Privacy Policy - Amicus Impact Cooperative

1. Introduction and Scope

1.1 This Privacy Policy explains how Amicus Impact Cooperative ("Amicus," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with the online platform available at amicusimpact.com and its related subdomains and applications (collectively, the "Platform" or the "Service"). The Platform supports the asset management of residential solar and battery energy storage systems operating under prepaid lease and energy services agreement (“Lease/ESA”) arrangements and associated federal investment tax credit information.

1.2 The Platform is a secure, login-gated business application. It is intended for named, authorized users acting in a business capacity, including Amicus administrators and representatives, staff of Amicus co-op member companies, and tax-credit buyers and their advisors. It is not an anonymous consumer-browsing product, and the sensitive data it holds is accessible only behind authenticated login.

1.3 In the course of providing the Service, the Platform also processes personal information about residential customers who are the subjects of the Lease/ESA records managed by our business users. We treat that residential-customer information as consumer personal information and apply consumer-grade protections to it, as described in this Policy.

2. Who Controls Your Information and How to Contact Us

2.1 The data controller and business responsible for personal information processed through the Platform is:

Amicus Impact Cooperative
PO Box 1764, Lyons, Colorado 80540
info@amicusimpact.com

2.2 For privacy questions, requests, or complaints, contact us using the details above or as described in Section 14 (Your Privacy Rights) and Section 18 (How to Contact Us).

3. Categories of Personal Information We Collect

3.1 Depending on your role and how the Platform is used, we may collect the following categories of personal information:

• Identifiers and contact information — individual name, business name (if applicable), home mailing address, email address, and telephone number.
• Account and authentication data — username, hashed credentials, authentication logs, and a mobile telephone number used solely to deliver multi-factor authentication (MFA) one-time passcodes (OTPs). See Section 6 for how we handle this number.
• Financial-account information — payment or financial-account details associated with Lease/ESA arrangements or credit transfers.
• Property, system, and equipment data — residential property details, solar and battery energy storage system equipment specifications, and installation details.
• Lease/ESA documents — enrollment records, agreements, and supporting documentation.
• Energy and usage data — electricity production or consumption data associated with a property or solar and battery energy storage system.
• Platform usage and technical data — log data, device and browser information, and limited cookie/analytics data as described in Section 11.

3.2 Sensitive personal information. Financial-account information — is treated as sensitive personal information under applicable law. We collect and use it only as reasonably necessary to provide the Service, and we apply heightened safeguards and use limitations to it (see Sections 7, 10, and 14).

4. Sources of Personal Information

4.1 We collect personal information from:

• You, when you register for or use the Platform, communicate with us, or upload documents.
• Our business users (Amicus representatives and Amicus co-op member company staff), who input or upload information about residential customers in the course of enrollment and servicing.
• The residential customers themselves, where they provide information directly.
• Service providers and integrated systems that support authentication, document handling, electricity usage, system production data, and tax-credit processing.

5. How We Use Personal Information

5.1 We use personal information for the following purposes:

• Enrollment and servicing of Lease/ESA arrangements.
• ITC / tax-credit management, including substantiating, tracking, and facilitating the transfer of investment tax credits under Internal Revenue Code §6418.
• Authentication and account security, including delivering multi-factor authentication one-time passcodes by SMS text message (see Section 6).
• Communicating with you about your account, the Service, and support requests.
• Operating, maintaining, securing, and improving the Platform.
• Complying with legal, tax, and recordkeeping obligations, and establishing, exercising, or defending legal claims.

5.2 We do not use the mobile telephone number described in Section 6, or your SMS consent, for marketing or promotional purposes. We do not send marketing or promotional text messages.

6. Mobile Phone Number and SMS Text Messaging (Authentication Only)

6.1 Purpose. If you enable or are required to use multi-factor authentication, we collect your mobile telephone number solely to send you account-security and one-time passcode (OTP) text messages — that is, transactional authentication messages that help verify your identity and protect your account. We do not send marketing or promotional text messages.

6.2 Message frequency. Message frequency varies and depends on your account activity (for example, when you log in or perform a security-sensitive action).

6.3 Message and data rates. Message and data rates may apply, depending on your mobile carrier and plan.

6.4 Opt-out. You may opt out of authentication text messages at any time by replying STOP to any message from us. After you opt out, authentication text messages to that number will stop. Because these messages are used to secure your account, opting out of SMS may require you to set up an alternative authentication method to continue accessing the Platform.

6.5 Help. For help, reply HELP to any message, or contact us at info@amicusimpact.com. Carriers are not liable for delayed or undelivered messages.

6.6 How we share the mobile number. We share your mobile telephone number with our SMS gateway/messaging service provider solely to deliver these authentication messages to you — that is a processing activity performed on our behalf. We do not otherwise share your mobile number. See Section 7.4 for our controlling commitment.

7. How and With Whom We Disclose Personal Information

7.1 We disclose personal information only as described in this Section and only as reasonably necessary for the purposes in Section 5. We do not sell personal information for money, and we do not share personal information for cross-context behavioral advertising.

7.2 Service providers and processors. We disclose personal information to vendors that perform services on our behalf — including hosting and cloud infrastructure, authentication and SMS-delivery providers, document management, and IT security — under contracts that limit their use of the information to providing services to us.

7.3 Tax-credit purchasers, advisors, auditors, and governmental authorities. To substantiate, manage, or transfer federal solar tax credits, we may disclose personal and tax-credit information to tax-credit purchasers and their advisors and auditors and to governmental authorities including the Internal Revenue Service (“IRS”), as necessary to establish eligibility for, document, or effect the transfer of investment tax credits under Internal Revenue Code §6418.

7.4 Mobile information / SMS opt-in — controlling non-sharing commitment. Notwithstanding anything else in this Policy:

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

For clarity, and as stated in Section 6.6, the only disclosure of your mobile telephone number is to our SMS gateway/messaging service provider for the sole purpose of delivering authentication messages to you; this is a processor relationship and is not a sale, rental, transfer, or marketing/promotional sharing of your mobile information or SMS consent. Every other disclosure described in this Policy — including disclosures to service providers under Section 7.2 and to tax-credit purchasers, advisors, auditors, and governmental authorities under Section 7.3 — excludes your mobile telephone number and your SMS opt-in/consent data.

7.5 Legal and safety disclosures. We may disclose information where required by law, subpoena, or legal process, or to protect the rights, property, or safety of Amicus, our users, or others.

7.6 Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to the non-sharing commitment in Section 7.4 with respect to mobile information and SMS opt-in data.

8. Tax-Data Handling

8.1 Because the Platform manages tax credit information, some processing involves tax-return-related information and government identifiers. We handle this information subject to applicable tax-confidentiality rules and disclose it only as described in Section 7.3.

9. Data Retention

9.1 We retain personal information for as long as needed to provide the Service and to satisfy our legal, tax, accounting, and recordkeeping obligations, after which we delete or de-identify it. Because the Platform manages tax credit records, some information is subject to extended retention periods tied to IRS recordkeeping requirements.

10. How We Protect Information

10.1 The Platform is designed as a login-gated system: the sensitive data it holds is accessible only to authenticated, authorized users. We use multi-factor authentication, access controls, encryption in transit, and other administrative, technical, and physical safeguards appropriate to the sensitivity of the information.

10.2 No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you and applicable authorities as required by law.

11. Cookies and Tracking Technologies

11.1 The logged-in Platform uses only cookies and similar technologies that are strictly necessary to authenticate users, maintain sessions, and secure the Service.

11.2 Our public website pages (marketing/informational pages) may use a limited set of cookies and analytics technologies. When active, tracking technologies may collect or transmit data such as your IP address, device and browser identifiers, and page URL, referrer, and interaction data.

11.3 Prior consent for non-essential trackers. Any non-essential or third-party tracking technologies on our public pages — including analytics, advertising, attribution, and session-replay technologies — load only after you affirmatively opt in through our consent mechanism. We do not load or activate these non-essential third-party trackers before you consent. You may accept or decline non-essential technologies, and you can withdraw consent at any time.

11.4 You can also control cookies through your browser settings. Disabling strictly necessary cookies may prevent the Platform from functioning.

12. Children's Privacy

12.1 The Platform is a business application and is not directed to children, and we do not knowingly collect personal information directly from children under 13 (or under the age defined by applicable law). If you believe a child has provided information to us, contact us and we will take appropriate steps.

13. State Privacy Rights — General

13.1 A number of U.S. states have comprehensive consumer privacy laws. Depending on your state of residence, you may have rights to access, correct, delete, or obtain a portable copy of your personal information, and to opt out of certain processing. We honor applicable rights as described in Section 14, and we do not discriminate against you for exercising them.

14. Your Privacy Rights (Including California CCPA/CPRA)

14.1 Right to know / access. You may request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties to whom we disclose it.

14.2 Right to delete. You may request deletion of personal information, subject to legal, tax, and recordkeeping exceptions (see Section 9).

14.3 Right to correct. You may request correction of inaccurate personal information.

14.4 Right to opt out of sale/sharing — "Do Not Sell or Share My Personal Information." We do not sell your personal information, and we do not share it for cross-context behavioral advertising. If this changes, we will update this Policy and provide the required opt-out mechanism.

14.5 Sensitive personal information. We use financial-account information only as reasonably necessary to provide the Service and for related, legally permitted purposes, and not for purposes that would require offering a "Limit the Use of My Sensitive Personal Information" right. If our practices change, we will provide the required control.

14.6 How to exercise your rights. Submit a request using the contact details in Section 2 or Section 18. We will verify your identity before responding. You may use an authorized agent where permitted by law.

14.7 California "Shine the Light." California residents may request information about disclosures of personal information to third parties for those third parties' direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

14.8 Appeals. Where applicable law provides a right to appeal a decision on your request, we will describe how to appeal in our response.

15. California Notice at Collection Summary

15.1 We collect the categories of personal information listed in Section 3 for the purposes in Section 5. We disclose them to the categories of recipients in Section 7. We do not sell or share personal information as those terms are defined under the CCPA/CPRA. We retain personal information as described in Section 9.

16. Users and Residents Outside Your State

16.1 The Platform is operated from and intended for use in the United States. We do not intend to offer the Service to individuals in jurisdictions whose laws would make such offering unlawful.

17. Changes to This Privacy Policy

17.1 We may update this Policy from time to time. We will revise the "Last Updated" date above and, for material changes, provide additional notice as required by law. Your continued use of the Platform after an update takes effect constitutes acceptance of the updated Policy.

18. How to Contact Us

Amicus Impact Cooperative
PO Box 1764, Lyons, Colorado 80540
info@amicusimpact.com

If you have a complaint we have not resolved, you may also contact your state attorney general or applicable regulator.