Privacy Policy

1. Who This Policy Covers

This policy applies to two distinct groups of people:

Our practices differ slightly for each group and are explained throughout this policy.

2. Information We Collect

From Campaign Operators

• Account information: name, email address, and password (managed by Clerk — see Section 7).
• Campaign details: candidate name, office sought, district, election date, party affiliation, biography, slogan, and campaign assets (photos, logos).
• Payment information: billing details processed by Stripe — we do not store raw card numbers.
• Usage data: pages visited, features used, session duration, and error logs.
• AI content inputs: background information and issue descriptions you provide to generate content drafts.

From Supporters & Visitors

• Sign-up data (when voluntarily submitted): first name, last name, email address, postal code, and volunteer interest.
• Feedback messages: anonymous messages submitted through the campaign feedback form.
• Device and usage data: IP address, browser type, referring URL, and pages viewed — collected automatically via server logs and analytics.
• QR code scan data: scan count and approximate location (region-level) when a campaign QR code is scanned.

3. How We Use Your Information

Campaign Operators

• To create and manage your account and campaign.
• To process payments and manage your subscription.
• To provide customer support and respond to inquiries.
• To send service-related communications (receipts, security alerts, product updates).
• To generate AI-assisted content drafts based on inputs you provide.
• To improve and develop the Service through aggregated, de-identified analytics.

Supporters & Visitors

• To record supporter sign-ups and make them available to the campaign operator.
• To deliver anonymous feedback messages to the relevant campaign.
• To provide aggregate analytics to the campaign (e.g., page views, supporter count, QR scan counts).
• To detect and prevent abuse, fraud, or violation of our acceptable use policy.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, we process your personal data on the following legal bases:

• Contract — to perform the services you or your campaign has engaged us for.
• Legitimate interests — to prevent fraud, improve the Service, and maintain security.
• Consent — where you have given clear consent (e.g., marketing communications). You may withdraw consent at any time.
• Legal obligation — where we are required to process data to comply with applicable law.

5. Sharing and Disclosure

We do not sell your personal data. We share information only in the following circumstances:

• Service providers: Clerk (authentication), Stripe (payments), cloud hosting providers, and AI model providers — each bound by data processing agreements.
• Campaign operators: supporter sign-up data is shared with the campaign operator who owns the campaign page.
• Legal requirements: if required by law, court order, or to protect the rights, property, or safety of Votumi, our users, or the public.
• Business transfers: in connection with a merger, acquisition, or sale of assets, with advance notice provided to affected users.

6. Supporter Data and Campaign Operators

When a supporter submits their information through a campaign page, Votumi acts as a data processor on behalf of the campaign operator (the data controller). The campaign operator is responsible for how supporter data is used after collection, including compliance with campaign finance and data protection laws.

If you are a supporter and wish to access, correct, or delete your data, you may contact the campaign directly or contact us at [email protected] and we will facilitate the request with the relevant campaign.

7. Third-Party Services

8. Cookies and Tracking

We use cookies and similar technologies to:

• Maintain your login session (essential cookies — cannot be disabled).
• Remember your preferences.
• Collect aggregate analytics on how the Service is used.

You can control non-essential cookies through your browser settings. Disabling cookies may limit some functionality of the Service. We do not use third-party advertising trackers.

9. Data Security

We implement industry-standard technical and organizational measures to protect your data, including TLS encryption in transit, encrypted storage for sensitive fields, access controls, and regular security reviews. However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

10. Data Retention

• Campaign operator account data: retained for the duration of your subscription plus 30 days after termination to allow data export.
• Supporter data: retained for as long as the associated campaign account is active, or as required by campaign finance law.
• Anonymous feedback: retained for up to 24 months.
• Payment records: retained as required by tax and accounting obligations (typically 7 years).
• Server logs: retained for up to 90 days.

11. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — request that inaccurate data be corrected.
• Deletion — request that your data be deleted (subject to legal retention requirements).
• Portability — receive your data in a machine-readable format.
• Objection / Restriction — object to or restrict certain processing activities.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.
• Opt out of sale (CCPA) — we do not sell personal data, so this right is satisfied by default.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

12. Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If we learn that we have inadvertently collected data from a child, we will delete it promptly. If you believe a child has provided us with personal data, please contact us at [email protected].

13. International Transfers

Votumi operates in the United States. If you access the Service from outside the United States, your information may be transferred to and processed in the United States, which may have different data protection standards than your country. Where required by law, we use appropriate transfer mechanisms (such as Standard Contractual Clauses) to protect your data.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a prominent notice within the Service at least 14 days before the changes take effect. We encourage you to review this page periodically. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

15. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy, please contact our privacy team: