Civic Privacy Policy

This Privacy Policy for Civic Tech, Inc. (doing business as Civic) ("we," "us," or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://www.engagecivic.com/ or any website of ours that links to this Privacy Policy
• Use Civic. Civic is a platform designed to help users learn what is happening in government, understand how it affects them, and engage with others and with their elected representatives. Civic is independent and nonpartisan.
• Engage with us in other related ways, including any marketing or events

Civic is intended only for users located in the United States.

Questions or concerns? Reading this Privacy Policy will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at privacy@engagecivic.com.

Summary of Key Points

This summary provides key points from our Privacy Policy. You can find more detail about any of these topics in the full policy below, using the table of contents to find the section you are looking for.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the features you use. Learn more in Section 1.

Do we process information that may reveal political or policy views? Yes, in limited cases. Some information you choose to post, communicate, or otherwise share through Civic may reveal your political or policy views. Although political opinions are not classified as legally protected "sensitive data" under every applicable privacy law, Civic treats identifiable information revealing political or policy views as sensitive as a matter of our privacy practices. Learn more in Section 1.

Do we receive information from other sources? We primarily collect personal information directly from you. We may receive limited account or authentication information from service providers such as Clerk and geographic district or representative information from providers we use to identify your elected representatives. We do not purchase personal profiles about you from data brokers.

Do we sell your personal information or use it for advertising? No. We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. Learn more in Section 2.

In what situations and with which parties do we share personal information? We share personal information with service providers that help us operate the Services, with other users and elected officials when you choose to share with them, and in limited situations such as when required by law or in a business transfer. We do not disclose nonpublic information about your political or policy views to candidates, campaigns, political parties, political committees, or advertisers, except at your direction or with your consent. Learn more in Section 3.

Do we use artificial intelligence? We use third-party artificial intelligence service providers, which may include OpenAI, to generate plain-language summaries of legislation from publicly available legislative text. We do not send your personal information to AI service providers for this purpose. Learn more in Section 4.

How do we keep your information safe? We use organizational and technical measures designed to protect personal information. However, no electronic transmission or storage system can be guaranteed to be 100% secure. If we experience a security incident involving personal information, we will provide notifications where required by applicable law. Learn more in Sections 7 and 8.

What are your rights? Depending on the state where you live, applicable privacy law may give you certain rights regarding your personal information. Learn more in Sections 10 and 12.

How do you exercise your rights? The easiest way to exercise your rights is by emailing privacy@engagecivic.com. Section 12 explains what to include in your request. We will consider and act upon any request in accordance with applicable data protection laws.

Table of Contents

• What information do we collect?
• How do we process your information?
• When and with whom do we share your personal information?
• Do we use artificial intelligence?
• Do we use cookies and other technologies?
• How long do we keep your information?
• How do we keep your information safe?
• What happens if there is a data breach?
• Do we collect information from minors?
• What are your privacy rights?
• Controls for Do-Not-Track and Global Privacy Control
• Privacy rights for United States residents
• Is Civic available outside the United States?
• Do we make updates to this policy?
• How can you contact us about this policy?
• How can you review, update, or delete the data we collect from you?

1. What Information Do We Collect?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our Services, participate in activities on the Services, or otherwise contact us.

Personal Information Provided by You

The personal information that we collect depends on how you interact with the Services, the choices you make, and the features you use.

The personal information we collect may include:

• phone numbers;
• email addresses;
• mailing addresses;
• usernames; and
• contact and communication preferences.

Mailing Address. When we refer to your mailing address, we mean the street address, city, state, and ZIP code you provide to Civic. We use this information to identify your electoral districts and elected representatives and to provide geographically relevant Civic content.

Authentication Information

We use Clerk, a third-party authentication and account-management provider, to support account creation, login, authentication, account security, and account management.

Clerk may process authentication credentials and related information on our behalf as necessary to provide those services. Civic does not store your account password in its application database.

Content You Share

When you use features of the Services, we collect the content you create or share, such as comments and views on legislation that you post, messages you send to other users, and messages you send to elected officials through the Services. This content may reveal your political or policy views (see "Political and Policy Views" below).

Private Messages. Private messages you send to other users are visible to you and the recipients. We access the content of private messages only when reasonably necessary to review messages reported to us, protect the safety and security of users and the Services, comply with legal obligations, or provide customer support you request.

Communications with Us

If you contact us, for example by emailing support@engagecivic.com or privacy@engagecivic.com, or by reporting content, we collect your contact information, the contents of your message, and any other information you choose to provide. If you send us feedback, suggestions, or other submissions, we handle any personal information they contain as described in this Privacy Policy.

Political and Policy Views

Some information you choose to publish, communicate, or otherwise share through Civic may reveal your political or policy views. This may include comments about legislation, participation in civic discussions, communications with elected representatives, or other activity you voluntarily undertake through the Services.

Although political opinions are not classified as legally protected "sensitive data" under every applicable privacy law, Civic treats identifiable information revealing political or policy views as sensitive as a matter of our privacy practices.

Providing or publicly sharing political or policy views through Civic is optional. We process this information to provide the features you choose to use and for the other purposes described in this Privacy Policy.

Civic Activity and Political or Policy Views

When you use Civic, you may engage with legislation, representatives, public-policy topics, discussions, or other civic features. This activity may reveal information about your political or policy interests and views.

We do not sell identifiable information about an individual user's political or policy views, legislative activity, or civic participation.

We may use this information as reasonably necessary to:

• provide features you choose to use;
• personalize your Civic experience;
• understand engagement with the Services;
• improve Civic;
• maintain the integrity and security of the Services; and
• carry out other purposes described in this Privacy Policy.

We may use aggregated or de-identified information for internal analytics and product improvement. We take reasonable measures designed to prevent information treated as de-identified from being associated with an identifiable individual.

Accuracy of Information

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In Short: Some information, such as your Internet Protocol (IP) address and browser and device characteristics, is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not by itself reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services and for our internal analytics and reporting purposes. We collect this information through our own systems and our hosting and analytics provider. We do not use advertising tools (see Section 5).

The information we collect includes:

Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type and settings, and information about your activity in the Services (such as the date and time stamps associated with your usage, pages and files viewed and other actions you take, such as which features you use), and device event information (such as system activity, error reports (sometimes called "crash dumps"), and hardware settings).

Device Data. We collect device data such as information about the computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.

Location Information. We do not collect precise geolocation data, such as GPS coordinates, from your device.

We use the mailing address you provide at sign-up to identify your electoral districts and elected representatives and to show you legislation and other content relevant to where you live.

To provide this functionality, we may provide your mailing address to a service provider that returns corresponding geographic districts and representative information.

If you use the address search on our home page, the address you type is sent to the United States Census Bureau's public geocoding service to identify your congressional district. The address is not stored by Civic, is not written to our logs, and is not used for any other purpose. The Census Bureau's own privacy policy governs how they handle requests to their service.

We may also derive the country from which you access Civic from your IP address for security and operational purposes.

2. How Do We Process Your Information?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

• We process your personal information for a variety of reasons, depending on how you interact with our Services, including:
• To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
• To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.
• To personalize your experience. We may process your information, including the mailing address you provide, to show you elected representatives, legislation, and other content relevant to where you live.
• To improve Civic. We may use information about how you engage with the Services to understand how users interact with legislation and other Civic features, improve the Services, and develop new features.
• To respond to user inquiries and offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
• To send administrative information to you. We may process your information to send you details about our Services, changes to our terms and policies, and other similar information.
• To enable user-to-user communications. We may process your information if you choose to use any of our features that allow for communication with another user.
• To request feedback. We may process your information when necessary to request feedback and to contact you about your use of our Services.
• To send you optional updates. If you choose to receive optional email updates or other promotional communications from us, we process your information to send them in accordance with your preferences. These communications are nonpartisan and will not advocate for or against any candidate, political party, or ballot measure. You can unsubscribe at any time. For more information, see Section 10.
• To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
• To evaluate and improve our Services and your experience. We may process your information when we believe it is necessary to identify usage trends, determine the effectiveness of our promotional campaigns, and evaluate and improve our Services, marketing, and your experience.
• To identify usage trends. We may process information about how you use our Services to better understand how they are being used so we can improve them.
• To determine the effectiveness of our marketing and promotional campaigns. We may process your information to better understand how to provide marketing and promotional campaigns that are most relevant to you.

To comply with our legal obligations. We may process your information to comply with our legal obligations, respond to legal requests, and exercise, establish, or defend our legal rights.

What we do not do. We do not sell your personal information. We do not use your personal information for targeted advertising. We do not use your personal information for profiling in furtherance of decisions that produce legal or similarly significant effects.

3. When and With Whom Do We Share Your Personal Information?

In Short: We share personal information only in the specific situations described in this section. We do not sell your personal information, and we do not disclose nonpublic information about your political or policy views to candidates, campaigns, political parties, or advertisers without your direction or consent.

• We may share your personal information in the following situations:
• Service Providers. We share personal information with vendors that perform services on our behalf, such as website hosting and infrastructure, data storage, account sign-in and authentication, address lookup services that identify your elected representatives, website analytics, email and text messaging, customer support, and security. These service providers may use your personal information only to provide services to us, under written contracts that restrict their use of the information.
• Other Users and the Public. Information you choose to make public on the Services, such as your username and public posts, comments, and views on legislation, can be seen by anyone who uses the Services, including elected officials, candidates, campaigns, journalists, and political organizations, and may also appear on third-party websites. Please keep in mind that this content may reveal your political or policy views, and do not include personal information in public posts that you do not want others to see.
• Elected Officials and Their Offices. If you choose to contact an elected official through Civic, we may transmit your message and the information necessary to deliver it to that official's office. Before you submit the communication, we will tell you what personal information will be provided. Depending on the office's requirements, you may be asked to provide additional information, such as your name or mailing address, to establish that you are a constituent. Once information is provided to an elected official or government office, that office handles the information according to its own privacy practices.
• Legal Requirements. We may disclose your information where we are required to do so by law, subpoena, court order, or other legal process, or where we believe disclosure is necessary to protect the rights, property, or safety of Civic, our users, or others.
• Copyright Notices. If you submit a copyright notice or counter-notice, we may share it, including your name and contact information, with the other party to the dispute, as permitted or required by law.
• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company. Any personal information transferred in connection with such a transaction will remain subject to the commitments in this Privacy Policy that applied when the information was collected.

Candidates, Campaigns, Parties, and Advertisers. We do not disclose your nonpublic personal information, including nonpublic information about your political or policy views, to candidates, campaigns, political parties, political committees, or advertisers, except at your direction or with your consent (for example, when you choose to send a communication to an elected official). Information you choose to make public can be seen by anyone who uses the Services, as described above.

4. Do We Use Artificial Intelligence?

In Short: We use third-party artificial intelligence service providers to summarize legislation. We do not provide your personal information to AI service providers for this purpose.

Civic uses third-party artificial intelligence service providers, which may include OpenAI, to generate plain-language summaries of bills and other legislation. These summaries are generated from publicly available legislative text.

We do not provide users' personal information, including account details, mailing addresses, location information, or information revealing political or policy views, to AI service providers for the purpose of generating legislative summaries. Summaries are not generated based on who you are.

If we introduce AI features that process users' personal information, we will update this Privacy Policy as appropriate to explain the information involved and any choices available to you.

5. Do We Use Cookies and Other Technologies?

In Short: We use technologies necessary to operate and secure Civic and privacy-focused analytics to understand general usage of the Services. We do not use advertising cookies or cross-site behavioral tracking.

We use essential cookies and similar technologies to provide authentication, maintain sessions, remember necessary application state, secure accounts, and provide core functionality.

Our authentication provider, Clerk, uses cookies and related technologies necessary to authenticate users and maintain account sessions.

We also use Vercel Web Analytics to collect aggregated information about how the Services are used, such as page views and general usage patterns. Vercel Web Analytics does not use cookies for analytics and is not designed to identify individual visitors or track users across different websites.

Civic also uses limited first-party cookies necessary to maintain signed-in application functionality and navigation state.

We do not use advertising cookies, advertising pixels, or advertising services, and we do not use analytics information for targeted advertising.

If our use of cookies, analytics, advertising, or tracking technologies materially changes, we will update this Privacy Policy and provide any choices required by applicable law.

6. How Long Do We Keep Your Information?

In Short: We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy.

• We retain personal information only for as long as reasonably necessary to:
• provide and operate the Services;
• maintain your account;
• fulfill the purposes described in this Privacy Policy;
• comply with legal obligations;
• resolve disputes;
• prevent fraud, abuse, or manipulation;
• enforce our agreements; and

protect Civic and our users.

Retention periods may vary depending on the type of information and the purpose for which it is processed.

When you delete your account, we will take reasonable steps to delete or de-identify personal information associated with your account from our active systems, except where we reasonably need to retain information for legal, security, fraud-prevention, dispute-resolution, enforcement, or other lawful purposes. Deleting your account does not delete copies of private messages already delivered to other users or communications already delivered to elected officials' offices, and content that other users have quoted may remain on the Services.

Information may remain for a limited period in secure backups before being deleted through our normal backup-retention processes.

When we de-identify personal information, we do so in accordance with applicable law. We take reasonable measures designed to prevent de-identified information from being associated with an identifiable individual, we maintain and use it only in de-identified form, and we do not attempt to re-identify it except as permitted by applicable law. If we provide de-identified information to another party, we will contractually require that party not to attempt to re-identify it.

7. How Do We Keep Your Information Safe?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

8. What Happens if There Is a Data Breach?

In Short: If we experience a security incident involving personal information, we will investigate the incident and provide notifications where required by applicable law.

If we become aware of a security incident affecting personal information, we will take reasonable steps to investigate, contain, and address the incident.

Where required by applicable law, we will notify affected individuals and appropriate governmental, regulatory, or law-enforcement authorities in accordance with applicable legal requirements and timelines.

Notifications will contain the information required and permitted by applicable law.

The disclaimers and limitations of liability in our Terms of Service do not limit our obligations under this section or under applicable breach notification laws.

9. Do We Collect Information From Minors?

In Short: Our Services are intended only for users 18 and older. We do not knowingly collect personal information from anyone under 18.

The Services are not directed to individuals under 18, and we do not knowingly collect, solicit data from, or market to anyone under 18 years of age. By creating an account, you confirm that you are at least 18 years of age. If we learn that we have collected personal information from someone under 18, we will deactivate the account and take reasonable measures to promptly delete the information from our records. If you believe we may have collected information from someone under 18, please contact us at privacy@engagecivic.com.

10. What Are Your Privacy Rights?

In Short: You may review, change, or terminate your account at any time. Depending on your state of residence, you may have additional rights described in Section 12.

Withdrawing your consent. If we are relying on your consent to process your personal information (for example, information revealing your political or policy views), you have the right to withdraw your consent at any time. You can do so through your account settings where available, or by contacting us using the details in Section 15. Withdrawing your consent will not affect processing that took place before you withdrew it.

Opting out of marketing and promotional communications. You can unsubscribe from our marketing and promotional communications at any time by clicking on the unsubscribe link in the emails that we send or by contacting us using the details in Section 15. You will then be removed from the marketing lists. However, we may still communicate with you, for example, to send you service-related messages that are necessary for the administration and use of your account, to respond to service requests, or for other non-marketing purposes.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with third parties.

Account Information

• If you would at any time like to review or change the information in your account or terminate your account, you can:
• Log in to your account settings and update your user account.

Contact us using the contact information provided.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms, and/or comply with applicable legal requirements, as described in Section 6.

If you have questions or comments about your privacy rights, you may email us at privacy@engagecivic.com.

11. Controls for Do-Not-Track and Global Privacy Control

In Short: We recognize Global Privacy Control signals as valid requests to opt out.

Global Privacy Control (GPC). Civic recognizes Global Privacy Control signals as valid requests to opt out of the sale or sharing of personal information or targeted advertising.

Civic does not currently sell personal information, share personal information for cross-context behavioral advertising, or use personal information for targeted advertising.

Do-Not-Track (DNT). Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track feature or setting you can activate to signal your preference not to have data about your online browsing activities monitored and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized, so we do not currently respond to DNT signals. However, we do not track users across third-party websites or use tracking technologies for advertising. If a standard for DNT is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Policy.

California law requires us to let you know how we respond to web browser DNT signals. Because there currently is not an industry or legal standard for recognizing or honoring DNT signals, we do not respond to them at this time. We do honor GPC signals as described above.

12. Privacy Rights for United States Residents

In Short: Depending on your state of residence and whether an applicable privacy law applies to Civic, you may have rights regarding your personal information.

• Depending on applicable law, these rights may include the right to:
• confirm whether we process your personal information;
• access personal information we maintain about you;
• correct inaccurate personal information;
• request deletion of personal information;
• obtain a copy of certain personal information;
• withdraw consent where processing is based on consent;
• exercise applicable rights regarding the sale or sharing of personal information;
• exercise applicable rights concerning targeted advertising; and

exercise applicable rights concerning certain types of profiling.

We will not discriminate against you for exercising your privacy rights.

Civic does not currently sell personal information, share personal information for cross-context behavioral advertising, or use personal information for targeted advertising.

How to Exercise Your Rights

To submit a privacy request, email privacy@engagecivic.com.

• Please provide sufficient information for us to identify your account and understand your request. This may include:
• your name or username;
• the email address associated with your Civic account;
• the privacy right you wish to exercise; and

your state of residence where relevant to your request.

We may take reasonable steps to verify that you are the person associated with the requested information before completing a request.

If you submit a request through an authorized agent, we may require reasonable evidence that the agent is authorized to act on your behalf and may separately verify your identity where permitted by law.

We will respond to privacy requests in accordance with applicable law.

Appeals

Where applicable law gives you the right to appeal a decision concerning your privacy request, you may submit an appeal by emailing privacy@engagecivic.com and identifying the request you would like us to reconsider.

We will process applicable appeals in accordance with applicable law.

California Direct-Marketing Disclosures

We do not disclose users' personal information to third parties for those third parties' own direct-marketing purposes.

California residents may contact us at privacy@engagecivic.com with questions concerning applicable California privacy rights.

13. Is Civic Available Outside the United States?

In Short: No. Civic is intended only for users in the United States.

The Services are designed for and offered only to individuals located in the United States. Your personal information is stored and processed in the United States. We do not offer or market the Services to individuals outside the United States. If you choose to access the Services from outside the United States, you do so on your own initiative, and your information will be transferred to and processed in the United States.

14. Do We Make Updates to This Policy?

In Short: Yes, we will update this Privacy Policy as necessary, and we will give you advance notice of material changes that reduce your rights.

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated date at the top of this Privacy Policy. If we make material changes that reduce your rights or protections under this Privacy Policy, we will give you reasonable advance notice by email or through the Services before the changes take effect. For other material changes, we will notify you by prominently posting a notice of the changes or by sending you a notification directly. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

15. How Can You Contact Us About This Policy?

If you have questions or comments about this Privacy Policy, you may email us at privacy@engagecivic.com.

16. How Can You Review, Update, or Delete the Data We Collect From You?

You may review or update certain account information through your Civic account settings.

Civic uses Clerk for account management, and account-deletion functionality may also be available through the Clerk-powered account interface.

You may also contact us at privacy@engagecivic.com to request access to, correction of, or deletion of personal information associated with your Civic account.

Depending on your state of residence and applicable law, you may have additional privacy rights described in Section 12.

We may take reasonable steps to verify your identity or account ownership before completing certain requests.

Civic · Independent & nonpartisan · For every voter