WATERLINE PAY LLC PRIVACY POLICY

This Privacy Policy describes how Waterline Pay LLC, an Illinois limited liability company (“Waterline,” “Company,” “we,” “us,” or “our”), collects, uses, discloses, retains, and protects information through waterlinepay.com, staging.waterlinepay.com, our customer dashboard, upload tools, reporting features, and related services that link to this Privacy Policy (collectively, the “Services”).

Waterline provides salary and compensation benchmarking services to U.S. nonprofit organizations. The Services are business-to-business services. Individual users generally access the Services on behalf of their organizations.

This Privacy Policy is a notice of our information practices. It is not intended to create contractual rights beyond those provided by applicable law. Our Terms of Service govern use of the Services and certain rights and obligations relating to customer content and the Services.

1. Scope of this Privacy Policy

This Privacy Policy applies to information collected through the Services, including public marketing pages and portions of the application available only to registered users.

When a customer organization uploads staff roster information, job-description files, or other customer content, the customer determines what information to submit and the business purposes for which it uses the Services. Waterline processes that information to provide, maintain, secure, and improve the Services as described in this Privacy Policy and the applicable customer agreement.

The Services are offered to U.S. nonprofit organizations and are not directed to residents of other countries. Waterline does not currently market or sell the Services outside the United States. The website may nevertheless be technically accessible from outside the United States.

2. Information We Collect

2.1. Information You Provide Directly

• Account information, such as name, work email address, password or authentication information, organization name, role or title, and other information needed to create, administer, and secure an account.
• Organization information, such as organization name, EIN, budget size or budget band, metro area, sector, benefits information, and other information used to configure the account and benchmarking cohort.
• Communications and support information, including information you submit through request-access forms, contact forms, surveys, feedback, support requests, or email correspondence.
• Subscription and billing information. Payments are processed by Stripe or another third-party payment processor. Waterline does not store complete payment-card numbers. We may receive limited information such as transaction status, subscription status, invoice information, billing contact information, and payment metadata needed to administer subscriptions.

2.2. Staff Roster Information

Customers may upload staff roster information for compensation benchmarking. Roster fields may include job title, salary or other compensation fields, pay type, full-time-equivalent status, hire year, metro area, union status, and other role- or employment-related information used for benchmarking and analysis. Waterline does not intentionally store employee names or employee email addresses from uploaded staff rosters.

2.3. Job Description Files

Customers may optionally upload job-description documents, including PDF, DOCX, DOC, and TXT files. Job-description documents may contain information that the customer chooses to include, including names of incumbents or managers, job duties, reporting relationships, compensation information, or other information relating to identifiable persons.

Waterline stores the uploaded job-description file as provided and may extract and process text from it to improve role matching and benchmarking accuracy. Waterline may also use information derived from job descriptions, after removing or reducing identifying details where reasonably practicable, to improve role taxonomies, matching rules, analytics, and existing or future products and services. Waterline uses automated processes designed to remove names, contact details, and organization identifiers from extracted text, but because job descriptions are free-form documents, Waterline cannot guarantee that all names or other identifying details will be detected or removed before the extracted text is stored or processed, including by the AI service providers described under “AI-Assisted Features.”

Customers should avoid including personal information in job descriptions unless it is reasonably necessary for the customer’s use of the Services.

2.4. Information From Public and Other Sources

Waterline uses or may use information from public, government, survey, and other lawful sources to provide and improve the Services. These sources may include:

• Public IRS Form 990 filings and the IRS Exempt Organizations Business Master File.
• U.S. Bureau of Labor Statistics wage statistics, including Occupational Employment and Wage Statistics and related government data.
• ProPublica Nonprofit Explorer organization-level information.
• Publicly available nonprofit job postings and compensation information.
• The 2023 Watershed Nonprofit Compensation Survey and other lawfully obtained survey information.
• Customer-contributed information used to create the peer benchmarking pool.

Where Waterline ingests individual names from public IRS filings, Waterline’s current process replaces each name in its benchmarking database with a code used to recognize the same individual’s records. The individual’s name is not stored in Waterline’s benchmarking database. Waterline may retain copies of the underlying public IRS filings as published, which include the names reported in them. Survey respondent names, email addresses, and IP addresses are removed when the applicable file is parsed and are not loaded into Waterline’s benchmarking database. Waterline retains the original survey file separately from the Services.

2.5. Information Collected Automatically

Waterline’s application does not currently use advertising trackers or general website analytics and does not currently store geolocation data or device identifiers in its application database. Waterline’s authentication provider records the IP address and browser information associated with each login session in order to maintain and secure account access. Waterline’s hosting and infrastructure providers may process IP addresses, request metadata, browser information, timestamps, and similar technical information in transient server or security logs as part of operating and securing the Services.

Logged-in users receive a strictly necessary authentication or session cookie used to maintain secure account access.

2.6. Planned Product Analytics and Cookies

Waterline may implement product analytics, such as PostHog or a similar provider, to understand page views, feature use, performance, errors, and how logged-in users interact with the application for internal product improvement. Before using non-essential analytics cookies or similar technologies, Waterline intends to provide a cookie banner or other appropriate choice mechanism.

2.7. Information Used for Marketing or Announcements

Waterline may collect business contact information from people who request information from us, sign up for updates, or otherwise provide contact information for communications. Waterline may also receive business contact information from lawful public or business sources.

3. How We Use Information

We may use information for the following purposes:

• To create, administer, authenticate, and secure accounts.
• To receive, sanitize, store, and process staff rosters and job-description files.
• To match roles to appropriate benchmark positions and generate compensation benchmarks, dashboards, and reports.
• To maintain the peer benchmarking pool and other benchmarking datasets in accordance with the Services and applicable customer agreements.
• To create de-identified or aggregated benchmarking information and other statistical or analytical information.
• To improve role taxonomies, matching rules, dashboards, reports, product functionality, and existing or future products and services.
• To provide customer support and respond to requests, questions, and feedback.
• To administer subscriptions, payments, and billing.
• To communicate with customers and users about accounts, transactions, product updates, security, support, and the Services.
• To send marketing or promotional communications where permitted by law and consistent with applicable communication preferences.
• To protect the Services and our users; detect, prevent, investigate, and respond to fraud, abuse, unauthorized access, technical issues, and security incidents.
• To comply with applicable law, legal process, contractual obligations, audits, and regulatory requirements; establish, exercise, or defend legal claims; and support business transactions.

4. Benchmarking, Aggregation, and Product Improvement

Confirmed customer compensation information may contribute to Waterline’s peer benchmarking pool. Participation in the peer pool is a condition of receiving peer benchmarks, as described in the Services and applicable customer agreement.

Waterline may create, use, retain, and disclose aggregated or de-identified benchmarking information for benchmarking, analytics, research, product improvement, and other lawful business purposes. Waterline’s current methodology does not display a standalone peer compensation figure drawn from fewer than ten (10) organizations. Peer data from fewer organizations may contribute, at reduced weight, to a market figure that combines multiple data sources. Peer benefits and bonus figures are displayed once at least five (5) organizations have provided the applicable information.

Waterline may also use information derived from job descriptions, after removing or reducing identifying details where reasonably practicable, to improve role taxonomies, matching logic, and products and services. If an organization’s data is deleted from the Services, Waterline’s intended design is to remove that organization’s contributed rows and recompute pooled aggregates without those contributions, including contributions derived from job-description content.

5. AI-Assisted Features

Waterline uses AI service providers to support certain features of the Services, including generating narrative or explanatory text in reports, assisting with matching positions to benchmark roles based on titles and job descriptions, summarizing job descriptions, and interpreting benchmarking, benefits, compensation, and related information. For these features, Waterline may send information from the categories described in this Privacy Policy to an AI service provider, including roster fields, market benchmark figures, organization configuration information such as budget band, metro area, and sector, benefits and bonus information, and extracted job-description text.

Waterline does not intentionally send names, email addresses, organization names or identifiers, or other direct identifiers with this information and uses automated processes designed to remove such identifiers before transmission. Because job descriptions and other free-form materials may contain identifying information, Waterline cannot guarantee that every identifying detail will be detected and removed. AI-generated suggestions are presented to the customer for review and do not modify customer data without customer action.

Waterline uses commercial or enterprise AI service providers and does not authorize those providers to use customer personal information or customer content to train unrelated general-purpose models. The applicable Terms of Service or customer agreement may provide additional terms regarding customer content, product improvement, and third-party processing.

6. How We Disclose Information

We may disclose information in the following circumstances:

6.1. Customer Organization Access

Information submitted through a customer account may be accessible to authorized users of that customer organization according to the account configuration, user permissions, and applicable customer agreement.

6.2. Service Providers

We may disclose information to vendors and service providers that process information for Waterline. Waterline’s current service providers that receive or may receive customer information are Supabase (database and file storage), Vercel (hosting), Resend (transactional email), Anthropic (AI-assisted features), Google Workspace (business email), Google (authentication), and Stripe (payment processing).

We provide service providers only the information reasonably necessary for their functions and expect them to protect information and process it for authorized purposes under applicable agreements or terms.

6.3. Aggregated and De-identified Information

We may disclose aggregated or de-identified benchmarking information that is not reasonably designed to identify an individual or a customer organization. Waterline applies the minimum aggregation thresholds described in Section 4. This may include aggregated summaries or analyses of job duties, qualifications, role characteristics, or similar information derived from job descriptions across multiple customer organizations, subject to the applicable minimum aggregation threshold and without reproducing any single customer organization's job-description document.

6.4. Legal, Safety, and Business Purposes

We may disclose information where reasonably necessary to comply with law, regulation, legal process, or governmental request; enforce our agreements or policies; detect or address fraud, security, or technical issues; protect the rights, property, or safety of Waterline, customers, users, or others; or establish, exercise, or defend legal claims.

We may also disclose information to lawyers, accountants, auditors, insurers, bankers, and other professional advisors, or in connection with a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, due diligence process, or similar business transaction.

6.5. With Consent or Direction

We may disclose information with the customer’s or user’s consent or at the customer’s or user’s direction.

6.6. No Sale or Targeted Advertising

Waterline does not sell personal information, does not share personal information with third parties for their own independent marketing or advertising purposes, and does not currently use personal information for cross-context behavioral advertising.

7. Cookies and Tracking Choices

The Services currently use a strictly necessary authentication or session cookie for secure login and account access. Waterline does not currently use advertising cookies or social-media tracking pixels.

If Waterline implements non-essential product analytics, users will be provided with a cookie banner or other appropriate mechanism to manage non-essential cookies or similar technologies. Users may also manage cookies through browser settings, although disabling strictly necessary cookies may prevent portions of the Services from functioning.

Some browsers transmit “Do Not Track” signals. Because there is not a uniform industry standard for those signals, Waterline does not currently respond to Do Not Track signals. If Waterline later engages in processing subject to a legally recognized browser-based opt-out preference signal, Waterline will address such signals as required by applicable law.

8. Security

Waterline uses administrative, technical, and organizational safeguards designed to protect information from unauthorized access, loss, misuse, alteration, and disclosure. Current practices include TLS encryption for data in transit, encryption at rest through cloud providers, row-level database security, multi-factor authentication for administrative accounts, device encryption on the primary work device, provider-level network controls, and access controls designed to limit access to authorized users and systems.

Waterline also designs the Services to minimize unnecessary employee identifiers, including detecting and discarding name and email columns from uploaded salary rosters before storage and replacing names ingested from public IRS filings with coded keys rather than storing the names themselves.

No method of transmission, hosting, or electronic storage is completely secure. Waterline cannot guarantee absolute security.

9. Security Incidents

If Waterline becomes aware of a security incident affecting information processed through the Services, Waterline will investigate and take steps it determines appropriate under the circumstances. Where required by applicable law or contract, Waterline will provide notice of a breach of security to affected customers, users, regulators, or other required recipients within the time required by applicable law or the applicable customer agreement.

Because the Services are provided to organizational customers, Waterline may provide breach-related notice to the affected customer organization, which may have its own obligations to notify personnel or other individuals depending on the facts and law.

10. Retention and Deletion

We retain information for as long as reasonably necessary to provide the Services, maintain accounts, support customers, preserve the integrity and auditability of reports, maintain security, comply with legal obligations, resolve disputes, enforce agreements, and support other lawful business purposes.

Customer data is generally retained while the applicable account or customer relationship remains active, and may continue to be retained after an account is cancelled or expires unless the customer requests deletion. Job-description files and text extracted from them are retained until the customer’s data is deleted, or as otherwise needed to provide the Services. Generated reports may be retained as point-in-time records for the customer.

Customers may request deletion of their organization’s data. Waterline’s intended deletion design removes the organization’s contributed data and recomputes pooled aggregates without that organization’s contributed rows, including applicable contributions derived from job-description content. Reports generated before a deletion request, including reports generated for other customers, are point-in-time records and may continue to reflect aggregate figures calculated before the deletion. Some information may remain for a limited period in backups, archives, logs, or disaster recovery systems, or may be retained where required or permitted by law.

Waterline may create, retain, and use aggregated or de-identified information derived from information processed through the Services for benchmarking, analytics, research, product improvement, and other lawful business purposes. Waterline may also retain organization-level benchmarking information as described in this Privacy Policy and the applicable Terms of Service. When Waterline discloses benchmarking information to other customers or third parties, such information will be presented in aggregated or de-identified form and will not be designed to identify any individual or customer organization. Waterline applies the minimum aggregation thresholds described in Section 4.

11. Your Choices and Requests

Users may access, update, or correct certain account or organization information through the Services or by contacting Waterline.

Customers or users may request access, correction, or deletion of certain information by contacting Waterline at support@waterlinepay.com. If information is controlled by a customer organization, Waterline may direct the requester to that organization or respond in coordination with it.

Marketing recipients may opt out of promotional emails by using the unsubscribe mechanism included in the message or by contacting Waterline. Even after a marketing opt-out, Waterline may continue to send account, transactional, administrative, legal, security, or service-related communications.

Users may reject non-essential cookies through the cookie preference mechanism when implemented. Rejecting marketing communications or non-essential analytics cookies will not ordinarily affect core Service functionality.

12. U.S. State Privacy Rights

Some U.S. state privacy laws provide residents with rights concerning personal information, which may include rights to access, correct, delete, or obtain a copy of certain information, and rights to opt out of certain sales, sharing, targeted advertising, or profiling. Whether a particular law or right applies depends on the user’s state, Waterline’s role, statutory thresholds, the context in which information is processed, and applicable exemptions.

If applicable law provides you with a privacy right, you may submit a request to support@waterlinepay.com. Waterline may request information reasonably necessary to verify identity, authority, state of residence, and relationship to the applicable customer organization. Where required by law, Waterline will provide a process to appeal a denied request.

Waterline does not currently sell personal information, share personal information for cross-context behavioral advertising, or profile individuals in furtherance of decisions that produce legal or similarly significant effects.

Certain information processed through the Services may be considered sensitive personal information or sensitive data under applicable law, including compensation information and, if provided by a customer, information concerning union membership or status. Waterline processes such information for the purposes described in this Privacy Policy and does not use sensitive personal information to infer characteristics about individuals except as necessary to provide the Services or as otherwise permitted by applicable law. Customers should provide sensitive personal information only where reasonably necessary for their use of the Services and are responsible for providing any notices and obtaining any consents or authorizations required by applicable law.

13. Children’s Privacy

The Services are business-to-business services and are not directed to children under 13. Waterline does not knowingly collect personal information directly from children under 13. If Waterline learns that it has collected personal information from a child under 13 without required consent, Waterline will take reasonable steps to delete that information.

14. Third-Party Services and Links

The Services rely on third-party providers for functions such as hosting, database infrastructure, storage, authentication, email, AI-assisted features, analytics, and payment processing. The public website or Services may also link to third-party websites or resources. Waterline is not responsible for the independent privacy or security practices of third-party websites or services that Waterline does not control.

Payment information is processed by Waterline’s third-party payment processor, currently Stripe. The processor’s handling of payment information may also be governed by its own privacy notices and terms.

15. International Access and Data Processing

Waterline offers the Services to U.S. tax-exempt organizations and does not currently market or sell the Services to residents of other countries. Waterline’s current infrastructure primarily processes customer data in the United States, and some service providers may process information outside the United States. The Services may nevertheless be technically accessible from outside the United States. If you access the Services from outside the United States, you understand that information may be processed in the United States.

16. Changes to This Privacy Policy

Waterline may update this Privacy Policy from time to time to reflect changes in law, technology, business operations, or the Services. When we update this Privacy Policy, we will revise the “Last Updated” date above. We will provide additional notice or obtain consent for material changes where required by applicable law.

17. Contact Us

If you have questions about this Privacy Policy, our privacy practices, or a privacy request, contact:

Waterline Pay LLC 1507 Sheridan Road Highland Park, Illinois 60035 Email: support@waterlinepay.com