What we collect, and what we do with it.

Last updated 11 August 2026 · Hipson Investments LLC, 2000 S Dairy Ashford, Ste 360, Houston, TX 77077

This notice covers hipsoninvestments.com and the tools on it. It is written to describe what the site actually does, in plain language. If anything here does not match your experience, tell us and we will fix the notice or the site.

What we collect, page by page

The plan-review form (/flyer). If you complete it we store what you enter: your name, company, work email, phone number if you give one, and your four answers about employee count, plan funding, renewal timing and what you need help with. We also record which link brought you and your browser's user-agent string. This is stored in a Google Firestore database that only Hipson staff can read.

The ACA review (/aca-review). This one does collect and store. Before the questions begin we ask for your name, company, work email and phone number, and we keep them along with your seven answers so we can send your results and follow up once. It is stored in the same Google Firestore database as the plan-review form, readable only by Hipson staff. If our system is unreachable when you finish, nothing is stored at all — the page instead opens an email in your own mail app, and you can see exactly what is being sent before you send it.

The ACA chat assistant. Several pages carry a voice-and-text assistant that answers general ACA questions. It is an AI, clearly labelled as one, and it is built not to ask for personal information — if you want a human, it gives you the office number. Conversations with it are processed and may be recorded by ElevenLabs, the service that runs it, under their own terms shown in the widget. Don’t put personal or company financial details into the chat; the review is the right place for those.

The health funnel (/health). This one runs entirely in your browser. Your answers are not transmitted to us or stored anywhere unless you press the button that opens an email — at which point you can see exactly what is being sent before you send it.

The ABA coverage review (/quote) — read this one carefully, because it is the only form on this site that asks about a child's health. If you use it, we store: your name and contact details; your ZIP code, household size and an income band; the names of the ABA clinic, doctors and prescriptions you want us to check; your child's age and the age at which their autism diagnosis was made; and the therapy hours that were prescribed or recommended. We ask you to tick a box agreeing to this before anything clinical is saved, because health information about a child should never be collected on implied consent. Your contact details are saved as soon as you finish the first step, so that if the form is interrupted an advisor can still call you — the rest is saved only when you press send. It goes into the same Google Firestore database as the other forms, readable only by Hipson staff, and it cannot be deleted or altered from a browser by anyone, including us. If our system is unreachable, nothing is stored: the page opens an email in your own mail app instead, and you see exactly what is being sent.

The ABA coverage check (/aba). The check itself stores nothing and sends nothing — the questions about your household and your child are answered in your browser and stay there, which is why the page needs no email to run. If you then ask us to email your results, we store your name, email and phone so we can send the guide and follow up once. Your answers are attached only if you tick the box offering to share them — therapy hours and a disability determination are health information about a child, and we do not collect those on implied consent. Untick it and we keep your contact details alone. Either way it goes into the same Google Firestore database as the other forms, readable only by Hipson staff, and it cannot be deleted or altered from a browser. If our system is unreachable, nothing is stored — the page opens an email in your own mail app instead, and you see exactly what is being sent.

The client portal (/portal). The "sample account" stores and sends nothing — it is demo data drawn in your browser. If you sign in and submit a question or a member-change request, we store what you typed, together with the name and email on the account you signed in with, so the request can be tracked through to done. These records go into the same Google Firestore database, readable only by Hipson staff and by you while signed in, and they cannot be deleted or altered from a browser.

The life-insurance call-back form (/personal/life-insurance). If you ask us to call, we store your name, your phone number or email, and who the coverage is for, so a licensed advisor can call you back. It goes into the same staff-only database. If our system is unreachable, nothing is stored — the page opens an email in your own mail app instead, and you see exactly what is being sent.

What we do with it. A licensed advisor uses those answers to look your clinic, doctors and prescriptions up in the federal Marketplace's public plan data and to work out what coverage would cost you. The names you give us are sent to that federal service as identifiers so it can tell us which plans include them; your name, your child's age, your diagnosis details and your income are not. We do not sell any of it, we do not share it with insurers unless you ask us to place coverage for you, and you can ask us to delete the whole record at any time by writing to information@hipson.com.

Every page. Firebase Hosting, which serves this site, keeps standard server logs including IP addresses, for security and reliability. We do not use Google Analytics, advertising pixels, or any cross-site tracking, and we do not set our own cookies.

Third parties that see something

• Google — hosting, the Firestore database, and the fonts this site loads. Loading a page contacts Google's font servers, which see your IP address.
• Substack — the newsletter sign-up box is an embedded Substack frame on some pages. If you subscribe, Substack handles that under its own privacy policy, and the address goes to them, not into the database above.
• Pulse AI Agency — the small "Live site by Pulseaa.com" badge is a script loaded from pulseaa.com.
• Insurance carriers — only if you become a client and only what is needed to quote or place your coverage.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done so.

Why we keep it

To reply to you, to prepare the review or assessment you asked for, and to keep a record of advice given — which, as a licensed insurance and securities practice, we are expected to retain. We do not send marketing email to people who only used a free tool; if you want the newsletter you subscribe to it separately.

How long

Enquiries that do not become client relationships: up to 24 months, then deleted. Client records: retained as long as required under insurance and securities recordkeeping rules, which is generally at least six years after the relationship ends.

Your choices

Texas residents have rights under the Texas Data Privacy and Security Act, and residents of other states may have similar rights. Whoever you are and wherever you live, you can ask us to:

• tell you what we hold about you,
• correct it,
• delete it, or
• send you a copy.

Email information@hipson.com with "Privacy request" in the subject, or call 281.493.6862. We respond within 45 days. There is no charge, and asking costs you nothing else — we will not treat you differently for it. If we decline, we will say why and how to appeal.

Security, honestly stated

The database is locked down so that the public can only submit an enquiry — it cannot read anything, and nothing can be deleted from a browser. Staff access requires a Google account on a named allowlist. That said, no website is perfectly secure, and we will not pretend otherwise. Please do not send policy numbers, Social Security numbers, medical details or account numbers through this website; if we need those, we will arrange a secure route.

Children

This site is meant for adults arranging coverage for a business or a household. We do not knowingly collect information from anyone under 13. Where a family's cover involves a child, the information comes from the parent or guardian and is handled with the same care as the rest of the file.

Changes

If this notice changes materially we will update the date at the top and, where it affects information we already hold, tell affected people directly.

This notice describes the website. Insurance and securities business conducted through Ameritas Investment Company, LLC (AIC) and Ameritas Advisory Services (AAS) is additionally covered by their own privacy notices, which are provided to clients at account opening and annually thereafter.