Privacy Policy

1. Introduction

This Privacy Policy explains how New Empact Work, LLC (“New Empact Work,” “we,” “our,” or “us”) collects, uses, shares, and protects information when you visit our website at newempactwork.com (the “Website”) or use the New Empact Work platform (the “Platform”). It also explains the choices and rights you have regarding your information.

We respect your privacy. We collect only what we need to run the Website and Platform, and we never sell your personal information.

2. Who We Are

New Empact Work, LLC is a software platform that helps non-profit associations and association management companies run awards, grants, scholarship, competition, and other application and review programs. We are organized under the laws of Virginia, USA, and we serve customers and users within the United States.

This policy uses two different roles for how we handle information:

• When you visit our Website, we act as the controller of your information.
• When you use the Platform as a reviewer, applicant, or staff member of a customer organization, we act as a processor on behalf of that customer (the association or association management company). That customer determines the purposes and means of processing within their program.

3. Information We Collect

a. Information you provide directly

On the Website:

• When you request a demo, we collect your name, work email address, organization name, and any details you include in the “tell us about your program needs” field.
• If you contact us by email, we receive the contents of your message and your email address.

On the Platform:

• If you are a reviewer or applicant invited by a customer, we collect your email address (used for passwordless sign-in) and any information you submit through forms the customer has configured, such as submission content, evaluations, scores, and written comments.
• If you are a staff user of a customer organization, we collect your email address, your role within the Platform, and a record of your activity for audit and security purposes.

b. Information collected automatically

On the Website:

We use Google Analytics to understand how visitors interact with our pages. Google Analytics collects information such as your IP address (in truncated form), browser and device type, pages viewed, and time spent. This information is collected through cookies and similar technologies. See Section 6 for details and your choices.

On the Platform:

The Platform does not use third-party analytics or tracking technologies. We log system events (sign-ins, configuration changes, review submissions, advancement decisions) for security, audit, and customer reporting purposes.

4. How We Use Information

We use the information we collect to:

• Respond to demo requests and other inquiries you send us.
• Operate, maintain, and improve the Website and Platform.
• Authenticate users through passwordless sign-in.
• Provide AI-assisted features (briefing cards, drafting help for reviewer feedback, variance summaries) using AWS Bedrock invoking Anthropic’s Claude model. See Section 5 for how this works.
• Generate audit logs and reports for customer organizations.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with applicable legal obligations.

We do not sell personal information, and we do not use personal information for targeted advertising.

5. How We Share Information

We share information only with the service providers and parties described below. Each service provider is bound by contractual obligations to protect your information and to use it only as needed to provide their service to us.

a. Service providers (sub-processors)

• Amazon Web Services, Inc. (AWS). Hosts the Platform infrastructure in the us-east-1 region (Northern Virginia). AWS processes information as needed to provide hosting, storage, and compute services.
• AWS Bedrock with Anthropic’s Claude model. When AI-assisted features are used, relevant submission content and reviewer prompts are processed through AWS Bedrock, which invokes Anthropic’s Claude model on our behalf. Per AWS Bedrock’s terms, inputs and outputs are not stored by Bedrock, are not used to train any model, and are not shared with Anthropic. Processing remains within the AWS environment.
• AWS Simple Email Service (SES). Sends transactional emails such as passwordless sign-in links, program notifications, and review reminders.
• Google LLC (Google Analytics). Provides analytics for the Website only. Data is processed in accordance with Google’s own privacy practices and is not used on the Platform.

b. Customer organizations

If you are a Platform user (reviewer, applicant, or staff member), your information is shared with the customer organization that invited you to participate in their program. The customer’s own privacy practices apply to their use of your information beyond what we control on their behalf.

c. Legal disclosures

We may disclose information if we are required to do so by law, subpoena, court order, or other legal process, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of New Empact Work, our users, or others, or to investigate fraud or security issues.

d. Business transfers

If New Empact Work is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal information through this Privacy Policy or by email before your information becomes subject to a different policy.

6. Cookies and Tracking Technologies

On the Website, we use cookies and similar technologies set by Google Analytics to understand how visitors interact with our pages. These cookies are used for analytics purposes only and not for advertising.

When you first visit the Website, a cookie banner lets you accept or reject analytics cookies. If you accept, we load Google Analytics. If you reject, we do not load Google Analytics and your choice is stored in your browser so the banner does not appear again. You can change your mind at any time by clearing site data for this domain in your browser settings.

You can control or refuse cookies through your browser settings, or you can use the Google Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout to prevent Google Analytics from collecting your data.

The Platform does not set advertising cookies or use third-party tracking technologies.

7. Data Retention

We retain information only as long as needed for the purposes described in this policy. Our standard retention periods are:

• Demo request information. Retained for up to two years from the date of your request, unless you become a customer or ask us to delete it sooner.
• Customer Platform data. Retained for the duration of the customer’s subscription and for ninety (90) days after termination, after which we provide an export to the customer and delete the data, unless the customer instructs otherwise in writing or applicable law requires longer retention.
• Audit and system logs. Retained for up to seven (7) years to support security, compliance, customer reporting, and integrity of past decisions.
• Aggregated and anonymized data. May be retained indefinitely for analytics and product improvement, since this data cannot reasonably be linked back to you.

8. Data Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect the information we hold. These include:

• Hosting on Amazon Web Services with redundant storage and monitored availability.
• Encryption of data in transit (TLS) and at rest.
• Role-based access controls and program-level access governance.
• Comprehensive audit logging of configuration changes, review activity, and advancement decisions.
• Program-level NDA enforcement when required by a customer’s configuration.

No system can be guaranteed fully secure. While we work to protect your information, we cannot guarantee absolute security and we encourage you to use strong, unique credentials and to report any suspected security issue to us at privacy@newempactwork.com.

9. Your Privacy Rights

a. Rights under Virginia law (VCDPA)

If you are a Virginia resident, the Virginia Consumer Data Protection Act gives you the right to:

• Confirm whether we process your personal information and access it.
• Correct inaccuracies in your personal information.
• Request deletion of your personal information.
• Obtain a portable copy of your personal information in a usable format.
• Opt out of the sale of personal information, targeted advertising, or certain types of automated profiling.

We do not sell personal information, do not conduct targeted advertising, and do not engage in profiling that produces legal or similarly significant effects, so the opt-out rights described above do not currently apply to our processing.

b. Rights under California law (CCPA / CPRA)

If you are a California resident, you have rights including the right to know what personal information we collect and how it is used, the right to delete personal information, the right to correct inaccurate personal information, the right to limit the use of sensitive personal information, and the right not to be discriminated against for exercising these rights.

c. Rights under other US state privacy laws

If you reside in another US state with a comprehensive privacy law (including Colorado, Connecticut, Utah, Texas, Oregon, and others), you have rights similar to those described above. We honor these rights consistent with applicable law.

d. How to exercise your rights

To exercise any of these rights, email privacy@newempactwork.com. We will verify your identity using your email address and any additional information reasonably needed. We will respond within the timeframes required by applicable law, typically within forty-five (45) days.

If you disagree with a decision we make about your request, you may appeal by emailing privacy@newempactwork.com with the subject line “Privacy Rights Appeal.”

If you are a Platform user (reviewer, applicant, or staff member) and your request relates to information we process on behalf of a customer organization, we may direct you to the customer or assist them in responding.

10. Children’s Privacy

The Website and the Platform are not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact us at privacy@newempactwork.com and we will take appropriate steps to delete that information.

11. International Users

The Website and Platform are intended for users in the United States. If you access them from outside the United States, your information will be transferred to and processed in the United States. By using the Website or Platform, you consent to this transfer.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the Effective Date at the top of this policy and provide notice through the Platform or by email where appropriate. Your continued use of the Website or Platform after changes take effect constitutes acceptance of the updated policy.