Privacy policy — America250 Community Futures Challenge

Last updated: June 24, 2026

Who we are

This privacy policy describes how Pacheco Ventures ("Pacheco," "we," "our," or "us"), as the operator of america250cfc.org (the "Site") and the America250 Community Futures Challenge application portal (together with the Site, the "Services"), collects, uses, and shares information about you.

The Community Futures Challenge is funded by Philip Morris International's U.S. business ("PMI U.S.") with judging partner Arizona State University ("ASU"). PMI U.S. is the program funder; ASU is the program judging partner. Neither PMI U.S. nor ASU operates this Site or receives applicant personal information through it. Pacheco Ventures is responsible for managing the personal information collected through the Services. For information about how PMI U.S. handles personal data, see the PMI Corporate Privacy Notice.

Information we collect

Information you provide

Email address — when you opt in to be notified when applications open, or when you contact us.
Application data — your name, role, organization name and tax status, project description, budget, team information, attached files, and any other information you submit through the application portal.
Correspondence — emails, messages, and materials you send to us at hello@america250cfc.org, apply@america250cfc.org, press@america250cfc.org, privacy@america250cfc.org, legal@america250cfc.org, or related addresses.

Information collected automatically

Server logs — IP address, browser user-agent, request path, and timestamp for security and reliability. Logs are retained for 90 days.
Authentication cookie — during the private-preview period, a session-only cookie (nn_auth) is used to verify the site password. The cookie expires when you close your browser; we never persist it across sessions.
No third-party advertising trackers, no cross-site tracking, no pixel-based analytics. We do not load Google Analytics, Meta Pixel, or comparable trackers, and we do not share data with advertising networks.

How we use information

To operate the application process and judge submissions.
To communicate with applicants, finalists, and winners.
To send program updates to people who explicitly request them.
To detect and prevent abuse of the Site or application portal.
To produce aggregate, non-identifying program reports for partners and the public.
To comply with legal obligations.

Sharing — and what is not shared

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

Applicant personal information is not shared with PMI U.S. PMI U.S. does not receive applicant submissions, names, contact details, or attachments through this Site. PMI U.S. receives only aggregate, non-identifying program reporting and the names of selected winners after public announcement.

We share limited information only with:

The independent judging panel — to perform review and scoring of applications across the program's five evaluation dimensions.
Arizona State University — non-identifying program summaries to the extent necessary for judging-partner reporting. ASU does not receive applicant contact details or submission text through this Site.
Service providers — vendors who host the Site, send our email, and store applications (Netlify, Supabase, Resend, Anthropic), under contract and limited to the purposes above.
As required by law — in response to valid legal process, or to protect rights, property, or safety.

Data retention

We retain personal information only as long as needed for the purposes above: application data is retained through the duration of the program (September 2026 – December 2027) and for two years thereafter for program reporting; correspondence is retained for the duration of the program and one year thereafter; server logs are retained for 90 days. After these periods, personal information is deleted or anonymized.

Your privacy rights

Regardless of where you live, you may:

Opt out of email updates by clicking "unsubscribe" in any email or writing to privacy@america250cfc.org.
Request access, correction, or deletion of your personal information by emailing privacy@america250cfc.org. We respond within 30 days.
Decline cookies by disabling them in your browser. The Site password gate requires cookies; disabling them will prevent access during preview.

California residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (together, "CCPA"), provides you with the following rights regarding your personal information:

Right to know — what categories of personal information we collect, the sources, the business or commercial purposes, the categories of third parties we share with, and the specific pieces of personal information we have about you.
Right to delete personal information we have collected from you, subject to legal exceptions.
Right to correct inaccurate personal information we maintain about you.
Right to opt out of sale or sharing of personal information. We do not sell personal information and we do not share personal information for cross-context behavioral advertising, so no opt-out is required.
Right to limit use and disclosure of sensitive personal information. We do not collect sensitive personal information beyond what is necessary to operate the Services for the purposes described above.
Right to non-discrimination for exercising any of these rights. We will not deny you Services, charge you a different price, or provide a different level of quality because you exercise your privacy rights.

Categories of personal information collected in the prior 12 months: identifiers (name, email, IP address); commercial information (organization, project budget); professional or employment information (role, organization affiliation); internet activity (server log information); inferences drawn from the above (none used for profiling or automated decision-making).

Sources: directly from you (application form, contact forms, email); automatically (server logs, authentication cookie); from service providers (hosting, email delivery).

Business purposes: operating the application process; communicating with applicants; preventing fraud and abuse; complying with legal obligations.

Categories of third parties we share with: service providers under contract; the independent judging panel; ASU (non-identifying summaries only); legal authorities as required by law. We do not share with advertising networks, data brokers, or PMI U.S.

To exercise California privacy rights, email privacy@america250cfc.org with your name and the email associated with any communications. Authorized agents may submit requests on your behalf with written authorization. We may need to verify your identity before fulfilling a request.

If you believe we have not responded adequately, you may contact the California Attorney General at oag.ca.gov/privacy/ccpa.

Other state residents (Colorado, Connecticut, Delaware, Iowa, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia)

If you are a resident of any of the states listed above, your state's comprehensive privacy law may grant you rights similar to those described under California above, including (where applicable) the right to access, correct, delete, and obtain a portable copy of your personal information, and to opt out of the processing of your personal information for targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects.

To exercise any of these rights, email privacy@america250cfc.org. We respond within 45 days, with one possible 45-day extension where reasonably necessary. If we decline a request, you may appeal by replying to our response or emailing privacy@america250cfc.org with the subject line "Privacy Appeal." We respond to appeals within 60 days.

As stated above, we do not sell personal information, we do not process personal information for targeted advertising or cross-context behavioral advertising, and we do not engage in profiling that produces legal or similarly significant effects. We do not knowingly process the personal information of consumers under 18 for these purposes.

Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from children. The Community Futures Challenge requires applicants to be 21 or older, and projects must serve adults 21 and older.

Security

We use HTTPS, modern security headers, content security policy, encrypted storage, and access controls to protect information in transit and at rest. The Site is hosted on Netlify; application data is stored in Supabase under Pacheco Ventures' account; transactional email is delivered via Resend; AI-assisted screening uses Anthropic's API. All providers operate under contract and process data only on Pacheco's instructions. No system is perfectly secure; if you believe your interaction with us is no longer secure, contact privacy@america250cfc.org immediately.

International visitors

The Site is operated from the United States and intended for U.S. residents (applicants must be U.S.-based). If you access the Site from outside the U.S., your information will be transferred to and processed in the United States, which may not provide the same level of privacy protection as your jurisdiction. By using the Services from outside the U.S., you consent to this transfer.

Changes

We may update this policy from time to time. Material changes will be posted on this page with a revised "Last updated" date and, where reasonably possible, additional notice via email to applicants. Continued use of the Services after changes constitutes acceptance of the revised policy.

Contact

Questions, requests, or complaints about this privacy policy can be sent to privacy@america250cfc.org. For California-specific requests, please put "California Privacy Request" in the subject line. A mailing address is available on request.