Collaborate Privacy Policy

Last Updated: July 27, 2026 (Version 1.0)

Plain-English Summary

Collaborate is a case-management platform operated by Network Ninja, Inc. ("NNI") for human-services organizations, such as nonprofits, agencies, and programs that serve individuals and families (collectively, "Organizations"). It helps case workers and program staff manage individuals, cases, forms, documents, tasks, and communications.

• Your Organization is in control. Your Organization decides what data goes into Collaborate and is responsible for how it is used. NNI runs the platform on your behalf. We do not make decisions about your data; we store and process it only as your Organization directs.
• We store sensitive information, including case records, form submissions, documents, and notes about the individuals and families your Organization serves. This may include protected health information (PHI) and information about program participants, some of whom may be minors.
• Your data stays in the United States. All data is stored and processed on Amazon Web Services (AWS) infrastructure in the United States.
• We do not sell your data. We do not use your data to train AI models. We do not share data with advertisers.
• Phone numbers and text messages. If your Organization uses SMS/text notifications, phone numbers are collected to send those messages and are shared only with our SMS provider (Twilio) to deliver them. Phone numbers are never sold or used for marketing. No mobile information (including SMS opt-in data and consent) will be shared with any third party or affiliate for marketing or promotional purposes. If you receive these texts, reply STOP to opt out or HELP for help; message and data rates may apply. See Section 4 and the Terms of Service SMS section.
• AI is limited and human-reviewed. Collaborate uses AI only for optional features. The translation feature runs on AWS Bedrock (Anthropic's Claude models) under a business-associate/zero-data-retention arrangement. Agent-assisted reporting is calculated by the platform's own software rather than by an AI model, and an Organization may connect an AI assistant of its choosing to request those reports; that assistant signs in with a staff member's own credentials and can reach only the data that person is already permitted to see. AI outputs are aids, not conclusions, and require human review. We do not use your data to train AI models.
• Access is controlled by your Organization. Your Organization's administrators manage which Authorized Users can access your data, and data is strictly isolated between Organizations. NNI personnel access Customer Data only as needed to operate, secure, and support the Service, under confidentiality and the applicable BAA.
• How long records are kept. Your Organization decides how long records are kept, within the limits of the laws and policies that apply to it. NNI stores the data while the subscription is active; retention obligations are the Organization's responsibility, not NNI's. If you are a person served by an Organization, contact that Organization about your records. Data can be exported at any time; export before canceling. See Section 7.
• If you are a person served by an Organization (a client or program participant, or the parent/guardian of one): see the short section below written for you.
• Questions? Contact your Organization's administrator for data-related requests, or contact NNI at the information at the end of this policy.

For People Served by an Organization

If an Organization uses Collaborate to manage services for you or your family, the Organization, not NNI, entered your information and controls it. In plain terms:

• What we hold about you: the records the Organization keeps to serve you (for example, your case, forms you filled out, documents, notes, and contact details), which may include health information and information about children in your family.
• We do not sell it, show ads with it, or use it to train AI. It is stored in the United States.
• Text messages: if you get texts from an Organization through Collaborate, reply STOP to stop them or HELP for help. Message and data rates may apply. The Organization is responsible for having your consent before texting you.
• To see, correct, or delete your information, contact the Organization that serves you (they control your records). If they cannot help, you may email NNI at privacy@networkninja.com.
• Children: we store information about minors only because an Organization submitted it to run its program. We do not sell it, advertise with it, or use it to train AI, and it is deleted when the Organization's workspace is closed (except any records that must be kept by law).

1. Who We Are and How This Policy Applies

Network Ninja, Inc. ("NNI," "we," "us," or "our") operates Collaborate, a case-management platform for human-services organizations (collectively, "Organizations").

This Privacy Policy explains how NNI collects, uses, discloses, and safeguards information in connection with the Collaborate platform (the "Service").

Relationship between NNI and Organizations. Organizations that subscribe to Collaborate decide what data is submitted to the Service and how it is used; they control that data. NNI processes it solely on the Organization's behalf and under its instructions, as the Organization's service provider and, where protected health information is involved, its business associate under a Business Associate Agreement (BAA), pursuant to our Terms of Service. If you are an Authorized User of an Organization, please also refer to your Organization's own privacy policies and data governance practices.

Protected Health Information. The Service is designed to handle protected health information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA) on behalf of Organizations that are covered entities or business associates. NNI maintains a HIPAA-compliant security program that is assessed annually by an independent third party, and where NNI processes PHI on an Organization's behalf, it does so as a business associate under a BAA. Organizations are responsible for ensuring their use of the Service complies with HIPAA and other laws applicable to them.

2. Information We Collect

2.1 Information Organizations and Authorized Users Provide

Account and Identity Information. When an Organization creates an account and when Authorized Users are invited or sign up, we collect:

• Name and email address
• Password (stored as a cryptographic hash; never stored in plaintext)
• Organization (workspace) and program membership and role
• Multi-factor authentication credentials (TOTP secrets, stored encrypted)
• Identity-provider tokens (e.g., Google) if used for sign-in

We collect this information to authenticate users, enforce role-based access controls, and maintain the security of the platform.

Case and Program Information. When Authorized Users work in the platform, we collect and store the case-management records your Organization creates, including:

• Individuals and their records (the people your Organization serves), and case records (case numbers, status, dates, and related fields)
• Form definitions and form submissions, which may include PHI and demographic information
• Documents uploaded to cases, individuals, or programs (and associated metadata such as filename, content type, and file size)
• Activities, tasks, and assignments; notes; contacts and organizations
• Participant portal submissions, where the participant portal is enabled

We collect this information because it is the core purpose of the Service: enabling Organizations to manage cases and serve individuals.

Information about individuals your Organization serves. Much of the above is information about program participants and other individuals who are generally not users of the Service. This information is submitted by Organizations as part of their case-management responsibilities and is processed by NNI solely on behalf of the Organization (see Section 2.3).

Contact Directory. Organizations may maintain an in-platform directory of contacts and partner organizations. We store the fields Authorized Users provide (such as name, email address, organization, title, and phone number).

Billing Information. Organizations provide payment information through Stripe, our third-party payment processor. NNI does not store payment card numbers, bank account numbers, or other financial account credentials. We receive and store subscription status and identifiers from Stripe.

Communications. If you contact NNI support, we retain records of that correspondence. If your Organization enables notifications, we process the email addresses and, for SMS, the phone numbers needed to deliver them.

2.2 Information Collected Automatically

Audit and Access Logs. The Service records an audit log of significant actions on sensitive and PHI records, including creates, edits, and deletions, along with the acting user and a timestamp. Audit logging is a core security and compliance feature. (See Section 7 for how audit records are retained and deleted.)

Session Information. We use session tokens stored in httpOnly cookies to maintain authenticated sessions. Sessions use a sliding inactivity timeout (30 minutes by default) and an absolute maximum lifetime (8 hours by default), after which re-authentication is required.

Cookies and Do Not Track. The Service uses only strictly necessary cookies. These are (a) session, authentication, and short-lived sign-in-flow cookies, stored as httpOnly cookies, that keep you signed in, maintain security, and carry state such as where to return you after you authenticate, and (b) a first-party preference cookie that remembers the language you select in the individual portal, which is readable by the browser so the language switcher works before you sign in. The Service does not use advertising cookies, cross-site tracking cookies, or marketing, advertising, or social-media tracking technologies, and does not profile you across other websites. This is separate from the error-monitoring service described in Section 4, which exists to detect and diagnose faults rather than to track you. Because the Service does not track Authorized Users or the individuals in your records across other websites, there is nothing for a "Do Not Track" browser signal to disable, and the Service does not respond differently to one. This describes the Collaborate application itself and does not cover any separate marketing website NNI operates.

Usage and Technical Information. We collect standard web server and application logs (including IP address, browser type, and timestamps) and information about how Authorized Users interact with the Service. This is used to operate, secure, and troubleshoot the Service. It is not used for advertising and is not sold to third parties.

2.3 Information About Individuals Served by Organizations

The Service stores information about the individuals and families that Organizations serve, including program participants, clients, and their household or case contacts, some of whom may be minors. These individuals are generally not users of the Service. This information is submitted by Organizations as part of their case-management responsibilities and is processed by NNI solely on behalf of the Organization. NNI does not use this information for any purpose other than providing the Service to the Organization.

3. How We Use Information

We use the information we collect to:

Provide and Operate the Service:

• Authenticate Authorized Users and enforce role-based access controls
• Store, process, and retrieve case records, form submissions, documents, notes, and related data
• Deliver notifications your Organization configures, including email and, where enabled, SMS text messages
• Provide optional AI-assisted features (translation and agent-assisted reporting) subject to Section 5
• Maintain audit logs and support your Organization's recordkeeping
• Process billing

Maintain Security and Compliance:

• Detect and prevent unauthorized access, fraud, and security incidents
• Enforce security controls (session management, MFA, role-based access, tenant isolation, encryption, audit logging)
• Monitor for and respond to security threats

Improve the Service:

• Analyze aggregated, anonymized usage patterns to identify and fix technical issues and improve functionality
• We do not use Customer Data (including case records, form submissions, or documents) to train AI models in any form

Communicate with Organizations:

• Send transactional emails (account verification, password reset, invitations, and configured notifications) via AWS SES
• Send SMS notifications via Twilio where your Organization has enabled them and users have provided a phone number
• Notify Organizations of billing events, service changes, and security matters

Comply with Legal Obligations:

• Respond to lawful requests from government authorities
• Enforce our Terms of Service
• Fulfill obligations under applicable law

4. How We Share Information

We do not sell personal information to third parties. We do not use personal information for advertising or marketing to the individuals in your records.

Within Your Organization. Information submitted to the Service is accessible only to Authorized Users of the same Organization, and only within the programs and roles configured by the Organization's administrators. Customer Data is strictly isolated between Organizations by row-level security enforced inside the database itself, not only by application code: the database returns no rows outside the requesting workspace's tenant context and refuses writes outside it, so a defect in application logic cannot expose one Organization's data to another. No Authorized User can access data belonging to a different Organization, and NNI does not permit cross-organization data access.

Phone numbers and SMS. Where an Organization enables SMS notifications, phone numbers collected for that purpose are shared only with Twilio, our SMS delivery provider, solely to deliver the messages your Organization sends. Phone numbers are not sold, rented, or used for marketing, and are not shared with any other third party for their own purposes. No mobile information (including SMS opt-in data and consent) will be shared with any third party or affiliate for marketing or promotional purposes. To stop messages, reply STOP; for help, reply HELP; message and data rates may apply. Full SMS program terms are in the Terms of Service.

Service providers. NNI relies on a small set of established, security-vetted providers to operate the Service in the United States, for example, Amazon Web Services (cloud infrastructure, storage, database, email, and AI processing via Bedrock), Anthropic (the Claude AI models), Twilio (SMS delivery), Stripe (billing), and Sentry (application error monitoring). What matters is not the vendor list but the bar they must meet: NNI selects providers that maintain strong, independently-audited security and privacy programs, and NNI binds every provider that receives Customer Data in identifiable form under a written confidentiality agreement and, where protected health information is involved, a Business Associate Agreement (BAA) or equivalent data-protection agreement, including AWS and Anthropic. Throughout this policy, a provider that handles or processes Customer Data means one that receives it in identifiable form; it does not include a provider that receives only a one-way cryptographic hash or similar data that cannot be used to reconstruct or identify Customer Data, such as the timestamp authorities used to timestamp an electronically signed document. These providers may process Customer Data only to deliver their services to NNI, and never for their own purposes, for advertising, or to train AI models. NNI will provide an Organization, on request, its current list of the providers that process that Organization's Customer Data, and will give advance notice before a new such provider begins processing (see the Terms of Service for the notice and objection process).

Business Transfers. If NNI is involved in a merger, acquisition, or sale of all or substantially all of its assets, Customer Data may be transferred as part of that transaction. We will provide notice before Customer Data becomes subject to a materially different privacy policy.

Legal Requirements. We may disclose information if required by law, court order, or valid legal process, or when we reasonably believe disclosure is necessary to protect the rights, property, or safety of NNI, our customers, or the public. To the extent permitted by law, we will notify the affected Organization before disclosing its data.

With Your Consent. We may share information with third parties when we have the explicit consent of the Organization or Authorized User.

5. AI Processing

Collaborate offers optional AI-assisted features. AI is not applied to your Customer Data by default; it runs only when an Organization uses a feature that invokes it.

Where AI is used. The current AI touchpoints are (1) an optional translation feature that helps translate content and notifications, and (2) agent-assisted reporting that helps staff query and summarize their own workspace data.

The translation feature runs on AWS Bedrock (Anthropic's Claude models), operated by NNI. Agent-assisted reporting works differently: the reports themselves are produced by the platform's own software calculations, not by an AI model, and an Organization may connect an AI assistant of its choosing to request them. That assistant authenticates with an Authorized User's own credentials and can reach only the data that user is already permitted to see in the application. Any such assistant is a third-party product, and its provider's terms, rather than NNI's arrangement described below, govern what that provider does with what it receives. Organizations choosing to connect an assistant to records that contain protected health information are responsible for satisfying themselves that the assistant is appropriate for that use.

How your data is handled. Content NNI sends to its own AI provider (currently AWS Bedrock, for the translation feature) is processed under a business-associate and zero-data-retention arrangement, meaning the provider does not retain the content after processing and does not use it to train models. The Service does not perform audio or video transcription.

AI outputs are aids, not conclusions. AI-generated output may contain errors and does not constitute legal, clinical, or professional conclusions. Organizations are responsible for applying appropriate human review before relying on AI-generated output in any decision, proceeding, or record.

We do not use Customer Data to train AI models. NNI does not use case records, form submissions, documents, or any other Customer Data to train, fine-tune, or improve AI models, including those provided by AWS or Anthropic.

No automated decision-making about individuals. The Service does not use AI to make automated decisions about an individual an Organization serves that produce legal or similarly significant effects for that individual, such as decisions about eligibility, benefits, custody, or a risk score or classification. Agent-assisted reporting reflects deterministic calculations over data an Authorized User is already permitted to see; it does not profile, score, or rank individuals. Any AI-generated output requires human review before it is relied upon in a decision.

6. Data Storage and Security

Storage. Customer Data is stored in AWS services (S3 for files, Amazon RDS / PostgreSQL for structured data) in the United States. All Customer Data is encrypted at rest with AES-256 using AWS Key Management Service (KMS). All data is encrypted in transit using TLS 1.2 or higher.

Independent validation. NNI maintains a HIPAA-compliant security program implementing the administrative, physical, and technical safeguards required by the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C). NNI's conformance with the HIPAA requirements that apply to it as a business associate is assessed each year by an independent third party. That HIPAA assessment is separate from, and complements, NNI's SOC 2 Type II attestation, which evaluates NNI's controls against the AICPA Trust Services Criteria and is renewed annually. On request and under confidentiality, NNI will provide an Organization a summary of its most recent independent HIPAA assessment, its current SOC 2 Type II report, and a security overview.

Security Controls. Controls include:

• Multi-factor authentication (TOTP) for Authorized Users, which an Organization may require workspace-wide
• A sliding inactivity session timeout (30 minutes by default) and an absolute maximum session lifetime (8 hours by default)
• Role-based access controls at the workspace and program level, consistent with the HIPAA minimum necessary standard
• Row-level security enforced inside the database itself, so isolation between Organizations does not depend on application code correctly filtering every query
• Audit logging of access and changes to sensitive and PHI records
• Progressive-delay throttling on repeated failed sign-in attempts, plus bot detection and IP blocklisting
• Encryption at rest (AES-256 / KMS) and in transit (TLS)

Security incident notification. If NNI discovers a security incident that resulted in unauthorized access to or disclosure of Customer Data, NNI will notify the affected Organization without undue delay and in any event within 72 hours of discovery (or the shorter period the BAA requires). The one exception is a delay directed by a law-enforcement official under 45 C.F.R. § 164.412, where notifying would impede a criminal investigation or damage national security; NNI gives the notice as soon as that period ends. Because the Organization controls the records and holds the relationship with the individuals it serves, the Organization, not NNI, is responsible for any notification owed to those individuals or to a regulator; NNI will reasonably cooperate. See the Terms of Service, Section 7(c).

Accessibility. NNI targets WCAG 2.1 Level AA conformance for the Service and will provide a current Accessibility Conformance Report (VPAT) on request. See the Terms of Service, Section 21.

No method of transmission over the Internet or electronic storage is 100% secure. While NNI implements strong security controls, we cannot guarantee absolute security.

7. Data Retention

NNI retains Customer Data for the duration of the Organization's subscription. Records-retention requirements for case records are set by the laws and policies that apply to your Organization, and meeting them is the Organization's responsibility, not NNI's. The Organization can export its data through the application, and should export its data before canceling so it can retain records for whatever period its own obligations require. For at least 30 days after cancellation or termination (or the period stated in the Order or BAA), NNI keeps the data available for the Organization to export; after that window it is deleted as described below.

Unlike some evidence-management systems, Collaborate does not treat audit records as permanent: when a workspace (Organization) is terminated, NNI deletes that Organization's Customer Data and its associated audit records in a workspace-scoped deletion, so that terminated-Organization data does not persist in the platform. Two narrow exceptions apply, described immediately below. Organizations that must preserve records are responsible for exporting them before termination.

The two exceptions. First, NNI retains any records it is required to keep by applicable law. Second, NNI keeps a minimal administrative record of the deletion itself, including the workspace name and identifiers, who requested the deletion and when, and the history of Business Associate Agreement and Terms of Service acceptances. That second record is retained so NNI can demonstrate that the deletion occurred and that those agreements were accepted, and it contains no case, form, document, note, or individual information.

Organizations are solely responsible for exporting any data they require before canceling or terminating their subscription.

8. Your Rights and How to Exercise Them

Organization administrators manage Authorized User accounts, roles, and access within the platform. Requests to access, correct, or delete personal information should be directed to your Organization's administrator in the first instance.

Authorized Users may update their own profile information (name, email) and MFA settings within the platform.

Requests are handled through your Organization. Because the Organization controls the records it puts into Collaborate, requests to access, correct, or delete those records are exercised through that Organization. NNI processes the data solely as the Organization's service provider and, for PHI, its business associate under the BAA; it will route or defer any such request to the controlling Organization and cannot act on it without the Organization's authorization. Where an Organization is a HIPAA covered entity, the rights individuals have in their health information (such as access and amendment) are provided by that Organization, and NNI supports the Organization in meeting them. Certain data may be retained as required by applicable law even after a deletion request.

9. Children's Privacy

If an Organization serves children, it may store information about them in Collaborate. In plain terms: we store a child's information only because the Organization submitted it to run its program. We do not sell it, we do not show advertising, and we do not use it to train AI. It is deleted when the Organization's workspace is closed, except any records that must be kept by law. To see, correct, or delete a child's information, contact the Organization that serves your family; if they cannot help, email privacy@networkninja.com.

The Service stores and processes case information about individuals served by Organizations, some of whom may be minors, submitted by Organizations in the course of their professional duties. These individuals are generally not users of the Service and do not submit information directly to NNI. NNI processes this information solely on behalf of the Organization, which is responsible for ensuring it has the appropriate legal authority (including any required parental or guardian consent) to submit and process such information.

The Service is not intended for direct use by individuals under the age of 18, and NNI does not knowingly collect personal information directly from children. Because Collaborate does not interact directly with the individuals in an Organization's records, and all such information is submitted by Organizations acting in their professional capacity, the direct-collection requirements of the Children's Online Privacy Protection Act (COPPA) do not apply to NNI in this context. Organizations are responsible for ensuring they have appropriate legal authority to submit and process information about minors. If you believe a child has directly submitted personal information to NNI outside of an Organization's case-management activities, please contact us immediately.

10. Geographic Scope

The Service is intended for use by Organizations located in the United States. Customer Data is stored and processed in the United States.

11. Changes to This Privacy Policy

NNI may update this Privacy Policy from time to time. Material changes will be communicated to Organizations via email. For Organizations under an active Order, material changes to data processing practices will not take effect until the current Order term ends unless required by law. In all other cases, changes are effective when posted, and continued use of the Service constitutes acceptance of the updated policy.

12. Privacy Officer and Contact Information

NNI has designated a Privacy Officer responsible for overseeing compliance with this Privacy Policy.

For privacy-related questions, data requests, or concerns:

Network Ninja, Inc. Email: privacy@networkninja.com Website: https://networkninja.com

For questions about your Organization's specific data or to submit a data request, please contact your Organization's administrator first. If you have a concern that cannot be resolved through your Organization, you may contact NNI directly using the information above.

Collaborate is a product of Network Ninja, Inc.