handle and the insurance agents who buy them.

Two different groups of people appear throughout this Policy, and the rules are not the same for each. Consumers are the people whose insurance inquiries become Leads; their information is what we sell, and Sections 3, 4 and 10 are the ones that matter to them. Agents are the licensed insurance professionals who hold an account and buy Leads; their account and contact information is not for sale, and Sections 6 and 7 explain how we treat it. Defined terms used in this Policy are set out in Section 15.

1. Personal information we collect

We collect the following categories of personal information (PII):

• Consumer contact and identity data submitted through insurance inquiry forms or provided by our lead sources, which may include name, phone number, email address, postal address, age or date of birth, and the type of insurance the consumer is interested in.
• Consumer inquiry metadata, such as the date and source of the inquiry and, where available, records evidencing the consumer's consent to be contacted.
• Agent account data for buyers, including name, business name, email address, password credentials, mobile number, licensed states, product selections, wallet and payment records, text-message consent records, and IP address at the time of key actions such as agreement acceptance.
• Technical and log data, such as IP address, browser type and version, the pages of the Marketplace you visit, the date and time of your visit, the time spent on those pages, device type, operating system, unique device identifiers, other diagnostic data, and audit records of actions taken in the Marketplace. Where the Marketplace is accessed from a mobile device this may include the type of mobile device, its unique device identifier, its mobile IP address, its operating system, and the mobile browser used. We retain technical and log data for a shorter period than Lead records, except where it is used to strengthen security or where we are legally obliged to keep it longer.
• Cookies and similar technologies. We set only strictly necessary cookies: the ones that keep a signed-in agent signed in, that carry a pending multi-factor authentication step, and that carry a pending mobile-number verification step. We do not run advertising pixels, analytics tags, session recording, or any third-party tracking technology on this site, and we do not use cookies to build profiles or to sell or share personal information. You can set your browser to refuse cookies. Because the only cookies we set are the ones listed here, refusing them does not switch off any advertising or analytics technology, which we do not run; it stops you from signing in and staying signed in.

2. How we use personal information

We use personal information to operate the Marketplace, to provide Leads to insurance agent buyers, to run consumer inquiry intake and routing, to process wallet top-ups and lead purchases, to maintain security and audit trails, to comply with legal obligations, and to communicate with agents and consumers as permitted by law.

We may also use personal information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets.

3. Sale and sharing of consumer leads (disclosure)

We want to be clear and direct: our business model involves selling and sharing consumer Leads. A Lead contains consumer personal information, and we sell and share that personal information with insurance agent buyers so that those agents can contact the consumer about insurance products. Under laws such as the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), this constitutes a "sale" and a "sharing" of personal information. We do not sell or share the sensitive login credentials of agent accounts.

4. Your right to opt out (Do Not Sell or Share)

Consumers have the right to direct us not to sell or share their personal information. To exercise this right, a consumer may submit a Do Not Sell or Share My Personal Information request by emailing leads@flyinggoatleads.com with the subject line "Privacy Request". Section 10 explains exactly what to include and what happens next. When we receive a valid opt-out, we will stop making that consumer's Lead available for sale or sharing and will record the opt-out in our suppression registry, which is checked when new inquiries arrive and again before any lead is delivered. Opting out does not require creating an account, we do not charge for it, and we will not discriminate against a consumer for exercising this right.

If a Lead containing your information was already sold to an agent before we received your opt-out, we will also direct that agent buyer to honor it. Under the Lead Purchase Agreement, agent buyers are separately obligated to honor any opt-out or revocation of consent they receive or are told about.

5. Service providers and other recipients

Separately from the sale and sharing of Leads described in Section 3, we disclose personal information to a small number of service providers that process it on our behalf, under contract, only for the purposes listed and not for their own marketing. As of the version date of this Policy they are:

• Vercel — application hosting and server logs. Handles request data, including IP addresses, for every page and API call.
• Neon — managed PostgreSQL database hosting. Stores Lead records, agent accounts, consent records, wallet and ledger records, and audit logs.
• Upstash — managed Redis, used for rate limiting and short-lived operational state. Receives IP addresses and account identifiers as keys.
• Stripe — payment processing for agent wallet top-ups. Stripe collects the payer's card and billing details directly on its own hosted checkout page; we do not receive or store full card numbers. No consumer Lead data is sent to Stripe.
• Meta — the source of consumer insurance inquiries submitted through Meta lead advertising forms. We retrieve the consumer's submission and the associated consent record from Meta. We do not send consumer personal information back to Meta, and we do not run a Meta pixel or conversions integration on this site.
• HighLevel (GoHighLevel) — the messaging platform that transmits the agent text messages described in Section 7, and the contact record that supports them. Receives agent name, email address and mobile number. Consumer Lead contact details are not placed in text messages.
• Google (Google Workspace) — the mail service that transmits our outbound email from leads@flyinggoatleads.com. Because Leads are delivered to agent buyers by email, consumer Lead contact details pass through this mail service in transit.
• Telegram — receives operational and financial alerts for our own staff. These alerts carry account identifiers and transaction metadata, not consumer Lead contact details.

Apart from the sale and sharing of Leads described in Section 3, we do not disclose personal information to any recipient so that the recipient can market its own products, services, or promotions, and we do not disclose it to an Affiliate for that purpose either. The list above is the complete set of service providers that receive personal information on our behalf as of the version date of this Policy.

We may also disclose personal information where we are required to do so by law or in response to a valid request by a public authority such as a court or a government agency, and where we believe in good faith that disclosure is necessary to: comply with a legal obligation; protect and defend our rights or property; prevent or investigate possible wrongdoing in connection with the Marketplace; protect the personal safety of users of the Marketplace or of the public; or protect against legal liability. We may also disclose personal information to establish or defend legal claims, to enforce our agreements, or in connection with a merger, acquisition, financing, or sale of assets. If personal information would become subject to a different privacy policy as a result of such a transaction, we will provide notice before that happens.

6. Automated decision-making and artificial intelligence

We do not use artificial intelligence, machine learning, or large language models to process personal information, and we do not send consumer or agent personal information to any AI or model-inference service.

The parts of the Marketplace that might be assumed to use AI do not. Lead intake maps fields deterministically from the source form. Duplicate detection and suppression are exact matches on a normalized phone number or email address. Assignment of a Lead to an agent is a deterministic round-robin rotation. Detection of a text-message opt-out is an enumerated keyword match. None of these steps scores, profiles, or predicts anything about an individual.

If we ever introduce AI processing of personal information, we will update this Policy before we do it.

7. Text messages and mobile information

This section is about our text-message program, which is offered only to registered insurance agent account holders. It is not about consumer Lead data. Read the two parts below together; they are deliberately different.

Agent mobile information. If you are an agent and you opt in to lead-alert text messages, we use the mobile number on your account only to send you the alerts you consented to and to operate the program, which means delivering the messages, handling STOP and HELP replies, and keeping the consent audit trail. No mobile information collected for our text-message program will be shared with third parties or affiliates for marketing or promotional purposes. Text message originator opt-in data and consent are not shared with any third party for any purpose other than delivering the messages you asked for. This carve-out overrides every other category of sharing described in this Policy as it applies to that data: whatever else we share, we do not share your text-message opt-in or your consent record. We do disclose your mobile number to the messaging platform identified in Section 5 for the sole purpose of transmitting the message. Our SMS Terms describe the program in full.

Consumer Lead data is different, and we are not going to blur the two. The paragraph above concerns a mobile number that an agent gives us so that we can text that agent. It does not apply to the consumer contact information contained in a Lead. As Section 3 states plainly, a Lead includes a consumer's phone number, and we do sell and share Leads with insurance agent buyers. A consumer whose phone number appears in a Lead is not a subscriber to our text-message program, and nothing in this Section limits or contradicts the sale and sharing disclosed in Section 3. Consumers who want us to stop selling or sharing their information should use Section 4 and Section 10. We do not send marketing text messages to consumers.

8. Data retention

We retain personal information for as long as needed for the purposes described in this Policy and as required by law. Specifically:

• Unsold Leads: a Lead that has not been sold expires and is removed from active availability ninety (90) days after we receive it.
• Sold Leads: once a Lead has been sold or shared with an agent buyer, the associated record is retained indefinitely. We keep it, and the related consent and provenance records, to evidence the transaction and consumer consent and to meet legal and compliance obligations, including record retention consistent with a four (4) year TCPA-oriented retention practice. Deletion requests are honored subject to these legal retention exceptions.

9. Your privacy rights

Depending on where you live, you may have rights to know what personal information we hold about you, to access a copy of it, to correct it, to delete it, and to opt out of the sale or sharing of it. These rights are subject to legal exceptions, including the retention exceptions described above for sold Leads and for records we must keep by law.

10. How to exercise your rights (DSAR)

Email leads@flyinggoatleads.com with the subject line "Privacy Request". That mailbox is monitored and is the designated contact for every privacy request, including a Do Not Sell or Share opt-out, a request to know or access, a correction request, and a deletion request. This is the only step required to submit a data subject access request (DSAR).

Please include:

• Which right you are exercising: opt out of sale or sharing, know or access, correct, or delete.
• The phone number and email address that would appear on the inquiry. These are the fields we match on, so a request without at least one of them cannot be matched to a record.
• If you are an authorized agent submitting on someone's behalf, say so and include evidence of your authority.

What happens next:

• First, we verify that the request comes from the person the information is about, or from someone authorized to act for them, by matching the details you provide against our records and, where necessary, asking you for further information. Information you send us for verification is used only to handle the request.
• Next, we log the request, the verification, and the action taken in our internal DSAR workflow, so there is a record of how it was handled.
• Then we respond within the timeframes required by applicable law. For a request to opt out of the sale or sharing of personal information, that is as soon as feasible and in any event within fifteen (15) business days of receipt. For a request to know, access, correct, or delete, that is within forty-five (45) days of receipt, which may be extended once by a further forty-five (45) days where the law allows, in which case we will tell you before the first period ends.
• If we cannot verify you, or if an exception means we must deny the request in whole or in part, we will tell you and explain why.

There is no charge for making a request, and making one will never affect the price, quality, or availability of anything we offer.

An opt-out or deletion is matched against our records using the phone number and email address you give us, so please give us every number and address you may have used. If we hold no record matching what you send, there is nothing for us to act on and we will tell you so. Where a matching Lead has already been sold, Section 8 explains which records we are required to keep, and Section 4 explains what we do about the agent who bought it.

11. Security (GLBA safeguards)

We treat consumer financial and insurance inquiry data as nonpublic personal information and maintain an information security program with administrative, technical, and physical safeguards designed to protect it, consistent with the Gramm-Leach-Bliley Act (GLBA) Safeguards Rule. Safeguards include access controls and row-level access restrictions, encryption of credentials, audit logging of sensitive actions, and least-privilege access for staff. No system is perfectly secure, and we cannot guarantee absolute security, but we work to protect personal information against unauthorized access, use, and disclosure.

12. Agent buyer obligations

Agents who buy Leads are independent data controllers for the personal information they receive and must handle it in compliance with all applicable privacy, consent, and marketing laws, including honoring any consumer opt-out or revocation they receive. The Lead Purchase Agreement governs those obligations.

13. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be posted here with an updated version marker.

14. Contact us

For any privacy question, and for every request described in Sections 4 and 10, email leads@flyinggoatleads.com. That mailbox is the designated contact for Flying Goat Leads privacy requests, and it is the address to use even if you first encountered us under another of our names.

Flying Goat Leads is not a separate company. It is a service of Skel & Spence Management, LLC, a Florida limited liability company that also operates under the name Flying Goat Agency. Skel & Spence Management, LLC is the registered business behind this Marketplace, and it is the entity that carries the obligations described in this Policy, in our Terms of Service, in our SMS Terms, and in the Lead Purchase Agreement. Any legal notice about this Policy should be addressed to that entity. We operate from Florida, United States.

15. Interpretation and definitions

Words with an initial capital letter have the meaning given below. A definition has the same meaning whether it appears in the singular or the plural.

• Account means the credentialed access we issue to an Agent so that the Agent can use the Marketplace. Consumers do not have an Account.
• Affiliate means an entity that controls, is controlled by, or is under common control with us, where control means ownership of fifty percent (50%) or more of the shares, equity interest, or other securities entitled to vote for election of directors or other managing authority. Flying Goat Agency is a name under which our own company operates rather than a separate entity, and the protection in Section 7 applies to it exactly as it applies to any Affiliate.
• Agent means a licensed insurance professional, or the agency that person acts for, who holds an Account and buys Leads.
• Consumer means a person whose insurance inquiry became a Lead. A Consumer is covered by this Policy whether or not that person has ever visited this site.
• Cookies are small files placed on a device by a website. Section 1 lists every cookie we set.
• Device means anything that can access the Marketplace, including a computer, a phone, or a tablet.
• Lead means a record of a Consumer's insurance inquiry, including the Consumer's contact details, the inquiry metadata, and any consent record that came with it.
• Marketplace means the Flying Goat Leads website and the lead marketplace it hosts.
• Personal information means information that identifies, relates to, or could reasonably be linked with a particular individual. "Personal data" and "PII" mean the same thing in this Policy.
• Service provider means a person or company that processes personal information on our behalf and on our instructions, under contract. Section 5 names every one of ours.
• Usage data means the technical and log data described in Section 1, which is generated by the use of the Marketplace rather than supplied by a person.

16. Minors

The Marketplace is offered only to licensed insurance professionals and is not intended for anyone under eighteen (18). We do not knowingly create an Account for a minor. We do not knowingly collect personal information from a minor through an insurance inquiry, and we do not knowingly sell or share the personal information of a minor. If you believe we hold information about a minor, email leads@flyinggoatleads.com with the subject line "Privacy Request" and we will delete it, subject to the retention exceptions in Section 8. A parent or guardian may make that request on the minor's behalf.

17. Third-party links

The Marketplace links to services operated by others, including the hosted checkout page of our payment processor. We do not control those sites and we are not responsible for their content, their privacy policies, or their practices. Review the privacy policy of any site you visit.

18. Where information is processed

We and the service providers named in Section 5 process personal information primarily in the United States. Where a provider processes or stores personal information outside the United States, we require it by contract to apply safeguards consistent with Section 11, and we do not use a provider that cannot.