Your Privacy Rights

Your Universal Rights

Regardless of where you live, all CivicSummary users have the following baseline rights:

1. Right to Access

You may request a copy of the personal information we hold about you, including:

• What categories of data we have collected
• Where that data came from
• How we are using it
• Who we have shared it with

2. Right to Correction

You may request that we correct any inaccurate or incomplete personal information we hold about you. For basic account information such as your name or email address, you can make corrections directly through your account dashboard at civicsummary.ai/account.

3. Right to Deletion

You may request that we delete your personal information. Upon a verified deletion request, we will:

• Delete or anonymize your personal data within 30 days
• Confirm completion of deletion to you in writing

4. Right to Data Portability

You may request a copy of your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON). This allows you to transfer your data to another service if you choose.

5. Right to Opt Out of Marketing Communications

You may unsubscribe from non-essential email communications at any time by:

• Clicking the unsubscribe link at the bottom of any marketing email
• Updating your notification preferences in your account dashboard
• Contacting us at privacy@civicsummary.ai

6. Right to Manage Cookie Preferences

You may control which optional cookies are active on your device at any time by:

• Using the cookie consent banner that appears at the bottom of the page on your first visit
• Clearing your browser cookies to reset and revisit your preferences
• Adjusting your browser settings to manage or block cookies
• Visiting our Privacy Preferences page for more information

For more detail on our cookie categories, see Section 6 of our Privacy Policy.

California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Right to Know — Categories and Specific Pieces

You may request:

• The categories of personal information we have collected about you
• The specific pieces of personal information we have collected about you
• The categories of sources from which the information was collected
• The business or commercial purposes for collecting it
• The categories of third parties with whom we share it

Right to Delete

As described above, California residents may request deletion of their personal information subject to certain legal exceptions.

Right to Correct

You may request correction of inaccurate personal information we maintain about you.

Right to Opt Out of Sale or Sharing

We do not sell your personal information. We do use marketing cookies that may involve sharing limited, non-identifying data with advertising partners. You may opt out of this at any time through our cookie consent banner.

Right to Limit Use of Sensitive Personal Information

We do not collect or use sensitive personal information (as defined under CPRA) beyond what is strictly necessary to provide our services.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA/CPRA rights. This means we will not:

• Deny you access to our services
• Charge you different prices or rates
• Provide a different level or quality of service
• Retaliate against you in any way

Authorized Agents

California residents may designate an authorized agent to submit privacy rights requests on their behalf. To use an authorized agent, please:

1. Provide written authorization signed by you
2. Have the agent contact us at privacy@civicsummary.ai with the signed authorization attached
3. Be prepared to verify your own identity directly with us

We will respond to verified California privacy requests within 45 days. If additional time is needed, we will notify you and may extend the response period by an additional 45 days as permitted by law.

EEA, UK, and International Users (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with applicable data protection laws, you have the following rights under the General Data Protection Regulation (GDPR) or equivalent legislation:

Right of Access (Article 15)

You may request confirmation of whether we process your personal data and, if so, access to that data along with information about how it is processed.

Right to Rectification (Article 16)

You may request correction of inaccurate personal data or completion of incomplete personal data without undue delay.

Right to Erasure / “Right to be Forgotten” (Article 17)

You may request deletion of your personal data where:

• The data is no longer necessary for the purpose it was collected
• You withdraw consent and no other legal basis applies
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Right to Restriction of Processing (Article 18)

You may request that we temporarily restrict how we use your data in certain circumstances, such as while a correction request is being resolved.

Right to Data Portability (Article 20)

You may receive your personal data in a structured, commonly used, machine-readable format and have the right to transmit that data to another controller where technically feasible.

Right to Object (Article 21)

You may object to the processing of your personal data where we rely on legitimate interests as our legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making (Article 22)

We do not currently make solely automated decisions that produce significant legal or similarly significant effects on users. If this changes, you will have the right to request human review of such decisions.

Right to Withdraw Consent

Where we rely on your consent as the legal basis for processing, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with your local data protection authority. For EEA residents, a list of national supervisory authorities is available at edpb.europa.eu. UK residents may contact the Information Commissioner's Office (ICO) at ico.org.uk.

Our Legal Bases for Processing

We will respond to verified GDPR requests within 30 days. In complex cases, we may extend this by an additional two months and will notify you accordingly.

How to Submit a Privacy Rights Request

To exercise any of the rights described on this page, you may:

• Email us: privacy@civicsummary.ai
• Use your account: civicsummary.ai/account (for account updates and deletions)

What to Include in Your Request

To help us process your request promptly, please include:

• Your full name and email address associated with your account
• The specific right you wish to exercise
• Any relevant details about your request

Identity Verification

To protect your privacy and security, we may need to verify your identity before fulfilling your request. We will use the information already associated with your account to do so and will not request more information than reasonably necessary.

Response Timeframes

We will always acknowledge receipt of your request within 5 business days.

Contact Us

If you have questions about your privacy rights or our data practices:

We are committed to resolving all privacy concerns promptly, transparently, and in good faith.