Privacy Policy

PART I — HOW TO READ THIS POLICY

1. Who we are and what this policy covers

Incenti Solutions, Inc. ("Incenti," "we," "us") is a Delaware corporation. We do three things:

• We build Incenti EDOS, our Economic Development Operating System platform, and Incenti Insights, our economic data and benchmarking product.
• We perform Professional Services — strategy and program design, economic and fiscal impact analysis, custom development on Incenti EDOS, implementation, onboarding, data migration and historical archive ingestion, custom reporting and configuration. We perform these only under a signed Statement of Work. Our fees are fixed or hourly. We do not charge contingency or success fees, we do not advocate before governmental bodies on a client's behalf, and we do not accept engagements to recommend, evaluate or score what a party should offer, seek, accept or concede in an incentive negotiation.

Our customers are economic development organizations and other public agencies, site selection and location consultants, chambers of commerce, public-private partnerships, and corporate real estate teams. A consulting client may have no platform subscription, and a platform customer may never buy consulting.

This policy covers personal information Incenti collects and uses in its own business as a controller — through incenti.co, when you fill in a form or subscribe to our newsletter, when you correspond with us, when you attend an event we host or sponsor, when you or your organization signs up for or administers an account, when we market to you, and when we administer a consulting engagement.

What this policy does not cover. When a customer puts information into their Incenti EDOS account, that customer decides what to collect and why. We process it on their instructions. This policy describes that arrangement at Part III so you understand it, but the customer's own privacy notice governs, and requests about that information should go to them. We will route requests we receive.

2. Our roles

3. Which section applies to you

• Visited our website, filled in a form, or received our marketing → Part II
• Your information is in a customer's Incenti EDOS account → Part III, § 12
• You are a listing contact, broker or property owner → § 13
• Your information was in material a consulting client sent us → § 14A.6
• You want to exercise a right → Part V

4. Business and government users

Most people whose information we hold are acting in a professional capacity. California does not exempt business contact information, so if you are a California resident, your name, title, employer and work contact details are personal information and you have the rights at § 26 even though we only ever knew you professionally. Most other states exclude individuals acting in a commercial or governmental capacity.

PART II — WHEN INCENTI IS THE CONTROLLER

5. Website visitors, prospects and marketing contacts

5.1 Where your information comes from

• From you — forms, newsletter signup, demo requests, correspondence, events.
• From your organization — when someone signs you up as an account administrator or Authorized User.
• From people in the industry — colleagues and contacts send us lists of economic development organizations and site selectors because they want to be helpful.
• From conference and event attendee lists we obtain from organizers who have the right to provide them.
• From your device, automatically — see § 6.

We do not buy contact data from data brokers or list vendors.

5.2 What we collect and why

Retention for marketing contact records. We keep marketing contact records for as long as the contact remains professionally active in economic development and has not opted out. We review this annually. When someone leaves the field, opts out, or asks us to delete, we remove them.

Everyone we add. We add clients, customers and prospects to our marketing list. Every marketing message has an unsubscribe link and we honor it.

5.3 Call and meeting recording

We record sales calls and product demonstrations, and we may use AI notetaking tools on customer calls. Our meeting tool announces to all participants at the start of the call that it is being recorded, and we will turn recording off on request. Recordings and notes are stored with our meeting and CRM providers listed at § 16.1. We do not record or collect your email or text message communications. A customer may separately choose to log a note about an interaction inside their own Incenti EDOS relationship management module — that is their record, governed by Part III.

5.4 Notice at collection

A short-form notice appears at each point of collection. See the Appendix below.

6. Cookies, pixels and other tracking technologies

This section is our cookie policy. There is no separate document.

6.1 What we use

Strictly necessary cookies cannot be switched off — the site does not work without them. Everything else is optional.

6.2 Your choices

• The Cookie Preferences link in our banner and in our footer, available at any time
• Your browser's cookie controls
• An opt-out preference signal such as Global Privacy Control (§ 8)

Rejecting optional cookies does not restrict your access to the site.

6.3 We block before you choose

We do not fire non-essential cookies, tags or pixels before you make a choice. Analytics and marketing technologies are blocked by default until you consent.

6.4 Analytics identifiers

We retain analytics identifiers for thirteen (13) months, after which they expire or are deleted.

7. Sale and sharing of personal information; your opt-out

Two things we do could be characterized as a "sale" or "sharing" of personal information under state privacy law. We give you the opt-out for both rather than asking you to rely on our characterization.

7.1 What these two things are

Property records exchanged with our Integration Partner. See § 13.2. This exchange runs in both directions: property records a customer has enabled for sharing go to the partner, and — where a customer links its accounts — property records come from the partner into that customer's account. In each direction the exchange covers only that customer's own property records, and in each direction a record can contain an individual's contact details (listing contacts, brokers, owners), which travel with it. Account administrators can switch sharing off for the whole account, and individuals can opt out for themselves — both routes are at § 13.2.

Incenti Contacts. Inside Incenti EDOS we provide Incenti Contacts, a curated professional contact database: economic development organizations see private-sector and site selector contacts useful for land-development RFPs and similar outreach, and consultant, site selector and company accounts see contacts at economic development organizations for RFIs and similar outreach. Every entry is submitted directly to us by the individual it describes — opt-in only, through a form we send to professionals in the economic development ecosystem — with the express, stated understanding that their details will be made available to Incenti customers in this database. Entries contain business contact details and stated focus areas: name, organization, role, work email and phone, and areas of interest. You can withdraw at any time by emailing privacy@incenti.co — we remove your entry from the database promptly, though we cannot recall copies customers have already retrieved — and we honor opt-out preference signals (§ 8). We do not purchase, scrape or license contact lists, we do not provide consumer contact lists, and Incenti Contacts contains no data drawn from any customer's account.

We do not use or disclose personal information for cross-context behavioral advertising. Providing Incenti Contacts to paying customers may constitute a "sale" of personal information as some state laws define that term, and the property-record exchange may constitute a "sale" or "share"; we honor opt-out requests for both regardless of characterization, and beyond these two features we do not sell personal information.

7.2 Do Not Sell or Share My Personal Information

Use the "Do Not Sell or Share My Personal Information" link in our footer, or email privacy@incenti.co. We honor these requests regardless of whether the activity is technically a sale or a share.

8. Opt-out preference signals (Global Privacy Control)

We recognize and honor opt-out preference signals, including Global Privacy Control. When we detect one, we treat it as a request to opt out of sale and sharing and as a rejection of non-essential cookies for that browser. If you are logged in, we apply it to your account.

9. Email and text message marketing

9.1 Email

Every marketing email has an unsubscribe link, honored promptly. Service and transactional messages about your account are not marketing and continue.

9.2 Text messages

We do not send marketing text messages.

10. Platform account holders and Authorized Users

When your organization creates an account, we hold your name, work contact details, role and permissions, authentication data, and access and activity logs. We use it to operate the service, secure it, support you, and communicate about the account. Your organization's administrator can see your activity in the account. We keep this for the life of the account plus the periods at § 17.

PART III — INFORMATION A CUSTOMER OR CLIENT PUTS IN OUR HANDS

11. Customer Data in Incenti EDOS

11.1 What customers put into Incenti EDOS

Incenti EDOS is a system of record and a form builder. Customers upload files and build forms that third parties complete. What arrives includes:

• Contact information — name, title, organization, email, phone, address
• Project, pipeline and program records, including incentive program data such as budgets, awarded amounts and contracts
• Property records for available sites
• Form responses from third parties, which may be proprietary or sensitive
• Uploaded documents and media — financial records, site documents, images, video, audio
• Signatures and attestations on forms
• Compliance records for incentive agreements
• Historical archives migrated at onboarding
• Relationship management records

A customer decides what fields exist. We do not require any particular category and we do not control what a customer chooses to collect.

11.2 What we do with it

We host, store, index, display, back up and secure it; we make it available to the people the customer authorizes; and — where the customer turns the feature on — we analyze it with AI to surface trends, create efficiencies, and assist with shortlisting. Our AI can read historical ingested data, first-party form responses, uploaded documents including financial and site documents, and signatures and attestations, and can be queried inside Incenti EDOS.

11.3 What we do not do with it

• We do not make one customer's data available to another customer. All AI queries are scoped to the requesting customer's own account.
• We do not train models on customer data — see § 15.3 and § 15.4.
• We do not sell it.
• We do not use it to build Incenti Insights. See § 11.4.

11.4 Aggregated and de-identified information

Our agreement permits us to create aggregated and de-identified information from Customer Data, subject to the de-identification standard, aggregation floor and tier exclusions in the Terms of Service.

We publicly commit to maintain and use any such information in de-identified form, not to attempt to re-identify it, and to contractually require the same of anyone who receives it.

Current position: Customer Data does not feed Incenti Insights, and we do not currently run product-improvement, model-development, benchmarking or roadmap-analytics workflows on Customer Data. If that changes, it will happen only through the aggregated-data provisions of the Terms of Service, and we will update this policy and notify account administrators before it does.

11.5 Public records

Many customers are public agencies subject to public records law. The customer is the custodian of its records and decides what is releasable. If we receive a records request for a customer's data, we notify the customer and let them respond.

11.6 Economic and fiscal impact analysis inside Incenti EDOS

Incenti EDOS includes a self-service impact analysis feature. It runs on the customer's own inputs and on public reference data. Output is a model, not a prediction.

11.7 Data classification

Customer Data is classified into tiers under Schedule D of the Terms of Service. Tier 3 is the most restricted and includes non-public program and financial data. Tier 3 data is excluded from aggregation and is not disclosed to our Integration Partner in any capacity.

12. Individuals whose information a customer puts into Incenti EDOS

If you completed a form, responded to an RFI, appear in a project record, or are a contact in a customer's CRM:

• The customer decides what to collect, why, and how long to keep it. Their privacy notice governs.
• We have no direct relationship with you and will not contact you except at the customer's instruction or as required by law.
• Send requests to the customer. If you send one to us, we acknowledge it and forward it.

Veteran-owned, minority-owned and similar business status. Some incentive programs qualify applicants on these criteria, so a customer may build a form that asks. Where that information identifies race, ethnicity or a similar characteristic, it is sensitive personal information under several state laws. We do not require it, we do not ask for it on incenti.co, and the customer is responsible for the lawful basis and any consent required.

13. Property records and Integration Partner sharing

13.1 Start from § 16

§ 16 lists who receives information and why.

13.2 The property-sharing capability

Incenti EDOS connects to a third-party GIS mapping platform we partner with commercially (our "Integration Partner"), which builds external web tools that economic development organizations use to showcase available properties. Where a customer chooses to share a property that is not already in the partner's national database, we supply it. This capability is off by default: nothing is shared until the customer switches sharing on for the properties it chooses. A shared property record — which may include listing contact details, broker details and owner details — goes to the Integration Partner. The Integration Partner may publicly list those properties on its own platform and websites.

Many economic development organizations want this — public exposure for available sites is the point of maintaining them — so the capability is there to switch on.

It stays under control. There are two independent controls:

• Customers decide which properties are shared, record by record, and an account administrator can switch sharing off for the whole account at any time. Switching it off stops all future sharing.
• Individuals whose contact details appear in a property record — listing contacts, brokers and owners — can opt out separately using the "Do Not Sell or Share My Personal Information" link in our footer, or by emailing privacy@incenti.co. We honor these requests whether or not the disclosure is technically a sale or a share, and we honor opt-out preference signals (§ 8).

Once a property record has been shared and republished, we cannot compel the removal of copies the Integration Partner has already distributed or cached.

13.3 If you are a listing contact, broker or property owner

Your details may appear on the Integration Partner's platform because a customer listed the property in Incenti EDOS.

You can opt out directly with us — see § 13.2. When you do, we stop sharing your details going forward and pass the request to the customer and to the partner. The customer controls its own record and the partner controls its own platform, so removal from those systems is theirs to action, not ours.

13.4 The two capacities our Integration Partner acts in

The Integration Partner acts in two distinct capacities:

• As our service provider, performing proposal generation and form data handling on our instructions, using the data for no purpose of its own.
• As an independent recipient, receiving property records under § 13.2 and using them under its own terms.

We maintain separation between these two paths. The partner also offers its own customers a separate integration that uses our form builder to collect RFP and RFI responses; that is the partner's product and its own terms apply.

14. Incenti Insights

Insights is built from federal, state, commercial and Incenti-proprietary data sources that we ingest, license and maintain. Customers do not contribute data to Insights. We hold licenses from commercial providers under their API terms.

Insights describes incentive programs, awards, jurisdictions, industries and companies — not individuals. Where a public source record names a person in a business capacity, we reproduce it as published. We do not build or infer profiles of individuals.

14.1 The state-level benchmark

We maintain state and state-level benchmark data on public incentives going back decades, compiled from publicly available sources. It supports analysis of award amounts, recipient companies and their parents and subsidiaries, and awards by industry using federal NAICS classifications — so a user can benchmark, for example, award volume by state and industry.

This is company-level and program-level information drawn from public records. It is not personal information and is not derived from any customer's account.

14A. Consulting and advisory services

14A.1 What engagements are

Fixed-price or hourly work under a signed Statement of Work. No contingency or success fees. No advocacy before governmental bodies.

14A.2 Where personal information comes from

From the client's personnel who run the engagement, and from material the client sends us.

14A.3 What may be in client material

Client-furnished material commonly includes proprietary and non-public financial records provided so that we can perform the analysis the Statement of Work describes. It may include public and licensed federal, commercial and private data.

We ask for the actual file rather than a derived or extracted version, so that what we analyze is what the client holds.

14A.4 Our role

For material a client sends us, we act on the client's instructions for the engagement. For our own engagement record — the scope, the working papers, the deliverable and our file — we are a controller, because we retain them to evidence our work and defend it. See § 14A.10.

14A.5 Client personnel

Name, title, organization, contact details, and correspondence. Kept for the engagement and the period at § 14A.10.

14A.6 If your information was in client material

Contact us at privacy@incenti.co. Please see § 14A.9 first — there is a real limit on what we can find.

14A.7 Site selectors and subcontracting

We are sometimes engaged by a site selection firm as a subcontractor. Our obligations run to the firm that engaged us, not to that firm's end client. We separately receive end-client material when a site selector or an EDO completes an RFP or RFI form inside their own Incenti EDOS tenant — that is platform data governed by Part III, not consulting material.

14A.8 Public records and consulting work

Where a client is a public agency, the client determines what is releasable. Working papers produced in support of an incentive negotiation or agreement are generally trade secret and confidential commercial information, and in our view are not public information, but the client makes that call and asserts any exception.

14A.9 Exercising rights over consulting information — a real limit

We cannot search our consulting engagement archive for a named individual. The archive is organized by engagement, not by person. If you can identify the engagement — the client organization and roughly when — we can look. If you cannot, we will not be able to locate your information, and we will tell you so rather than imply a search occurred.

This limit does not apply to Incenti EDOS. Information in a customer's account is searchable by that customer.

14A.10 How long we keep engagement material

Seven (7) years from completion, to evidence and defend our work. This is our own retention as controller of the engagement record and it is not affected by the deletion of a platform account.

14A.11 Conflicts and information barriers

No deliverable, dataset or report we have produced for one client has ever been made available to another party in a form containing individual-level client-furnished material. Where an engagement requires separation, we impose access barriers enforced by our platform access controls.

14A.12 AI in consulting

We maintain an internal AI-use policy for the consulting practice. Our personnel are trained on it, and the AI tools they use are on our subprocessor list.

14A.13 Advanced impact analysis

Performed and reviewed by our people, not automated.

14A.14 Custom development on Incenti EDOS

Fixed price per project, delivered into the client's tenant.

PART IV — CROSS-CUTTING DISCLOSURES

15. Artificial intelligence, automated decision-making and profiling

15.1 Where AI is used

In Incenti EDOS, where a customer turns it on: the AI assistant, AI grading and shortlisting, and analysis of uploaded documents and form responses. In our own business: AI notetaking on calls (§ 5.3), and internal tools within the consulting practice (§ 14A.12).

15.2 The assistant reads only what is in your organization's account

The Incenti EDOS AI assistant reads only data inside the requesting customer's own account. It does not retrieve external web content and it does not read another customer's data.

15.3 We do not train models on your data

We do not use Customer Data to train, fine-tune or develop models, and our AI providers are contractually prohibited from doing so. The one exception is feedback a user chooses to submit — see § 15.4.

15.4 Honest limits on that commitment

• Feedback you submit. If a user rates an AI response with a thumbs up or thumbs down, we receive the rating together with the prompt and the response it relates to, and we use it to evaluate and improve how our AI features perform. This is the only exception to § 15.3, and it happens only when a user chooses to submit feedback.
• Abuse monitoring. Our AI providers retain inputs and outputs for limited periods to detect misuse. Current windows are at § 16.2.
• Support. Our staff may access account data to resolve a support request. Access is limited and logged.

15.5 Automated decision-making, profiling and AI grading

AI grading is off by default. A customer switches it on per form and per field type and configures the grading criteria against its own requirements. Where enabled, responses are graded automatically against those criteria.

Grading assists a human decision. It does not make one. Our terms require human review, and we provide a per-item transparency record so the customer can explain an outcome.

The customer is the decision-maker. If a decision about you was informed by AI grading, the customer is responsible for notice, explanation and any appeal.

16. Who we share personal information with

16.1 Categories of third parties

Current named providers are on our Subprocessor List at https://incenti.co/legal/subprocessors.

16.2 AI providers and their retention windows

Each AI provider, what it processes, whether inputs and outputs are retained, and for how long, is published on our Subprocessor List. We do not claim that any provider operates on a zero-retention basis except where the Subprocessor List says so for that provider.

17. How long we keep personal information

Backups are deleted on their ordinary expiry cycle.

18. Security

Encryption in transit and at rest, access controls, tenant separation, logging, vulnerability management and incident response. Personnel with access to customer data — including engineering personnel whose roles permit cross-tenant access — are bound by written confidentiality obligations and by our internal access policy, and platform access controls enforce separation where an engagement requires it.

Our current technical and organizational measures are described in our Security Annex, which is made available to customers under the Master Subscription Agreement. We do not currently hold a SOC 2 or ISO 27001 certification.

19. International data transfers

We process personal information in the United States, and we do not currently offer our products in the European Economic Area, the United Kingdom or Switzerland. If that changes we will update this section and put appropriate transfer mechanisms in place first.

20. Children and minors

Our products are not directed to children and we do not knowingly collect information from anyone under 18. If you believe we have, contact us and we will delete it.

21. Data broker status

We are not a data broker. Everyone whose information we make available to customers — through Incenti Contacts — gave it to us directly and opted in (§ 7). Apart from the two activities described at § 7, for which we honor opt-outs, we do not sell personal information.

Some contact information reaches us from sources other than you — a colleague in the industry passing along a name, or an attendee list from a conference organizer entitled to provide it. We use it only to market our own products to professionals in our field. We do not sell it, license it, add it to Incenti Contacts, or make it available to our customers or to anyone else.

You can opt out of our marketing at any time (§ 9.1), ask what we hold and where we got it, or ask us to delete it (§ 24).

22. Data breaches

We maintain an incident response process and notify affected individuals and regulators where the law requires. Where the incident affects a customer's account data, we notify the customer and the customer decides on notification to individuals.

23. How to contact us

Incenti Solutions, Inc.
Onward HQ
110 NW 2nd St
Bentonville, AR 72712
United States

Privacy questions and requests: privacy@incenti.co

PART V — YOUR RIGHTS

24. Rights available in every state where we operate

Access; correction; deletion; a portable copy; opt out of sale, sharing and targeted advertising; limit the use of sensitive personal information; and non-retaliation.

24.1 How to submit a request

Email privacy@incenti.co.

24.2 How we verify who you are

We match what you give us against what we hold. For sensitive requests we may ask for more. We will not create an account or collect new categories of information just to verify you.

24.3 Timing

We acknowledge within 10 business days and respond within 45 days, extendable once by a further 45 days with notice.

24.4 Appeals

If we deny your request you may appeal by replying to our decision or writing to privacy@incenti.co. We respond to appeals within 60 days and tell you how to contact your state Attorney General if you remain dissatisfied.

24.5 Authorized agents

An authorized agent may submit on your behalf with written permission; we may ask you to confirm.

25. California

25.1 Your rights

Know, delete, correct, opt out of sale and sharing, limit use of sensitive personal information, and non-discrimination.

25.2 Sensitive personal information

We do not collect sensitive personal information for our own purposes, and we do not use it to infer characteristics. Where a customer configures an Incenti EDOS form to collect it (§ 12), we process it on their instructions.

25.3 Categories

25.4 Retention

See § 17.

25.5 Shine the Light

We do not disclose personal information to third parties for their own direct marketing purposes.

25.6 Opt-out

See § 7.2 and § 8.

26. Texas

26.1 Your rights

Texas residents have the rights at § 24. Requests to privacy@incenti.co.

26.2 Required notice

Where applicable, we provide the notice Texas law requires regarding sale of personal data. See § 7 and § 21.

27. Colorado, Connecticut, Virginia and other states

Residents of states with comprehensive privacy laws have the rights at § 25, including opt-out of targeted advertising, sale and certain profiling, and the right to appeal. We honor universal opt-out mechanisms where required.

28. Europe, the United Kingdom and Switzerland

We do not currently offer our products in these jurisdictions. If you are in one of them and have corresponded with us, contact privacy@incenti.co and we will handle your request consistently with this policy.

APPENDIX — SHORT-FORM NOTICE AT COLLECTION

We collect your name, work contact details and organization to respond to you, provide the service, and send you information about our products. We keep it while you remain professionally active in economic development and have not opted out. We do not sell it for money. You can opt out or ask us to delete it at privacy@incenti.co. Full policy: https://incenti.co/privacy