Privacy Policy

1. Introduction

Welcome to Water Watch Center ("WWC," "we," "our," or "us"), a nationwide, not-for-profit initiative that helps small and rural drinking water and wastewater utilities defend against cyber threats. Water Watch Center is operated by TPO Group, LLC, a cybersecurity consultancy. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit waterwatchcenter.org, submit our contact form, sign up for our mailing list, or submit a support ticket.

By using this website or providing us with your information, you consent to the practices described in this Privacy Policy.

2. Information We Collect

2.1 Contact Form Submissions

When you submit our contact form, we collect the information you provide: your name, email address, organization (optional), the category that best describes you (e.g. water utility, MSSP or vendor, funder, government agency), and your message.

2.2 Mailing List Signups

If you subscribe to our mailing list, we collect only the email address you provide.

2.3 Ticket Submissions

Our public support ticket system collects the email address you provide (so we can reply and so you can track your request), the title and details you write, and any files you choose to attach (up to 5 MB each).

2.4 Website Usage Information

When you visit our website, our self-hosted analytics tool automatically collects aggregate usage information: pages visited, referring pages, approximate geographic location (derived from IP address, which is not stored), and general device/browser type. See Section 9 for details on how this differs from typical third-party analytics.

3. How We Use Your Information

• Responding to inquiries submitted through our contact form and routing them to the right person on the WWC team
• Creating, tracking, and responding to support tickets, including emailing you status updates and replies
• Sending periodic updates to mailing list subscribers
• Understanding aggregate website usage so we can improve the site
• Complying with legal obligations and protecting our legal rights

We do not use your contact form, ticket, or mailing list information for advertising, and we do not sell it.

4. Information Sharing and Disclosure

4.1 Service Providers

Your information is stored in a database we operate on Amazon Web Services (AWS) infrastructure. We use Amazon Simple Email Service (SES) solely to deliver transactional emails — for example, notifying us of a new contact or ticket submission, or emailing you a confirmation or status update. We do not use a third-party CRM, marketing platform, or data broker to process contact form, mailing list, or ticket data. An earlier version of this site sent form submissions to a third-party form-processing service; that integration has been fully removed, and all submissions are now stored directly in our own database.

4.2 Legal Requirements

We may disclose your information when required by law, court order, or government regulation, or to protect our legal rights, investigate potential violations of our terms, or ensure the safety and security of our systems and users.

4.3 Business Transfers

In the event of a merger, acquisition, or transfer of WWC's operations, your information may be transferred to the successor organization, subject to the same commitments described in this policy.

5. Public Water System Data Shown on Our Maps

WWC's atlas, National Rural Water Association (NRWA), and wastewater system maps display information about U.S. water and wastewater systems — such as system name, location, and size — sourced from public government records (including EPA data). This is public infrastructure data, not personal information collected from website visitors. Browsing these maps does not submit any of your own information to us beyond the ordinary website usage information described in Section 2.4.

6. Data Security

This website is served entirely over HTTPS with HTTP Strict Transport Security enabled. Submitted data is stored in a database with access restricted to the specific application that needs it, on infrastructure isolated from public networks. As a cybersecurity-focused organization, we hold our own website to the same standards we advocate for the utilities we serve.

7. Data Retention

We retain contact form and ticket submissions for as long as needed to respond to your request and maintain a record of the engagement. Mailing list addresses are retained until you unsubscribe or ask us to remove them.

8. Your Privacy Rights

• Request access to the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your information, or removal from our mailing list
• Ask us how your information has been used

To exercise any of these rights, contact us at privacy@tpo.group.

9. Website Analytics and Tracking

We use Umami, a self-hosted, privacy-respecting analytics platform that we run ourselves at analytics.waterwatchcenter.org — not a third-party service like Google Analytics. Your browsing data is never shared with an advertising network or data broker, because there isn't one in the loop at all. In its default configuration (which is how we run it), Umami does not set tracking cookies in your browser and does not build an individual profile of you across visits or across other websites.

10. Third-Party Links

Our website may contain links to third-party websites or resources. We are not responsible for the privacy practices of these third parties, and we encourage you to review their privacy policies before providing any personal information.

11. Data Transfers

We are a U.S.-based organization, and information collected through this website is processed and stored on infrastructure located in the United States.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated policy on this page, and the "Last updated" date at the top will reflect the most recent revision.

13. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

TPO Group, LLC
Email: privacy@tpo.group
Address: 255 S King St Ste 800, Seattle, WA 98104
Or use our website contact form.

14. Governing Law

This Privacy Policy is governed by the laws of the State of Delaware and applicable federal law, without regard to conflict of law principles.