Legal · Compliance

The rulebook, kept in the open.

A market is only as trustworthy as the rules every member keeps. These are ours — what we follow, how the system enforces it, and how you can hold us to it.

Looking for our privacy policy? It has its own page.

The rulebook · what we follow, how we check it, and how to tell us when we fall short

IThe rules of the room

Four rules come before every other.

Utmost good faith

Tell people what matters before they have to ask: who we are, how we are paid, and what we cannot do for them.

Licensed acts, licensed hands

Recommending a plan, preparing a return or working a credit case is done only by a person whose license or credential has been verified.

III

Consent before contact

No marketing call or text without consent recorded for that purpose. A request to stop is honored everywhere, at once.

Nothing pooled that should not be

Health, credit and tax records live in separate suites. One suite cannot read another’s files, by design and by database rule.

IIThree lines of defence

Three walls, one gate each.

Banks and insurers protect customers with three independent lines. Each can stop what the one before it missed — and none answers to the line it checks.

First line
The people doing the work
Seated specialists working from approved scripts and checklists. The system disables regulated actions until their credentials are verified.
Second line
Compliance and risk
Approves every script, claim and creative before it runs; manages suppression lists and complaints; can halt any program on its own authority.
Third line
Independent review
An append-only audit log that the application itself cannot alter, reviewed without management present and exportable for examiners.

IIIThe register

Every law we answer to, and how we answer it.

Each line of business carries its own rules. The register names them, says what they require, and shows the control that enforces them — not a promise, a mechanism.

All lines

Telephone Consumer Protection Act · National Do Not Call Registry: RequiresPrior consent for marketing calls and texts; respect for do-not-call requests.; How we honor itConsent recorded with its source and scope; internal and national DNC suppression checked before any dial; the website form never authorizes marketing calls or texts.
FTC Telemarketing Sales Rule: RequiresTruthful calls, required disclosures, call-time limits and no advance fees for debt relief.; How we honor itApproved scripts only; calling windows enforced by recipient time zone; debt-relief fees blocked until a debt is resolved.
CAN-SPAM Act: RequiresHonest email with a working way to unsubscribe.; How we honor itEmail updates go only to people who opted in, and every message must carry a working unsubscribe. No marketing email is being sent today.

Health

CMS Medicare marketing rules: RequiresScope of Appointment before discussing products, required disclaimers, recorded calls.; How we honor itA Scope of Appointment must be recorded before a Medicare application can proceed; Medicare scripts and creative are checked automatically for the required disclaimer before approval.
ACA Marketplace agent and broker standards: RequiresMarketplace registration, consumer consent and accurate applications.; How we honor itMarketplace registration and state licenses verified before enrollment work; consent documented; no application marked enrolled without a confirmation reference.

Credit

Credit Repair Organizations Act · state credit-services laws: RequiresWritten contract, required disclosures, a three-day right to cancel, no fee before services are fully performed.; How we honor itThe system computes the cancellation deadline and refuses to record a fee until disclosures, contract, cancellation window and full performance are all on file.

Tax

Internal Revenue Code §7216 · IRS preparer rules: RequiresTax return information used only to prepare the return unless the client consents; preparers hold a valid PTIN.; How we honor itTax records are restricted to the tax suite; PTINs verified before preparation; no cross-selling from tax information without specific written consent.

Privacy

State consumer privacy laws: RequiresNotice, access, deletion, opt-out of sale and sharing, and browser privacy signals.; How we honor itWe do not sell or share personal information; Global Privacy Control is honored; requests are answered through the contact form.

IVControls

Rules are kept by machinery, not memory.

Credentials checked at the source

Licenses, Marketplace registrations, carrier appointments and PTINs are verified against the issuing authority, with expiry dates tracked. A role is never proof of a license.

Masked by default

Phone numbers, identifiers and protected fields are masked in lists. Revealing one is a deliberate act, permitted by role and written to the audit log.

Encrypted and separated

Encryption in transit and for sensitive fields at rest; row-level security keeps each suite’s records apart in the database itself.

Kept only as long as needed

Each category of record has a written retention period and the legal basis for it. When the period ends, the record is deleted.

Every access remembered

Sign-ins, denied requests, reveals, exports, seat assignments and approvals are logged. The log cannot be edited by the application.

Strong sign-in for strong roles

Managers and anyone with privileged access must use two-factor authentication. Sessions expire after inactivity and at a fixed limit.

VPrivacy policy

Privacy Policy

Last updated November 3, 2026

The short version is here. The full policy has its own page. To opt out of sale or sharing, see Do Not Sell or Share My Data.

We collect only what you send us, plus a one-way hash of your IP address.
We never sell or share personal information, and never call or text you for marketing because you wrote to us.
Inquiries are kept for up to two years, then deleted.
You can see, correct or delete your information, or stop our email, at any time.

Read the full Privacy Policy

VIRaise a concern

If we fall short, tell us.

A complaint is information we cannot get any other way. Every one is logged, reviewed by the second line, and counted — not buried.

Write to compliance

Say it is a compliance matter
Put “Compliance” at the start of your message so it is routed past sales.
No retaliation
Customers, partners and staff who raise a concern in good faith are protected from retaliation.
You can always go to the regulator
You may contact your state insurance department, attorney general, the FTC or the IRS directly at any time.

This page describes Michelangelo’s compliance program and privacy practices in general terms. It is not legal advice and does not create a contract. Laws and our controls change; we update this page when they do. Regulated activities are performed only by appropriately licensed professionals. See also the Disclosures.