Privacy Policy

1. Information We Collect

When you interact with CivicSummary, we may collect the following types of information:

1.1 Information You Provide Directly

• Account Information: Your name, email address, and encrypted password when you register for an account
• Public Comment Submissions: If you submit a comment through the platform, we store the content, date, meeting ID, and associated metadata
• Optional Profile Details: ZIP code, interests, or other preferences you choose to provide for a customized experience
• Communications: Any messages, feedback, or support requests you send to us directly

1.2 Information Collected Automatically

• City Preferences & Usage Data: Your selected cities, meeting categories you follow, and how you interact with content (such as which summaries you read or alerts you open)
• Device Information: Browser type, IP address, device identifiers, and operating system collected for security and analytics purposes
• Log Data: Pages visited, time spent on the platform, links clicked, and referring URLs
• Cookies and Tracking Technologies: As described in Section 6 below

1.3 Information from Third Parties

• Payment Information: If you subscribe to a paid plan, our third-party payment processor collects and handles your payment details. We do not store full payment card information
• Single Sign-On (SSO): If you choose to sign in using a third-party service (such as Google), we may receive basic profile information such as your name and email address in accordance with that service's permissions

2. How We Use Your Information

Your data helps us create a civic experience that is personalized, responsive, and impactful. We use your information to:

• Deliver city-specific updates, summaries, and email digests
• Tailor notifications based on your interests and selected cities
• Facilitate public comment submissions to government officials
• Process subscription payments and manage your account
• Analyze usage trends to improve platform functionality and user experience
• Communicate with you about product updates, new features, and relevant civic events
• Respond to your support requests and inquiries
• Maintain account security and prevent fraud or abuse
• Comply with applicable legal obligations
• Enforce our Terms of Service

We will not use your personal information for purposes materially different from those described in this policy without providing you with prior notice and, where required, obtaining your consent.

3. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties. Your data is shared only in the following limited circumstances:

3.1 Service Providers

We work with trusted third-party service providers that help us operate and improve the platform. These providers are contractually obligated to use your data only as necessary to perform services on our behalf and to maintain appropriate security standards. Current providers include:

• AWS — cloud infrastructure and hosting
• Vercel — frontend hosting and delivery
• Supabase — database management
• Brevo — email delivery
• Stripe — payment processing
• PostHog and Google Analytics — usage analytics (subject to your cookie preferences)
• Anthropic (via AWS Bedrock) and OpenAI — AI processing used to generate summaries and power search; queries you submit to AI features may be processed by these providers, but are not used to train their models

We may update our service providers from time to time. Material changes to providers handling sensitive data will be reflected in updates to this policy.

3.2 Public Comments

When you submit a public comment through our platform, it may be forwarded to and shared with relevant government officials and may become part of the official public record. Please be aware that public records are generally accessible to anyone and that CivicSummary has no control over how government bodies handle, publish, or retain submitted comments.

3.3 Marketing Cookies

We use optional marketing cookies to inform you about CivicSummary product updates and features. We do not currently share data collected through marketing cookies with third-party advertising networks, and we do not share your name, email address, or other directly identifying information with advertisers. If this practice changes, we will update this policy and provide notice as described in Section 13. You may opt out of marketing cookies at any time through the cookie consent banner or our Privacy Controls page, as described in Section 6.

3.4 Legal Requirements

We may disclose your information if required to do so by law, court order, subpoena, or governmental regulation, or if we believe in good faith that such disclosure is necessary to:

• Comply with a legal obligation
• Protect the rights, property, or safety of CivicSummary, our users, or the public
• Detect, prevent, or address fraud, security, or technical issues

3.5 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will notify you via email or prominent notice on our platform before your data becomes subject to a materially different privacy policy.

3.6 Aggregated or De-Identified Data

We may share non-identifiable, aggregated, or de-identified data for analytics, research, or transparency reporting purposes. This data cannot reasonably be used to identify you.

4. Data Storage and Retention

• All data is encrypted in transit and at rest using industry-standard protocols (TLS 1.2 or higher)
• Our infrastructure is hosted in the United States via AWS
• Account information is retained for as long as your account remains active
• Usage and analytics data is retained for up to 24 months, after which it is deleted or anonymized
• Public comments forwarded to government bodies become part of the permanent public record and cannot be deleted by CivicSummary once submitted
• Payment transaction records may be retained for up to 7 years as required by applicable financial and tax regulations
• If you delete your account, we will remove or anonymize your personal data within 30 days, except where we are legally required to retain certain information or where data has already entered the public record

5. Your Rights and Choices

You have meaningful control over your personal information. Depending on your location, you may have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Update or correct inaccurate or incomplete information
• Deletion: Request deletion of your account and associated personal data, subject to legal retention requirements
• Portability: Receive a copy of your data in a structured, machine-readable format
• Opt-Out of Marketing: Unsubscribe from non-essential email communications at any time using the unsubscribe link in any email or through your account settings. Note that essential service notifications (such as billing receipts and security alerts) cannot be opted out of while your account is active
• Object to Processing: Object to certain data processing activities where we rely on legitimate interests as our legal basis
• Restrict Processing: Request that we limit how we use your data in certain circumstances
• Cookie Preferences: Manage your cookie preferences at any time through the cookie consent banner, our Privacy Controls page, or your browser settings, as described in Section 6

To exercise any of these rights, please contact us at privacy@civicsummary.ai or use the settings available in your account dashboard at civicsummary.ai/account. We will respond to verified requests within 30 days. In some cases, we may need to verify your identity before fulfilling your request.

6. Cookies and Tracking Technologies

6.1 What We Use

We use cookies and similar technologies, including local storage and session tokens, to help personalize content, analyze platform usage, deliver relevant content, and provide a better overall experience.

6.2 Types of Cookies

We use three categories of cookies:

6.3 Managing Your Cookie Preferences

You have control over which optional cookies you allow. You can manage your preferences in the following ways:

• Cookie Consent Banner: When you first visit CivicSummary, a cookie consent banner will appear at the bottom of the page allowing you to accept or decline optional cookie categories
• Privacy Controls Page: You can change your cookie preferences, withdraw consent, or request deletion of your data at any time at civicsummary.ai/privacy/manage
• Browser Settings: You can also manage or disable cookies directly through your browser settings at any time
• Preferences Page: You can review information about our cookie categories at civicsummary.ai/preferences

For more information on managing cookies, visit allaboutcookies.org.

7. Children's Privacy

CivicSummary is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. Users between the ages of 13 and 18 should review this policy with a parent or guardian before using the platform.

If you believe we have inadvertently collected personal information from a child under 13, please contact us immediately at privacy@civicsummary.ai and we will take prompt steps to delete such information from our systems.

8. Security Measures

We take the security of your personal information seriously and implement a range of technical and organizational measures, including:

• End-to-end encryption of data in transit (TLS) and at rest (AES-256)
• Role-based access controls limiting employee access to personal data
• Regular security audits and vulnerability assessments
• Multi-factor authentication options for user accounts
• Employee training on data security and privacy best practices
• Incident response procedures to address potential data breaches

9. International Data Transfers

CivicSummary is based in the United States, and your information is stored and processed in the U.S. If you access our service from outside the U.S., please be aware that your information may be transferred to, stored, and processed in the U.S. or other countries where our service providers operate, which may have different data protection standards than your home country.

By using CivicSummary from outside the United States, you consent to the transfer of your information to the U.S. in accordance with this Privacy Policy. Where required by applicable law, we implement appropriate safeguards for international data transfers, such as standard contractual clauses.

10. California Privacy Rights (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you, the sources of that information, and the purposes for which it is used
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions
• Right to Correct: You may request correction of inaccurate personal information we hold about you
• Right to Opt-Out of Sale or Sharing: We do not sell your personal information or share it for cross-context behavioral advertising. You may manage marketing cookies at any time via our cookie consent banner or Privacy Controls page
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights
• Sensitive Personal Information: We do not collect or use sensitive personal information beyond what is necessary to provide our services

To exercise your California privacy rights, contact us at privacy@civicsummary.ai or visit our Privacy Rights page. We will respond to verified requests within 45 days as required by California law. You may designate an authorized agent to submit a request on your behalf.

11. Users Outside the United States

If you are located in the European Economic Area (EEA), United Kingdom, or other regions with applicable data protection laws, you may have additional rights under regulations such as the General Data Protection Regulation (GDPR), including:

• The right to access, rectify, or erase your personal data
• The right to restrict or object to processing
• The right to data portability
• The right to withdraw consent at any time where processing is based on consent
• The right to lodge a complaint with your local data protection authority

Our legal bases for processing your personal data include performance of a contract, compliance with legal obligations, legitimate interests, and consent where applicable. For inquiries regarding international data rights, please contact us at privacy@civicsummary.ai.

12. Third-Party Links and Services

Our platform may contain links to third-party websites, government portals, or external resources. This Privacy Policy applies only to CivicSummary. We are not responsible for the privacy practices or content of third-party sites and encourage you to review their privacy policies before providing any personal information.

13. Changes to This Policy

We may update this Privacy Policy as our services evolve or as required by law. For material changes, we will provide at least 14 days' advance notice via email to your registered address and/or a prominent notice on the platform before the changes take effect. Non-material changes will be reflected by updating the “Last Updated” date at the top of this policy.

Prior versions of this Privacy Policy are available upon request by contacting privacy@civicsummary.ai. Your continued use of CivicSummary after changes take effect constitutes your acceptance of the updated policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We are committed to resolving privacy concerns promptly and transparently. If you are not satisfied with our response, you may have the right to lodge a complaint with your applicable data protection authority.