ACA 360 LLC respects the privacy of the people who visit our website, receive our text messages, contact our team, refer a business, or use our authorized content-management tools. We collect only what we need to operate the site, respond to requests, and deliver our services responsibly.
1. Scope of this policy
This Privacy Policy applies to the public website at aca360.com, its ACA 360 Insights articles, and the restricted content-management area hosted on the same domain (together, the “Website”).
Section 7 also applies to mobile information and consent data associated with ACA 360 text messaging.
This policy does not govern employee, benefits, payroll, tax, or other client data that ACA 360 processes while providing contracted ACA compliance services. That information is handled under the applicable client agreement, instructions, and legal requirements. It also does not apply to websites or services operated by other organizations, even when we link to them.
2. Information we collect
Information you provide
- Business contact information: your name, business email, phone number, company, job role, and the subject of your inquiry.
- Communications: information you include in emails, telephone conversations, consultation requests, or other correspondence with ACA 360.
- Referral information: your contact details, your relationship to ACA 360, reward preference, and the company or business contact you choose to refer. You should provide another person’s information only when you have a reasonable basis to do so.
- Website form submissions: information you enter in Marketplace, supplemental-benefits, referral, consultation, and other inquiry forms, including the page and request type that led you to the form.
- Assessment and guide requests: your work email and, for an assessment, the company website you want assessed. The Deep Dive also asks how your company tracks hours, offers coverage, sets employee contributions, and handles ACA reporting, along with your name, company, and an optional phone number. We record the consent statement you accepted and when you accepted it.
- IRS-letter uploads: the letter and contact details you submit through the dedicated penalty-relief upload form. ACA 360 stores a letter only after it passes a malware scan; infected file bytes are deleted.
- Authorized CMS account information: username, private login email, password hash, role, account status, public profile details, profile image, social links, and content attributed to an authorized contributor.
Public information about your company
When you request a Quick Assessment or Deep Dive, we use AI models to research publicly available information about the company at the website you provide, such as its own website, job postings, public filings, and news coverage. We do this only for the company you name. The resulting report is an estimate, not a compliance determination.
Information collected automatically
Our hosting and security systems may create standard technical logs when a browser requests a page or file. Those logs can include an IP address, request date and time, requested URL, referring page, browser and device information, response status, and security or diagnostic events.
Information the calculator does not send to us
Values entered into the public ACA Affordability Calculator are calculated in your browser. The Website does not submit or store those calculator values. If you later email or otherwise provide the figures to us, they become part of that communication.
Use only the dedicated IRS-letter form to upload a letter. Do not include Social Security numbers, employee medical information, full payroll files, or other sensitive enrollment data in general inquiry forms or ordinary email. If you need to share other sensitive documents, ask an ACA 360 representative for an approved method.
3. How information is collected
We collect information from the following sources:
- directly from you when you email, call, request information, send a referral, or manage an authorized CMS account;
- automatically from your browser, device, and interactions with the Website;
- from a person who refers you or your business to ACA 360;
- from publicly available sources about a company, when you request an assessment of it; and
- from service providers that support hosting, security, communications, and Website operations.
Website forms and assessment requests submit information to ACA 360's protected administrator inbox and are recorded in our customer relationship management (CRM) system. Staff receive email notices about new submissions. IRS letters are not attached to those notices; administrators must sign in to open a clean, scanned letter. If the malware scan cannot confirm a clean result, the Website does not retain the file.
4. How we use information
We use information reasonably necessary to:
- respond to questions, referrals, consultation requests, and other communications;
- evaluate whether ACA 360 services may fit an employer’s needs;
- operate, maintain, secure, troubleshoot, and improve the Website;
- administer authorized CMS accounts, authenticate users, attribute articles, and send account-related email;
- prepare assessment reports, using AI models to research and summarize public information about the company you name and, for the Deep Dive, your answers;
- email you the reports and guides you request, and follow up with you about ACA compliance as you agreed when you made the request;
- keep a record of requests, inquiries, and follow-up in our CRM system;
- prepare and publish employer-facing content, including optional AI-assisted metadata and image workflows used by authorized editors;
- measure general Website performance and understand which content is useful;
- protect ACA 360, our clients, users, and others from fraud, abuse, security threats, or unlawful activity;
- comply with legal obligations and enforce applicable agreements; and
- carry out another purpose that we explain when information is collected or that you authorize.
6. How information is disclosed
We may disclose information in the following limited circumstances:
- Service providers: vendors supporting hosting, infrastructure, email delivery, security, fonts, analytics, content generation, AI research and report writing, customer relationship management, and other Website operations, subject to appropriate instructions and protections.
- Professional advisors: attorneys, accountants, insurers, auditors, or consultants where reasonably necessary.
- Legal and safety reasons: when required by law, legal process, or a valid governmental request, or when reasonably necessary to protect rights, safety, property, systems, or users.
- Business transactions: in connection with a financing, merger, acquisition, reorganization, sale of assets, or similar transaction, subject to applicable law.
- At your direction: when you ask us to disclose information or otherwise consent.
ACA 360 does not sell personal information and does not share it for cross-context behavioral advertising.
| Category | Examples | Primary purposes | Typical recipients |
|---|---|---|---|
| Identifiers and contact information | Name, email, phone, company, account username, IP address | Communications, referrals, account administration, security | Hosting, email, CRM, security, and professional service providers |
| Professional information | Employer, role, business relationship, public author profile | Responding to inquiries, referrals, author attribution | Operational providers; public visitors when intentionally published |
| Assessment information | Company website, work email, Deep Dive answers, public information about the company, the report | Preparing and emailing reports, follow-up about ACA compliance | AI model, CRM, email, and hosting providers |
| Internet or network activity | Requested pages, browser/device data, referring URL, diagnostics | Site delivery, security, troubleshooting, aggregate measurement | Hosting, security, tag-management, and analytics providers |
| Communications and user content | Emails, referral notes, profile content, articles, image prompts | Responding, operating the CMS, and publishing content | Email, hosting, content-generation, and professional service providers |
7. SMS text messaging privacy
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information may be shared with subcontractors that provide support services, such as customer service, solely to provide those services.
All other use-case categories exclude text messaging originator opt-in data and consent. We will not share SMS opt-in data or consent with any third party.
8. Retention
We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including providing requested information, maintaining business and account records, securing the Website, resolving disputes, enforcing agreements, and satisfying legal, tax, accounting, or compliance obligations.
The private link to an assessment report works for 90 days. ACA 360 keeps the request, the report, and our follow-up notes as business records in our own systems and CRM after the link expires. Retention depends on the type and sensitivity of the information, the relationship involved, and applicable requirements. CMS account and published-author records may be retained to preserve security history and accurate article attribution. When information is no longer required, we may delete, de-identify, or securely archive it.
9. Security
We use administrative, technical, and physical safeguards designed to protect information against unauthorized access, alteration, loss, misuse, or disclosure. Measures include access controls, encrypted transport, password hashing, signed sessions, role-based administration, and restricted production systems.
No website, email system, or storage method can be guaranteed completely secure. You are responsible for using a strong, unique password for an authorized CMS account and for protecting your devices and email account.
10. Your choices and privacy rights
Depending on where you live and subject to applicable exceptions, you may have the right to request that we:
- confirm whether we process your personal information and provide access to it;
- correct inaccurate information;
- delete certain information;
- provide a portable copy of certain information;
- identify categories of information, sources, purposes, and recipients;
- limit certain uses of sensitive personal information;
- opt out of a sale, targeted advertising, or qualifying profiling; or
- appeal a denied request where applicable.
ACA 360 does not sell personal information or use it for targeted advertising. To submit another privacy request, email compliance@aca360.com with “Privacy Request” in the subject line, or use the contact information below. Describe the request and the Website interaction or account involved.
We may need to verify your identity and authority before completing a request. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and identity verification. We will not discriminate against you for exercising an applicable privacy right.
11. Children’s privacy
The Website is intended for employers and business professionals, not children. We do not knowingly collect personal information from children under 13 through the Website. If you believe a child has provided information to us, contact us so we can evaluate and delete it as appropriate.
12. International visitors
ACA 360 is based in the United States, and the Website and its service providers may process information in the United States or other countries. If you access the Website from outside the United States, your information may be transferred to a jurisdiction with different data-protection laws. We apply the protections described in this policy and any safeguards required by applicable law.
13. Third-party sites and services
The Website links to services we do not control, including LinkedIn, email providers, and Google services. Their collection and handling practices are governed by their own terms and privacy notices. A link does not mean ACA 360 controls or endorses every aspect of the third party’s privacy practices.
14. Changes to this policy
We may update this Privacy Policy to reflect changes in the Website, our practices, or legal requirements. We will post the revised policy here and change the “Last updated” date. If a change materially affects how we use information already collected, we will provide additional notice when required by law.
15. Contact us
Questions, requests, or concerns about this policy can be directed to: