Privacy Policy

1. Information We Collect

A. Information You Provide to Us Directly

• Account Information: Name, email address, password, and organization affiliation.
• Account Setup Information: When you set up your account, the information you give us during setup, such as your phone number, employer and occupation, address and ZIP code, the issues you care about, the candidates and organizations you choose to follow, and, if you raise money, your fundraising role and whether you are a registered lobbyist.
• Organization Verification Information: If you set up an organization to receive donations, we collect what our payment processor needs to verify it and the people who control or own it: the organization's legal name, tax identification number, address, committee or registration identifiers, website, business description, and expected donation activity, and, for its authorized representative and each person who owns 25% or more, their name, title, contact details, address, date of birth, and Social Security number. Social Security numbers are encrypted, used only to verify identity with our payment processor, and never stored in saved setup drafts. You may instead ask an owner to provide their own details through a secure, single-use link we email to them.
• Regulated Financial & Donor Data (Category 1): When you make a donation, we collect billing details, employer, occupation, and donor attestations (e.g., U.S. citizenship, own-funds certification) as required by federal (FEC) and state campaign finance laws.
• User-Generated Content: Information you post on feeds, petitions, surveys, and chat forums.
• Contact, Voter, Donor, and Organizing Data: Organizations may upload or connect contact lists, voter-file data, donor history, volunteer records, outreach preferences, and related organizing data. In those cases, the organization determines why the data is used and Advotecate generally processes it on the organization's behalf. Some voter, election, representative, and campaign-finance information may also come from public records, licensed data providers, or organization integrations.
• Communications and Support: Messages, email and SMS preferences, call or message metadata, support requests, and responses you provide through forms, petitions, events, or outreach campaigns.

B. Information We Collect Automatically

• Device and Usage Data: We automatically collect your IP address, browser type, operating system, referring URLs, and user agent. We log IP addresses and user agents specifically for attestation audit trails.
• Product Analytics: Event names, session identifiers, organization context, timestamps, page URLs, referrers, and limited event properties. We use this information to operate, secure, and understand use of the Service.
• Tracking Technologies: We use cookies, web beacons, local storage, and similar technologies to maintain sessions, remember preferences, analyze product use, improve performance, and prevent abuse. Where analytics, advertising, error-monitoring, or session-replay tools are enabled, we provide any notice and choices required by applicable law and configure those tools to limit the personal information they capture.
• Setup Progress: While you set up your account or organization, we save your progress so you can leave and pick up where you left off. This includes which steps you have viewed, completed, or skipped, when, how long each step took, and the last step you reached before leaving.
• Agreement and Authorization Records: When you accept our terms or a payment processor's terms, accept our rates, certify that you are authorized to act for an organization, confirm who owns it, or authorize us to act for you (for example, to send an invitation on your behalf), we record the exact statement you agreed to and its version, the date and time, your IP address, an approximate location derived from that IP address, and your browser and device information, including a device identifier. We keep these records as proof of your agreement, and our compliance staff can review them.

2. How We Use Your Information

We use the collected data to:

• Provide, operate, and maintain the Advotecate platform.
• Process payments and donations securely.
• Generate deterministic compliance files (e.g., FEC Schedules) and automated receipts.
• Monitor for fraud, enforce contribution limits, and maintain payment security.
• Verify organizations and the people who control or own them with our payment processor, as financial regulations require.
• Keep proof of the agreements, certifications, and authorizations you give us, and demonstrate compliance with campaign-finance, payment, and consumer-protection laws.
• Save your setup progress so you can resume it, remind you about unfinished setup, and understand where people get stuck so we can improve it.
• Provide CRM, voter-file, list-building, canvassing, communications, analytics, and reporting features at an organization's direction.
• Provide AI-assisted features, including content assistance, search, classification, recommendations, embeddings, and natural-language data queries. Inputs and relevant account or organization context may be sent to our contracted AI and analytics providers to return the requested feature. We do not use customer content to train a general public model unless we provide separate notice and obtain any consent required by law.
• Communicate with you regarding account updates, support, and marketing (you may opt out of marketing communications at any time).

2A. SMS and Text Messaging

Advotecate operates its own SMS programs and also provides messaging tools to organizations. If you opt in to an Advotecate program, we use your number for the program described at the point of consent. If you provide a number to or interact with an organization, that organization controls its campaign and Advotecate processes messaging data on its behalf, subject to the organization's notices and applicable law.

• Collection: We collect your phone number only when you voluntarily provide it (e.g., via a waitlist form or account settings).
• Use: We use phone numbers to deliver requested or consented messages, maintain consent and suppression records, prevent unwanted contact, and support message delivery and compliance.
• No Sharing or Selling: We will not sell, rent, loan, trade, lease, or otherwise transfer your phone number or SMS opt-in data to any third party for marketing purposes. Phone numbers and message-routing data may be shared with Twilio, carriers, and other communications providers for delivery, security, and compliance, but not with unaffiliated third parties for their own marketing.
• Opt-Out: You may revoke consent at any time by replying STOP, QUIT, END, REVOKE, OPT OUT, CANCEL, or UNSUBSCRIBE, or by using any other reasonable method that clearly communicates your request. See Section 7 of our Terms of Service for full SMS program details including message frequency and data rates.

2B. Cookie Categories and Your Choices

We group the cookies and similar technologies used across advotecate.com, our donation pages, and the organizer dashboard into three categories. Your choice is stored once and applies to all three.

• Strictly necessary (always on): Sign-in and session cookies, security and fraud-prevention tokens, load balancing, and the record of the cookie choice itself. These cannot be switched off because the Service cannot operate without them.
• Analytics (optional): Product analytics that tell us which pages and flows are used and where people get stuck. Where enabled, this category covers Google Analytics 4 and Microsoft Clarity, including the setup steps you view, complete, or skip.
• Marketing (optional): Advertising measurement and retargeting tags that help us understand which campaigns bring organizers and supporters to Advotecate. Where enabled, this category covers the Meta Pixel, the LinkedIn Insight Tag, the TikTok Pixel, and the X Pixel.

No advertising or session-replay technology runs on a donation checkout page. Regardless of the choice you make, marketing and analytics tags are suppressed on the pages where a contribution is entered or completed.

Nothing in the optional categories loads before you choose. Google consent signals default to denied until you grant the relevant category. You may change your choice at any time by clearing the Advotecate cookie choice in your browser, and we will ask again the next time you visit. We will also ask again whenever we materially change the categories or the processing described here — and while we are asking, the optional categories stop loading, because your earlier choice was made about different processing.

Saving your setup progress on your account, and the step records we keep so you can resume and receive reminders, are part of operating the Service and are not governed by the optional categories. Sending those step events to Google Analytics 4 is, and happens only if you allow analytics.

Your choice covers advotecate.com, Advotecate donation pages, and the organizer dashboard. It governs the technologies listed above and the additional attribution detail described in the next section; it does not govern strictly necessary cookies, which cannot be switched off.

2C. Referral and Campaign Attribution

When you arrive at Advotecate we record how you got here, so we can understand which outreach works and report accurately to the organizations we serve. How much we retain for this purpose depends on the analytics choice described above.

If you have not allowed analytics, we keep only a single classification of how you arrived — for example "email", "paid ad", "organic search", or "direct". The campaign parameters, advertising click identifiers, referring site, and landing page that classification was derived from are used to produce it and are then discarded. They are never written to a cookie your browser keeps, and never stored against your account.

If you have allowed analytics, we additionally retain:

• Campaign parameters present in the link you followed (utm_source, utm_medium, utm_campaign, utm_content, utm_term).
• Advertising click identifiers present in the link (Google, Meta, LinkedIn, and TikTok click ids).
• The domain name of the site that referred you — not the full referring address.
• The general shape of the page you landed on — for example "/org/:id/event" — never the specific address.

In every case we deliberately do not retain the rest of the address you arrived on, and we never retain a page address that identifies a specific person, invitation, or shared item, because such links can contain verification tokens or other personal information. We keep both your first visit and your most recent visit; the first is never overwritten. If you later create an account, this record is associated with it so we can attribute the signup to the outreach that produced it. It is not used to build an advertising profile of you, and it is not sold.

Recording the arrival classification itself, and the fact that a visit occurred, is not part of the optional categories above: we rely on it to operate and measure the Service and to report to the organizations on whose behalf we process, and it identifies a channel rather than a person. The optional analytics choice governs the additional detail listed in this section.

3. How We Share Your Information

We do not exchange personal information for money. Some privacy laws also define "sale" or "sharing" to include disclosures for cross-context behavioral advertising even when no money changes hands. Where we use such advertising technologies and the law applies, you may opt out by contacting [email protected] or through any privacy choice mechanism we make available in the applicable product. We honor legally recognized browser-based opt-out preference signals where required.

We only share your information with trusted third-party service providers necessary to operate our business:

• Payment Processors: We use Moov Financial for PCI-DSS compliant tokenized card processing. We do not store full credit card data on Advotecate servers. For organizations that receive donations, we share the organization verification information described in Section 1 with Moov so it can verify the organization and its representative and owners, and Moov records your acceptance of its terms.
• Bank Account Linking: If you connect a bank account through Plaid, you sign in to your bank through Plaid, and Plaid handles your bank credentials under the Plaid End User Privacy Policy. We receive only what is needed to send payouts, such as the account holder name, account type, and the last four digits of the account, and we never receive your bank login.
• Communications: We share necessary routing data with communications providers such as Twilio, Mailgun, Amazon SES, and SendGrid to facilitate SMS, phone, and email delivery.
• Chat Providers: We utilize Stream to power our internal chat functions. Chat data and interactions are stored on Stream's secure servers.
• Infrastructure, Analytics, and AI: We use providers for authentication, hosting, object storage, monitoring, analytics, maps, data warehousing, and AI-assisted features, including AWS, Databricks, Sentry, and mapping or cloud infrastructure providers. They process information under contract to provide their services to us or to an organization using Advotecate.
• Organizations/Campaigns: If you interact with or donate to an organization on our platform, that organization receives your donor data to fulfill their legal reporting requirements.
• Legal Compliance: We may disclose your information if required by law, subpoena, or to protect the rights, property, and safety of Advotecate, our users, or the public.

4. Data Retention and Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit where appropriate. No system is completely secure. Retention depends on the data, purpose, organization instructions, legal obligations, dispute or fraud-prevention needs, and configured retention periods. Account deletion requests ordinarily begin a 30-day grace period during which the request may be canceled. After that period, account-local data is deleted, anonymized, or de-identified according to the applicable workflow. Legal holds and campaign-finance, tax, payment, security, and other recordkeeping duties may require us or an organization to retain certain records longer. Regulated transaction facts may be preserved in anonymized or de-identified form.

4A. Retention of Consent and Attribution Records

Your cookie choice is stored in your browser for up to thirteen months and is then requested again. Arrival details are stored in your browser for up to ninety days — the full detail described in section 2C where you have allowed analytics, and the arrival classification alone where you have not. In the latter case the details that classification is derived from live in a short-lived cookie your browser scripts cannot read, are discarded as soon as the arrival is classified, and expire within ten minutes regardless. If you have an Advotecate account, we also keep a durable record of each consent choice you make — the category, whether it was granted, the policy version in force, and when — together with the attribution associated with your signup. Those account-side records are kept for the life of the account and then handled under the deletion workflow described above, except where we must retain proof of consent to demonstrate compliance. Agreement and authorization records (Section 1) and the identity verification details we shared with our payment processor are kept for as long as your account or organization exists and afterward for as long as campaign-finance, payment, tax, or anti-money-laundering rules require us to keep proof, even if you delete your account. Saved setup progress and setup step records are kept with your account and handled under the deletion workflow described above. To request access to, correction of, or deletion of your consent or attribution records, or to ask any question about them, contact us at [email protected].

5. Your Privacy Rights (CCPA / Texas DPA)

Depending on your state of residence (e.g., California, Texas), you may have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your personal data (subject to legal compliance exemptions, such as FEC data retention mandates).
• Opt-out of targeted advertising.
• Opt out of the sale of personal data.
• Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, where applicable.
• Obtain a portable copy of personal data you provided.
• Not be discriminated against for exercising a privacy right.
• Limit certain uses or disclosures of sensitive personal information, where applicable.

To exercise these rights, appeal a decision, or ask about an authorized agent request, please contact us at [email protected]. We may verify your identity and authority before completing a request. We will respond within the period required by applicable law and explain how to appeal a denial. Texas residents whose appeal is denied may submit a complaint to the Texas Attorney General. Rights and exceptions vary by jurisdiction and may differ when Advotecate processes data only on behalf of an organization; in that case, we may direct the request to that organization.

6. Children's Privacy

Accounts are limited to people who are at least 18 years old. The Service is not directed to children under 13, and we do not knowingly collect personal information directly from a child under 13. If we learn that an ineligible minor created an account or provided personal information directly, we will investigate and delete or restrict it as required by law, subject to security, legal-hold, and recordkeeping obligations. Contact us at [email protected] if you believe a child provided information to us.

7. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Effective Date."

8. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

• Email: [email protected]
• Advotecate, LLC

  225 Matlage Way

  PO Box 1173

  Sugar Land, TX 77487