EMD Secure LLC Privacy Policy

Version 1.0 · Last updated: October 29, 2026 · Effective: October 29, 2026

EMD Secure LLC (“EMD Secure,” “we,” “us”) helps nonprofits, houses of worship, schools and other community organizations find and apply for security funding. This policy explains what personal information we collect on our public website (emdsecure.com) and our client platform (apply.emdsecure.com), what we do with it, who helps us handle it, and the choices you have.

We keep this simple on purpose. We use your information to do the work you asked us to do, and nothing else. We do not sell it.

1. Who this covers

This policy applies to:

• emdsecure.com, our public information site.
• apply.emdsecure.com, where you check your eligibility and, if you become a client, work with our team through your secure client portal.

Our service is built for organizations. The people who use it are staff, board members and volunteers acting for their organization. The service is not directed to children, and we do not knowingly collect information from anyone under 13.

2. What we collect

On emdsecure.com

Nothing, beyond what our hosting provider records to serve the page. The site has no forms, no login, no cookies and no analytics or advertising tools. If you email us at support@emdsecure.com, we receive your email address and whatever you write.

The site loads its fonts from a third-party font service, so your browser contacts that service when the page loads. It receives your IP address and browser details as part of that request.

When you check your eligibility (apply.emdsecure.com)

You fill out a short form. We collect:

• Your first and last name, email address and, if you give it, phone number.
• Your organization’s name, city, state and ZIP code, and its type (for example 501(c)(3) nonprofit or public K-12 school).
• Information about the facility: its main use, whether it is owned or leased, whether it is operating, and your history with the Nonprofit Security Grant Program.
• Your organization’s federal identifier (Unique Entity ID) if you provide it.
• Answers to a few yes/no questions about assessments, security improvements and past incidents, and optional questions about risk factors (for example, whether your organization has worked with police or the FBI on an incident). The optional questions do not change your eligibility result.
• A short source tag if you arrived through a link we shared (for example, ?src= followed by a campaign name).

We use this to work out your likely eligibility, show you a result, and email you the result with a link to view it. The link expires after a set number of days.

When you become a client (client portal)

• Account details. Your email address and a record of when you sign in. We do not use passwords. You sign in with a one-time link or code we email you.
• Security questionnaire. Detailed answers about each facility, such as its layout, existing security measures, and vulnerabilities you want to address. This is sensitive information and we treat it that way.
• Documents you upload. For example, your IRS determination letter, vulnerability assessments, floor plans and vendor quotes. We screen files before they are stored.
• Call notes and transcripts. If you have an intake call with our team, our staff may keep notes and a transcript of the call. These are visible to our staff only, not in your portal.
• Case records. Our staff’s notes and the status of your work, your approvals and responses to drafts, the dates of key events, and any feedback you send us through the portal.
• Emails. Copies of what we send you, and delivery information from our email provider (for example, whether a message was delivered or bounced).

Technical information

• Cookies. The platform uses cookies only to keep you signed in (session cookies). We do not use advertising or cross-site tracking cookies.
• Page-view statistics. The platform uses a privacy-focused analytics tool to count visits and see which pages are used. It does not use cookies.
• Abuse protection. To stop automated abuse, we limit how often the forms can be submitted. For that we store a scrambled (hashed) form of your IP address or email address in a counter table, and we delete those counters after about two days.
• Error monitoring. If something breaks, our error-monitoring tool records technical details about the failure. We have set it up not to attach IP addresses, cookies or request headers, and we do not record screen sessions. Error details can occasionally include fragments of the page or data involved.

3. How we use your information

We use it only to:

• Assess whether your organization is likely eligible for security grant programs.
• Prepare your facility security assessment, your grant application materials and the documents you need.
• Communicate with you: result emails, sign-in links, document and deadline reminders, and answers to your questions.
• Run, secure and improve the service, including preventing abuse and fixing errors.
• Meet legal, accounting and record-keeping obligations.

We do not sell your information. We do not share it for advertising. We do not use client information to train AI models, and we do not allow our service providers to do so on our behalf.

4. AI-assisted drafting

Our team uses artificial intelligence to help draft parts of your security assessment and grant application. To do this, we send relevant material to an established AI provider through its business service. That material can include your questionnaire answers, text pulled from documents you uploaded (such as your vulnerability assessment and vendor quotes), and, where we have turned this feature on, text from your intake call. Our staff review the drafts, and you review them before anything is submitted.

We do not send this material to the AI provider for any other purpose, and the provider does not use it to train its models. We require zero data retention from our AI provider: the provider must not keep client information after it processes a request, and we will not open the platform beyond our invite-only beta until the provider confirms that arrangement in writing. During the beta, the provider processes client information under its standard business terms: it does not use the information to train its models and deletes it on its standard schedule, and each beta organization consents to this processing in its beta agreement.

5. Who we share information with

We share information only with the companies that help us run the service, and only so they can provide that service to us. They are bound by their own terms and privacy commitments.

We do not publish the names of our providers, for security reasons. Clients can request the current list by emailing support@emdsecure.com.

We may also disclose information:

• To our staff and experts who work on your case, on a need-to-know basis. Only EMD Secure staff can see internal notes and call records.
• To government agencies as part of the grant application you ask us to prepare, and only the application content you approve.
• When the law requires it, or to protect rights, safety or security, or to respond to valid legal process.
• In a business transfer, such as a merger or sale of EMD Secure, in which case we will require the new owner to honor this policy.

6. How long we keep it

7. Your choices and rights

Wherever you are located, you may ask us to:

• tell you what information we hold about you or your organization, and give you a copy,
• correct anything that is wrong,
• delete your information, or
• stop sending you emails.

Email support@emdsecure.com from the address you used with us. We will confirm your identity and respond within the time applicable law requires, and generally within 30 days. Where federal grant record-keeping rules require us to keep certain records (see Section 6), we will tell you what we must keep and why.

State privacy rights. Depending on where you live, you may have additional rights, such as to know, correct, delete or opt out of the sale or sharing of personal information. We do not sell or share personal information for advertising. If a state privacy law gives you specific rights, email us at support@emdsecure.com and we will honor the rights that apply to you.

8. How we protect information

• Encryption in transit (TLS) for all traffic to our sites and platform.
• Encryption at rest (AES-256) for our database and stored files.
• Access to client data inside the platform is limited by account and by organization. Database access rules (row-level security) keep each client’s records separate, and a client can see only its own organization’s information.
• Internal notes and call transcripts are visible only to EMD Secure staff.
• Uploaded files are screened before they are stored, and files are served through short-lived links.
• Staff sign in with one-time email links.
• We limit repeated requests to our forms to reduce abuse.

No system is perfectly secure, and we cannot promise absolute security. If we learn of a breach affecting your information, we will notify you as the law requires.

9. Where information is stored

We store and process your information in the United States. Our website’s content delivery network may serve pages from locations near the visitor, but your stored information remains in the United States.

10. Links to other sites

Our materials may link to government and other third-party sites (for example, SAM.gov). Their privacy practices are their own.

11. Changes to this policy

If we change this policy, we will post the new version here with a new effective date. For material changes, we will tell clients by email before the change takes effect.

12. Contact us

EMD Secure LLC
Email: support@emdsecure.com

13. Governing law

This policy and any dispute about it are governed by the laws of the State of New York.