Privacy Policy

1. Introduction

This Privacy Policy explains how Copygen Inc. ("Civon," "we," "us," or "our") collects, uses, protects, and shares your personal information when you use the Civon platform at civon.org and any related services (the "Platform").

Civon is a civic mobilization and fundraising platform that enables organizations to create petitions, manage campaigns, collect donations, and communicate with their supporters. By using the Platform, you agree to the practices described in this Privacy Policy.

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on the Platform or by sending you an email. Continued use of the Platform after changes constitutes acceptance.

2. Who We Are

The data controller for your personal information is:

3. Information We Collect

We collect the following categories of personal information:

3.1 Account Data

When you create an account, we collect your name, email address, and password. If you sign in through Google or another third-party provider, we receive your name, email, and profile picture from that provider.

3.2 Organization Data

If you register an organization, we collect the organization name, description, contact details, logo, and any other information you provide about your organization.

3.3 Campaign and Petition Data

When you create or sign a petition, make a donation, or interact with a campaign, we collect the content you provide, including petition text, signatures, comments, and donation amounts.

3.4 Payment Data

When you make a donation or payment, your payment information (credit card number, billing address) is collected and processed directly by our payment processor, Stripe. We do not store complete credit card numbers on our servers. We receive transaction confirmation details such as the amount, date, and last four digits of your card.

3.5 Usage and Analytics Data

We automatically collect information about how you use the Platform, including your IP address, device type, browser, operating system, pages visited, time spent, referring URLs, and interactions with Platform features.

3.6 Cookies

We use cookies and similar technologies to recognize your browser, remember your preferences, analyze traffic, and improve the Platform. You can manage cookie preferences through your browser settings. Essential cookies required for the Platform to function cannot be disabled.

4. How We Use Your Information

We use your personal information for the following purposes:

• Providing the Platform: Creating and managing your account, enabling you to create and sign petitions, process donations, and manage campaigns.
• Processing payments: Facilitating donation transactions through our payment processor.
• Communications: Sending you transactional emails (e.g., petition confirmations, donation receipts), platform updates, and, with your consent, promotional communications.
• Analytics and improvement: Understanding how the Platform is used, diagnosing technical issues, and improving our services.
• Security: Detecting and preventing fraud, abuse, and unauthorized access.
• Legal compliance: Meeting our legal and regulatory obligations.

5. Legal Basis for Processing

We process your personal information based on the following legal grounds:

• Contract performance: Processing necessary to provide our services to you, including account management, petition functionality, and payment processing.
• Consent: Where you have given explicit consent, such as for marketing emails or optional cookies.
• Legitimate interest: Processing necessary for our legitimate business interests, such as analytics, fraud prevention, and platform improvement, where these interests are not overridden by your rights.
• Legal obligation: Processing required to comply with applicable laws, such as tax regulations and law enforcement requests.

6. How We Share Your Information

We do not sell your personal information. We share your data only in the following circumstances:

• Payment processing: Stripe processes your payment information to complete donation transactions.
• Email delivery: Resend delivers transactional and campaign emails on our behalf.
• Hosting and infrastructure: Vercel (hosting) and Supabase (database) provide the technical infrastructure for the Platform.
• Analytics: We may use analytics tools to understand Platform usage in aggregate form.
• Campaign visibility: When you sign a petition, your name may be visible to the campaign organizer and, depending on campaign settings, to the public. You can choose to sign anonymously where this option is available.
• Legal requirements: We may disclose information when required by law, court order, or government request, or to protect the rights, safety, or property of Civon, our users, or the public.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our services. Specifically:

• Account data: Retained while your account is active. Deleted upon account deletion request, subject to legal retention requirements.
• Payment and transaction data: Retained for the periods required by tax and commercial regulations (generally six years).
• Usage data: Retained for up to 24 months, then anonymized or deleted.
• Campaign content: Petitions and campaign data remain on the Platform as long as the campaign is active. After deletion, data may be retained in backups for a limited period.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

For all users:

• Access: Request a copy of the personal information we hold about you.
• Rectification: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information, subject to legal retention requirements.
• Objection: Object to processing of your information for certain purposes.

For EEA/UK residents (GDPR):

• Portability: Request your data in a structured, machine-readable format.
• Restriction: Request restriction of processing in certain circumstances.
• Withdraw consent: Withdraw consent at any time where processing is based on consent.
• Lodge a complaint: File a complaint with your local data protection authority.

For California residents (CCPA):

• Right to know: Request details about the categories and specific pieces of personal information collected about you.
• Right to delete: Request deletion of your personal information.
• Non-discrimination: You will not be discriminated against for exercising your privacy rights.
• Do Not Sell: We do not sell personal information. No opt-out is required.

To exercise any of these rights, contact us at hello@copygen.ai. We will respond within 30 days (or as required by applicable law).

9. International Data Transfers

Civon is operated from the United States. If you are accessing the Platform from outside the US, your information will be transferred to and processed in the United States. By using the Platform, you consent to this transfer. Where required by law (e.g., GDPR), we implement appropriate safeguards for international data transfers.

10. Children's Privacy

Civon is not intended for users under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected information from a child under 16, we will delete it promptly. If you believe a child under 16 has provided us with personal information, please contact us at hello@copygen.ai.

11. Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These include encryption of data in transit (TLS), secure authentication mechanisms, and regular security reviews. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

12. Third-Party Links

The Platform may contain links to third-party websites or services that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

13. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the State of Delaware, United States, without regard to its conflict of law provisions. This does not affect your statutory rights under applicable data protection laws, including the GDPR.

14. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, contact us at: