Privacy Policy

Who we are

InCite is a mission-sustainability platform for nonprofit organizations, built and operated by FitProof (“FitProof,” “we,” “us”). This policy describes how we collect, use, store, and protect information when your organization uses InCite, including its integrations with third-party systems and its AI assistant. Questions: Info@fit-proof.com.

Information we collect

Information your organization provides

• Account information: names, work email addresses, and roles of the people your organization authorizes to use InCite.
• Documents your organization uploads: financial statements, IRS filings, audits, contracts, policies, grant records, and similar organizational documents.
• Data your organization enters in the product: programs, budgets, decisions, tasks, notes, and configuration.

Information from connected systems (integrations)

When an administrator at your organization connects a third-party system, InCite reads data from it under credentials your organization controls. Connections are read-only wherever the vendor supports it. Depending on what your organization connects, this may include:

• Accounting and ledger data (for example QuickBooks Online, Microsoft Dynamics GP): chart of accounts, journal entries, vendors, bills, and payments.
• Point-of-sale and payment data (for example Square): sales, tenders, fees, and settlement summaries.
• Accounts-payable data (for example BILL): bills, vendors, approvals, and payment records.
• Payroll and workforce data (for example ADP, Paylocity): payroll cost and its allocation to programs and grants.
• Corporate card and spend data (for example Brex): card transactions and expenses.
• Case-management and service data (for example Foothold AWARDS, Apricot by Bonterra, Therap): program, service, and outcomes records, which may include protected health information (“PHI”) where your organization’s programs involve it.

Information collected automatically

• Sign-in and security records (authentication events, including multi-factor authentication).
• Operational logs needed to run and secure the service (errors, sync results, audit trails of administrative actions).

InCite does not sell advertising and does not use third-party advertising trackers.

How we use information

• To provide the service: organizing your organization’s data, reconciling figures across sources, computing metrics and scores, generating reports, and answering questions through the AI assistant.
• To keep the service secure and reliable: authentication, access control, monitoring, and troubleshooting.
• To support your organization: responding to requests and investigating issues you report.

The AI assistant

InCite includes an AI assistant that analyzes your organization’s data to answer questions and produce reports. Its computations run on our servers; figures it reports come from your organization’s own records and connected systems. Where document content may contain PHI, InCite applies an automated screening layer designed to prevent PHI from being sent to AI providers that are not under a business associate agreement with us.

How information is protected

• Encryption in transit and at rest, using the security infrastructure of Google Cloud, our primary hosting provider.
• Integration credentials (such as OAuth tokens and API keys) are stored server-side in a managed secret store; they are never exposed to web browsers and never sent by email.
• Tenant isolation: each organization’s data is segregated and access-controlled so it is available only to that organization’s authorized users.
• Role-based access and multi-factor authentication for user sign-in.
• Where an organization’s use of InCite involves PHI, we operate under a business associate agreement (BAA) with our hosting provider, and we sign BAAs with customer organizations as required by HIPAA.

Who we share information with

We share information only with service providers needed to run InCite (for example, cloud hosting and AI processing providers), under contracts that restrict their use of the data to providing their service to us. We may disclose information if required by law. We do not sell or rent customer information. If FitProof is involved in a merger or acquisition, customer data would remain subject to commitments at least as protective as this policy.

Your organization’s control

• Your organization owns its data. Administrators control who has access and which systems are connected.
• Integration access can be revoked at any time — either inside InCite or directly in the connected system (for example, disconnecting the app inside QuickBooks or Square).
• Deleting an uploaded document removes the records extracted from it.
• On termination of service, your organization may request export of its data, and we delete customer data from production systems within a commercially reasonable period thereafter, subject to legal retention requirements.

Data retention

We retain customer data while the customer relationship is active and as needed to provide the service. Security and audit logs are retained for a limited period for the protection of the service and its customers.

Individuals’ rights

InCite is a business-to-business service: the data in InCite is controlled by the customer organization. If you are an individual whose information appears in a customer’s data and you wish to exercise privacy rights, please contact that organization; we support our customers in responding to such requests. For questions about FitProof’s own handling of information, contact Info@fit-proof.com.

Children

InCite is a workplace tool for organizations and is not directed to children. Customer organizations may store service records that concern minors served by their programs; that data is controlled by the customer organization and protected as described above.

Changes to this policy

If we make material changes to this policy, we will update this page and notify customer administrators. The effective date above reflects the latest revision.

Contact

FitProof · Info@fit-proof.com