Privacy Policy

Information We Collect

We collect different types of information depending on how you interact with our website and services.

When You Request Help (Get Help Form)

If you reach out for support through our intake form, we collect your name, phone number, email address (optional), home address (optional), county, household size, urgency level, the services you need help with, and a description of your situation in your own words.

When an Agency Makes a Referral (Referral Form)

When a service provider or agency refers a client to us, we collect:

• The referrer's name, agency, email, and phone number
• The client's name and phone number
• The services requested, urgency level, and reason for the referral

A referral can only be submitted after the referrer confirms the client has given verbal or written consent.

When You Contact Us (Contact Form)

If you send us a message through our contact form, we collect your name, email address, phone number (optional), subject (optional), and your message.

When You Sign Up to Help (Volunteer Form)

If you express interest in volunteering or getting involved through our Get Involved page, we collect your name, email address, phone number (optional), your areas of interest (such as volunteering at events, mentoring, donating supplies, or corporate partnerships), and any additional message you provide.

When You Make a Donation (Donation Form)

When you donate, we collect the amount, frequency (one-time or recurring), and whether you chose to cover processing fees. Your payment information (credit card number, billing address) is collected and processed directly by Stripe, our payment processor. We do not store your credit card number on our servers. Stripe shares your name and email with us so we can send a donation confirmation.

Sensitive Information

Some information collected through our intake and referral processes may be sensitive in nature, including details about behavioral health, substance use, justice system involvement, or domestic situations. We apply heightened protections to this information and limit access strictly to navigators and staff directly involved in your care.

Information Collected Automatically

When you submit any form on our website, our system records your IP address, the date and time of submission, and the page you submitted from. This information is stored in our audit log for security and compliance purposes. Our website uses HTTPS encryption for all connections.

We use Google Analytics on our public information pages to understand how visitors use them (pages visited, time on a page, where visitors arrived from). It collects information such as your IP address (anonymized), browser type, device type, and pages viewed, using cookies. We do not send Google your name, your contact details, or anything you type into a form on this site. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on. Google's use of this data is governed by Google's Privacy Policy.

It does not run on every page. Not on the Get Help page or anything below it, and not on the private links we send people — consent forms, secure file links and partner links. There the script is not loaded, and where it has already loaded it is switched off, so nothing is sent while you are on those pages. Advertising below has the full list of pages this covers, what is measured on the rest, what Google’s own script adds without being asked, and the one thing switching it off does not stop.

Our website is delivered through Cloudflare, which may collect technical data such as your IP address, browser type, and request metadata for security, performance, and content delivery purposes. Cloudflare processes this data as described in Cloudflare's Privacy Policy.

The Staff Mobile App

Empower & Link publishes a mobile app for its own staff. It is not available to the public, and people who receive services do not have accounts. If you are not a member of staff, nothing in this section applies to you.

When a staff member turns on notifications, the app registers a notification token with the operating system’s push service — Apple’s on an iPhone, Google’s Firebase Cloud Messaging on an Android device. The token identifies that installation of the app on that handset, and it is stored on our servers so we can send a notification to the right device. It is deleted when the staff member turns notifications off, signs out, deletes the app, or closes their account.

Notifications are written so that they never contain a person’s name or any detail from a record. They say only what kind of update it is, so that nothing confidential can appear on a locked screen.

Information We Do Not Collect

We do not sell your information, and we do not share information about the people who request services with advertisers. The cookies used on our site are limited to functional cookies required for the website to operate (session management), analytics cookies set by Google Analytics, security and performance cookies set by Cloudflare, and payment processing cookies set by Stripe during the donation checkout process.

Advertising

We run search ads on Google through the Google Ad Grants program for nonprofits. Those ads appear in Google search results. We do not sell or serve advertising on this website.

When someone reaches our site by clicking one of those ads, Google adds a click identifier to the web address. Google calls this auto-tagging, and the parameter is named gclid (or gbraid / wbraid). Where we use it, it counts how many visits came from an ad.

The Get Help and Contact pages

We do not run Google Analytics on the Get Help page, the Contact page, or any page below either of them. If you open one of those pages directly, the analytics script is never loaded at all.

The contact form is one of the ways people ask us for help. Its message box asks how we can help, and what is sent arrives in the same inbox as a request sent from the Get Help page. So we treat the two the same way, whatever the pages are called.

Arriving there from another page on this site is the harder case, and it is the one we had wrong until now. The script has already loaded by then, and leaving it out of the next page does not unload it — it keeps running in the background. So on both of those pages we also set the switch Google publishes for turning its own script off, named ga-disable. Google’s script checks that switch every time it is about to send something, which is why it works even when the script was already running. We tested this in a browser rather than assuming it: before the switch, closing the tab on the Get Help page sent Google a note of how long the visit had lasted, and with the switch set nothing is sent while you are on the page.

We switch it back on when you move to a page we do measure. Otherwise one visit to Get Help would quietly stop all measurement for the rest of your visit, which would be a different fault rather than a safer one.

One thing does carry over, and we would rather write it down than let the sentences above imply otherwise. Google's script counts how long you are actively using the site. That counter keeps running while measurement is switched off, so when it resumes, the count it reports includes the time you spent on the page we were not measuring. It is reported against the page you moved to, not against the one you left, and it is a number of seconds with no page address attached — so it does not tell Google you were on that page. It is still a number produced there, and this is the one thing switching measurement off does not stop.

Those pages still have our phone numbers, the site menu and the Quick exit button; it is the measurement that is gone, not the help. The same switch is set on the private links we send people — consent forms, secure file links and partner links.

Sending a help request or a referral

Google Analytics records nothing when someone sends a help request or a referral. We deleted those two measurements from our website’s code, so no analytics event is created for either one, and neither is counted as an ad conversion or imported into our Google Ads account. We do of course keep the request itself — that is how we get back to you. What we keep, and for how long, is set out in Information We Collect at the top of this page and in Data Retention below. It is the analytics record, and only the analytics record, that does not exist.

What Google Analytics records

Two different things reach Google, and only the first is ours to choose.

What our code asks for, on the public information pages where analytics runs: a page view for each page, with the address cleaned up as described below; a completed donation; a get-involved form submission; and a tap on our phone number, except on the Get Help, referral and contact pages.

What Google’s own script adds without being asked: the first page view of a visit is marked as a first visit and as the start of a session, and while a page is open the script reports engagement — in practice, how long you were actively on it. Google can also be set to measure things like scrolling and clicks on links that leave the site; that is a setting in Google’s console rather than anything in our code, so we will not list it as though we chose it. On the pages named above we switch the whole script off, which is the only way to stop the parts we do not choose one at a time.

The referral page

We should be straight about the difference. The referral page is the one form page we still measure: ordinary page views are recorded there, because the person filling it in is a worker at another agency referring someone else, not the person asking for help. What is different on that page is that the click identifier is removed from the address before it is reported — along with everything else in the address, including the client’s name or phone number if the link the worker used carried them — that a tap on a phone number is not recorded, and that sending the form records nothing at all.

Addresses that are reported

Where a web address is reported to Google Analytics at all, we remove the click identifier from it first on:

• the referral page and anything below it
• the contact page and anything below it, where measurement is switched off
• the Get Help page and anything below it, where measurement is switched off (see the note on active-time above)
• every private link we send you — consent forms, secure file links, partner links, kiosk and account-setup links

On those private links we also replace the secret part of the address with a placeholder, so the link itself is never sent anywhere. Everywhere on this site, the rest of the query string is dropped before an address is reported.

What we never do

We do not use remarketing or retargeting. We do not build, upload or use audience lists. We do not use Customer Match. We do not use enhanced conversions. Ad personalization is switched off on our analytics property. Nothing you type into a form on this site is sent to Google or to any other advertising platform.

Four of those are switched off inside our Google Ads account: remarketing, audience lists, Customer Match and enhanced conversions. They are commitments about how our accounts are configured, and you cannot check them from this page. The last two are in the code of this website instead, which is a different kind of claim: ad personalization is turned off in the analytics settings this site loads into your browser, and the code that would have reported a help request or a referral was deleted rather than switched off.

What we cannot tell you is what Google already knows about a search or a click before anyone reaches us. That happens on Google’s side, under Google’s own privacy policy.

Reaching us another way

No way of contacting us leaves nothing behind, so we will not name one as the private one. Each leaves a different thing, in a different place.

• A phone call usually appears in the phone account’s records — the phone bill, or the call history in the online account — which whoever holds the account can read. It is also in the call list on the handset.
• An email stays in the Sent folder of the account it was sent from, and anyone who can open that account, on any device, can read it.
• Using this website leaves the pages in the browser’s history on the device, and a browser may keep what was typed into a form. Browsing Safety below covers what a device keeps and how to delete it.

Which of those matters depends on who has access to what, and only you know that. Whichever way you use, we keep what you tell us — see Data Retention below. Our number and address are at the bottom of this page.

Information about people who request services is not shared with advertisers, in any form. Federal law requires this of us: the Violence Against Women Act (34 U.S.C. § 12291(b)(2)) and the Family Violence Prevention and Services Act (42 U.S.C. § 10406(c)(5)) bar disclosing individual information about people who seek services, whether or not that information has been encoded, encrypted or hashed.

How We Use Your Information

We use the information we collect to:

• Connect you with a navigator who can help coordinate your support services
• Respond to your questions or messages
• Process your donations and send tax-deductible receipts
• Coordinate with partner service providers to deliver wraparound support across housing, employment, behavioral health, legal aid, transportation, and education
• Comply with grant reporting requirements (using only aggregated, anonymized data that cannot identify you)
• Maintain audit logs for security and accountability
• Improve our services and website

We will never use your information for marketing purposes or sell it to anyone.

Who We Share Your Information With

We share your personal information only in the following circumstances.

Partner Service Providers. When you request help, your navigator may share relevant information with partner organizations (housing agencies, employers, legal aid providers, behavioral health services, transportation providers) to coordinate your care. We only share what is necessary to deliver the specific services you need.

Stripe. When you make a donation, your payment information is processed by Stripe, Inc. When processing your donation, Stripe acts as an independent data controller for the payment transaction. E&L acts as the data controller for all other information collected through our website. Stripe's handling of your data is governed by Stripe's privacy policy.

Google Analytics. We use Google Analytics on our public pages to collect aggregated, anonymized data about how visitors use them. On the Get Help and Contact pages it is switched off, so nothing is sent from those pages — see Advertising above. Where it does run, Google may process your IP address (anonymized), browser type, and pages visited. Google's use of this data is governed by Google's Privacy Policy.

Cloudflare. Our website is delivered through Cloudflare's content delivery and security network. Cloudflare may process your IP address and request metadata to protect the site from malicious traffic and deliver content efficiently. Cloudflare's handling of this data is governed by Cloudflare's Privacy Policy.

Email Services. We use email services to send form confirmations and donation receipts. These services process your email address and name only for the purpose of delivering those messages.

Grant Funders. We may report aggregated, anonymized statistics (such as the total number of clients served or services provided) to grant funders. We never share individual client information with funders.

Law Enforcement or Legal Process. We may disclose your information if required to do so by law, court order, or legal process. We will make reasonable efforts to notify you before doing so unless we are legally prohibited from doing so.

We never sell, rent, or trade your personal information. We do not sell your personal data as defined under any applicable state privacy law.

Data Security

We take the security of your data seriously and use multiple layers of protection:

• All data transmitted between your browser and our systems is encrypted in transit using HTTPS/TLS.
• Sensitive client information is encrypted at rest using industry-standard encryption. Your name, phone number, email, address, and case notes are stored in encrypted form that cannot be read without the decryption key.
• Access to client data is restricted by role. Staff members can only access the information necessary to perform their duties. Navigators can only view information for clients they are directly working with.
• All staff are required to use multi-factor authentication to access client information. Each staff member has a unique account — shared logins are prohibited.
• Every access to client data is recorded in a tamper-proof audit log, including who accessed the information, when, and what action was taken. These logs cannot be modified or deleted.
• Client session data automatically expires after a period of inactivity.
• Form submissions are validated and sanitized to prevent malicious input.
• Encrypted backups are performed daily and stored securely.

No system is 100% secure. While we take reasonable measures to protect your information, we cannot guarantee absolute security. In the event of a data breach affecting your personal information, we will notify affected individuals without unreasonable delay in accordance with West Virginia Code §46A-2A-102 and within the timeframes required by our business associate agreements.

Your Rights

You have the following rights regarding your personal information:

• Access. You can request a copy of the personal information we hold about you.
• Correction. You can ask us to correct inaccurate or incomplete information.
• Deletion. You can ask us to delete your personal information. We will comply unless we are required to retain it for legal, regulatory, or grant compliance reasons. If you are a staff member asking about your account, see Account Deletion.
• Withdraw Consent. If you previously gave consent for us to use your information in a specific way, you can withdraw that consent at any time.
• Opt-Out. You can ask us to stop sharing your information with partner service providers at any time, though this may limit our ability to coordinate services on your behalf.

To exercise any of these rights, contact us at support@empowerandlink.org or (413) 676-9370 We will respond within 30 days.

Confidentiality

All client information is treated as confidential regardless of whether HIPAA or other specific regulations apply. Our staff are trained on confidentiality practices and access client information only when it is necessary to perform their role. Information shared during the intake or navigation process is not disclosed to anyone outside the care team without your consent, except as described in the “Who We Share Your Information With” section above.

Information related to substance use disorder (SUD) services receives additional protections under federal regulation 42 CFR Part 2, which restricts the use and disclosure of such records beyond standard privacy protections. When SUD-related information is shared with an external party, we include a notice prohibiting further disclosure: “This information has been disclosed to you from records protected by federal confidentiality rules (42 CFR Part 2). The federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR Part 2.” Every disclosure of SUD records is documented in a permanent, unalterable log including what was shared, with whom, for what purpose, and under what authorization.

SUD records may not be used to initiate or substantiate any criminal charges or to conduct any criminal investigation of a client, and cannot be disclosed in any civil, criminal, administrative, or legislative proceeding without a court order that meets the requirements of 42 CFR Part 2.

Children's Privacy

Empower and Link provides services to adults. Our website and services are not directed at anyone under the age of 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from someone under 18, we will delete it promptly. If you believe a minor has submitted information through our site, please contact us immediately.

Cookies and Tracking

Our website uses the following types of cookies:

• Functional cookies required for the website to operate, including session management.
• Analytics cookies set by Google Analytics to help us understand how visitors use our site. These cookies collect aggregated, anonymized usage data (pages visited, time on site, referral sources). You can opt out by installing the Google Analytics Opt-out Browser Add-on.
• Security and performance cookies set by Cloudflare to protect the site from malicious traffic and deliver content efficiently.
• Payment processing cookies set by Stripe during the donation checkout process.

We do not use Facebook Pixel or any social media tracking pixel. We do not serve ads on our website — our ads run on Google search results. Our Google Ads account imports counts of completed donations, of get-involved form submissions, and of taps on our phone number; help requests and referrals are not among them, because those two measurements were deleted from our code. Ad personalization is switched off on that property, so these cookies are not used to build advertising audiences. See Advertising above for the detail.

Links to Other Websites

Our website may contain links to other organizations, resources, or service providers. This Privacy Policy applies only to empowerandlink.org. We are not responsible for the privacy practices of other websites. We encourage you to read the privacy policies of any website you visit.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last Updated” date at the top of this page. If we make significant changes to how we handle your information, we will post a notice on our website. Your continued use of our website after changes are posted constitutes your acceptance of the updated policy.

Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or your personal information, contact us at: