Privacy policy.

This privacy policy covers both the public marketing website at npdestracker.com and the NPDESTracker application at app.npdestracker.com. Wood Technologies LLC operates NPDESTracker. Customer-side data handling inside the application is summarized here for procurement and IT review.

What we hold for customers. When an agency uses the NPDESTracker application, customers create accounts (name, email, role) and enter municipal compliance records (sites, outfalls, BMPs, structures, inspections, IDDE incidents, complaints, tasks, activities, enforcement actions, annual report answers, and attachments uploaded by staff). All customer records are scoped to the customer's tenant.

How we use that data. We use customer data to operate the product (rendering the workspace, running queries, producing the annual report, generating audit trails) and to provide support when a customer requests it. We do not sell customer data. We do not share customer records with advertisers, data brokers, or marketing lists.

No cross-tenant analytics or benchmarks. We do not run cross-tenant analytics, anonymized benchmarks, or industry-comparison reports across customers. Each agency's records stay inside its own tenant workspace. Operational analytics surfaces (MS4 Metrics, the audit log workspace, IDDE response timelines, and readiness rollups) run on a single tenant's own records. If we ever offer optional cohort benchmarks in the future, they will be tenant opt-in and described in writing before any data leaves a tenant workspace.

No staff surveillance or productivity ranking. NPDESTracker is built for the program, not for surveilling the workforce. We do not provide inspector productivity scores, keystroke logging, location tracking outside the inspection record itself, or staff ranking dashboards. Per-record attribution and timestamps exist for audit purposes; they are not packaged as performance metrics.

Connected ArcGIS content. If your agency connects its ArcGIS organization, a staff member signs in with their own ArcGIS named user account through Esri sign in. We never receive, request, or store an ArcGIS password, and we do not ask your agency for an API key or a shared service account. The long-lived refresh credential is held server side and is never sent to the browser. NPDESTracker reads the maps, layers, and features that account can already see; it performs no writes against your ArcGIS content, so it cannot edit, publish, re-share, or delete it. Content read through the connection stays in your ArcGIS organization and is not copied into NPDESTracker. Files your team chooses to import, such as GeoJSON, shapefile, or CSV, are stored in NPDESTracker, with the original upload retained separately from the browser display layer. Each connection is scoped to one user in one tenant, and removing the application approval or disabling the account in ArcGIS ends what we can read. The full description is on the ArcGIS integration and security page.

Smart Draft data handling. Smart Draft (the assistive drafting feature inside Annual Reporting) is deterministic: it assembles a starting draft from linked evidence using templates inside NPDESTracker. It does not contact an external AI provider, and no customer data is sent to an AI provider. The full disclosure is on the Smart Draft page.

What you should not upload. The application is built for municipal compliance records, not for personally sensitive data. Please do not upload Social Security numbers, payment card numbers, health information, or other sensitive personal data into compliance records or attachments.

We use the information you provide to respond to your inquiry. If you email us about a private demonstration or an annual deployment, we use your contact details to follow up and coordinate next steps. If you email us with a question, we use your email address to reply.

We do not sell your information. We do not share it with advertisers, data brokers, or marketing lists. We do not use your information for marketing unless you've explicitly asked us to.

Running a website means a small number of service providers receive information incidental to delivering the site:

• Cloud hosting provider. Our hosting provider receives basic request data (IP address, user agent, URL) required to serve each page. This is standard for every modern website.
• Website analytics providers. We use Microsoft Clarity and Vercel Analytics on the public marketing website. These providers receive the page-view and behavior signals described in the cookies-and-analytics section and process them on our behalf so we can understand how visitors use the site.
• Google Ads. We use a Google Ads tag on the public marketing website. It reports page views, a conversion event when the demo link is clicked, and the named buyer-intent events listed in the cookies-and-analytics section (sample workspace click, pricing page view, security page view, privacy page view, walkthrough request click, demonstration request click, contact page opened for a demonstration or walkthrough, contact email click, and checkout link click). Each event carries only its name, the page or link it came from, and, when present, the campaign source, medium and name from the fixed list described in the cookies-and-analytics section. Google receives those signals and standard browser request data; it does not receive customer compliance records or visitor lists from us.
• Microsoft Advertising (UET). We use a Microsoft Advertising UET tag on the public marketing website to measure ad conversions and campaign performance on Microsoft and Bing search ads. Microsoft receives page-view signals and conversion events plus standard browser request data; it does not receive customer compliance records or visitor lists from us. The tag is only present on the public marketing website, not inside the application.
• Google Fonts. The public website loads the Inter typeface from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). When a page loads, your browser requests the stylesheet and font files directly from Google, which receives the standard request data any web request carries, such as your IP address and user agent. Nothing you type on the site is involved, and we do not use these requests for tracking.
• Email. When you email us, whether about a private demonstration, an annual deployment, or a general question, your message is delivered through standard email infrastructure.

We do not share your information with any other third party for marketing, advertising, or resale.

If we add a form-handling service in the future (for example, to process demo requests server-side rather than via email), we will update this policy and identify the provider.

You can ask us to show you the information we have about you, correct anything that's wrong, or delete your information from our records. Email admin@npdestracker.com and we'll take care of it. These rights apply regardless of where you live.

If this policy changes, we'll update the "Last updated" date at the top and note what changed in a short summary. For material changes, we'll do our best to flag them where visitors can notice, not just quietly update the page.