Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect:

• Full name
• Email address
• Phone number (optional)
• State and district
• Office sought
• Party affiliation

Assessment Data

If you complete a Campaign Readiness Assessment, we collect your responses including office sought, state, election date, prior experience, available resources, key issues, and motivation for running.

Campaign Data

As you use the Platform, we store:

• Messaging frameworks you create or generate
• Generated documents and templates
• AI Campaign Manager chatbot conversations
• Campaign plans, budgets, and timelines
• Print material designs and order history

Payment Information

Payment processing is handled by Stripe. We do not store your credit card numbers, bank account details, or other sensitive payment information on our servers. Stripe may collect and store payment information in accordance with their own privacy policy.

Usage Data

We automatically collect:

• Pages visited and features used
• Template generation history
• Session duration and frequency
• Device type, browser type, and operating system
• IP address (used for security and analytics)

2. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Platform
• Generate personalized campaign content, templates, and viability reports
• Power the AI Campaign Manager with context about your specific campaign
• Process payments and fulfill print material orders
• Send account-related communications (welcome emails, subscription confirmations, security alerts)
• Improve our AI models using anonymized, aggregated data only — never your identifiable campaign data
• Analyze usage patterns to improve the user experience and develop new features
• Detect and prevent fraud, abuse, and security threats
• Comply with legal obligations

3. Information Sharing

We share information with the following third parties, solely for the purposes described:

Law Enforcement: We will disclose information to law enforcement agencies only in response to valid legal process (subpoena, court order, or similar legal requirement). We will notify you of such requests unless legally prohibited from doing so.

4. Political Data Protection

Your messaging strategy, donor information, voter contact data, campaign plans, opposition research, and strategic decisions are treated as confidential business information. We implement the following protections:

• Strict data segregation: Every campaign account is completely isolated. No campaign's data is ever accessible to or visible to any other campaign account.
• No cross-campaign analytics: We do not analyze patterns across competing campaigns or provide competitive intelligence derived from other users' data.
• Employee access controls: Access to campaign data is restricted to authorized personnel on a need-to-know basis for technical support only.
• No political bias: Our data practices are identical regardless of your party affiliation, political ideology, or the office you are seeking.

5. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS (Transport Layer Security)
• Encryption at rest: Stored data is encrypted using industry-standard encryption
• Supabase hosting: Our database is hosted on Supabase with row-level security (RLS) ensuring users can only access their own data
• Regular security reviews: We conduct regular reviews of our security practices and infrastructure
• Limited employee access: Only authorized personnel have access to production data, and all access is logged

While we take reasonable precautions to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

• Active accounts: Your data is retained for as long as your account remains active and your subscription is current.
• After cancellation: You have a 30-day window to export your campaign data after cancelling your subscription. After 30 days, your campaign data is permanently deleted.
• Assessment data: Campaign readiness assessment data is retained for up to 12 months to enable re-engagement and allow you to retake the assessment with historical context.
• Anonymized analytics: Aggregated, anonymized usage data (containing no personally identifiable information) may be retained indefinitely for product improvement.
• Legal requirements: We may retain certain data longer if required by law or to resolve disputes.

7. Your Rights

You have the right to:

• Access your data: Request a copy of the personal information we hold about you
• Export your data: Download your campaign data in a portable format at any time through your account settings
• Delete your account and data: Request permanent deletion of your account and all associated data
• Opt out of marketing emails: Unsubscribe from marketing communications at any time (transactional emails related to your account will continue)
• Data portability: Receive your data in a structured, commonly-used format

California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information held by us
• Right to opt out of the sale of personal information (we do not sell personal information)
• Right to non-discrimination for exercising your CCPA rights

To exercise any of these rights, contact us at contact@onecampaign.ai.

8. Cookies

We use a limited number of cookies to operate the Platform:

• Essential cookies: Required for authentication, session management, and security. These cannot be disabled.
• Analytics cookies: We use Vercel Analytics to understand how the Platform is used. This data is aggregated and does not identify individual users.

We do not use third-party advertising cookies or cross-site tracking cookies. For more details, see our Cookie Policy.

9. Children

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' notice via email or through a prominent notice on the Platform. The "Last Updated" date at the top of this page indicates when the policy was most recently revised.

Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

11. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us: