Privacy policy

Plain words about a serious subject.

Effective September 10, 2026 · version 1.2

Your supporter information, in plain language

If you're a supporter writing a letter or signing a petition, here is exactly what we collect and why, as required by Canada's federal private-sector privacy law.

Why we collect it (purpose): To compose the letter or petition you write and deliver it to your elected representative on behalf of the organization running the campaign, and, if you ask, to email you a copy.
What we collect (the specific information): Your name, email, mailing address and postal code; the content of your letter and any note or answer you add; and, as evidence of your consent, a timestamp and your IP address in hashed (scrambled) form. Nothing more.
How we collect it (manner): Only what you type yourself into a campaign or petition form. No hidden tracking, no advertising profiles, no data bought from anyone.
Newsletters: A standalone newsletter form requires a one-time mailbox confirmation before subscription. Individual open/click measurement is off by default; if the organization enables it, the consent wording says so, the events may be linked to its CRM record, and they are deleted after the organization’s selected 30-to-180-day period.
Who sees it (use & disclosure to third parties): The organization running the campaign (in its dashboard); your elected representative's office, to whom the letter is delivered in your name; and a small number of vetted service providers that each carry out one step, the email or postal service that sends your letter, the AI providers that help draft it and screen it for unsafe content (they never receive your name, email or address), bot-protection, and representative-lookup by postal code, each getting only what its role needs. Some are located outside Québec or outside Canada. The full list, with each provider's role and location, is below.
What the AI is given: To draft your letter, the AI receives only the campaign's talking points and the free-form note or answers you write, never your name, email address or mailing address from the form fields, which are kept out of the AI entirely. The automated check that screens your finished letter for unsafe content also removes your name, email and address before it runs. However, anything you type into a free-form field (your note, or a campaign's open questions) IS sent to the AI word-for-word and becomes part of your letter, so please do not enter personal information there (for example a phone number, health details, or anyone else's private information). This AI processing is routed through Spur Compute, a Canadian AI infrastructure provider; Spur never receives your name, email or address.
How your name, email and address are used: Your name and mailing address appear on the letter delivered to your representative, and in the email version too, on purpose: it lets your message read as a genuine letter from a real constituent, which is what makes advocacy credible and trusted. When your letter goes by email, it is sent from PoliPost's email system, but the reply-to address is the email you entered, so the representative's office can reply to you directly. The organization's campaign managers can see your name and email, and, for letters they review before sending, your city or province to confirm you're a constituent, but they do not see your full mailing address. When you choose paper mail or real-pen delivery, your mailing address is shared with our print-and-mail providers, PostGrid (print & mail) and Scribeless (real-pen handwriting), so they can address and send the physical letter.
What this means for you (foreseeable consequences): Your representative's office and the campaign organization will know who you are, where you live and what you asked for; your letter becomes part of the correspondence record sent in your name; the office may reply to you directly.
Your consent: Consent must be valid and expressly given: nothing is sent until you check a box confirming the words are yours and that you want them delivered in your name. You can withdraw consent, or ask to see, correct or delete your information, at any time, write to privacy@polipost.ca.

Our commitment

PoliPost Canada exists to help people write to their own elected representatives, in their own name. That only works if the people who use it trust us with a small amount of personal information, so we treat privacy as a design requirement, not a legal afterthought. This policy follows the ten fair-information principles of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and we also honour Québec's Law 25 for residents of Québec.

1 · Accountability

PoliPost Canada Inc., which operates PoliPost Canada, is responsible for the personal information under its control. Our appointed Privacy Officer is Avery Campbell, who can be reached at privacy@polipost.ca.

Email privacy@polipost.ca with any question, concern or complaint about your privacy, or to ask what personal information PoliPost holds about you, to obtain access to it, to have it corrected or amended, or to request its deletion. We respond within 30 days. Organizations that run campaigns on PoliPost Canada are independently responsible for how they use campaign results.

2 · Identifying purposes

We collect personal information mainly to compose and deliver a letter you have written to an elected official, and (if you ask) to email you a copy. When the campaign you support chooses to turn them on, we may also send you an optional one-time reminder to finish a letter you started. If you separately choose the optional organization-updates box, your name and email are added to that organization's contact list/CRM so it can send occasional updates about the campaign or petition and related advocacy work. A standalone newsletter signup takes effect when you submit the form with its consent box checked. Every such message carries an unsubscribe link, and we honour it. Identifiable newsletter open/click measurement is off by default; if an organization enables it, the signup wording says so before consent and the events are retained for that organization's selected 30-to-180-day period. We do not build advertising profiles, and we never sell personal information.

3 · Consent

Your letter is only sent after you check a box confirming the words are yours and that you want them delivered in your name. Joining the organization's contact list is a different, optional checkbox that starts unchecked and is never required to write a letter or sign a petition. Standalone newsletter forms always show and require the full disclosure. Your choice on the form is the consent; no separate confirmation email is required. Ticking a box never overrides an earlier unsubscribe; a newsletter form instead emails a link to confirm the re-subscription. We record the exact request, organization identity, optional profile fields and their purpose, timestamp, language, tracking disclosure (when enabled), and your IP address in hashed form so the organization can demonstrate the choice you made. Organizations agree to this policy when they create an account.

4 · Limiting collection

We ask supporters for the minimum a legislator's office needs to take a constituent seriously: name, contact email, and mailing address (offices verify constituency). A campaign may also add its own question or note to its letter, sometimes required, sometimes optional, and either way it is clearly labelled. Newsletter forms name every optional profile field and why it will be used. We do not collect advertising identifiers or fingerprint people. Recipient-level newsletter opens/clicks are collected only when the sponsoring organization explicitly enables the disclosed setting; aggregate delivery statistics may still be supplied by its email provider.

5 · Limiting use, disclosure and retention

Personal details are used to deliver your letter and shown to the sponsoring organization in their dashboard. Beyond that, they are disclosed to the recipient's office and only to the vetted service providers that carry out a specific step, each receiving just what its role needs: the email provider that sends your letter or its copy (Mailgun in the US by default, or a configured SMTP server); the postal providers that print and mail a paper letter (PostGrid, Lob or Scribeless); address services that prefill or verify what you enter (Zippopotam.us receives only the coarse FSA/ZIP prefix, while PostGrid receives the entered address components when its verification service is enabled); the AI providers used for supporter letter drafting, which receive the campaign's talking points and your optional note but never your name, email or address, the note goes to them word for word, so leave out anything you would not want them to read; Cloudflare Turnstile, which receives your IP address for bot protection on public forms; the postal-code lookup services that find your representatives (Open North, Geocodio); and, only on campaigns that enable it, Didit for optional government photo-ID verification. The full list, with each provider's role, location and privacy policy when one is published, is below. Some of these providers are located outside Québec, and some outside Canada; information handled there is subject to the laws of that place. We handle any transfer of personal information outside Québec in accordance with Québec's Law 25. Letter records are automatically de-identified after 730 days.

A · Cookies and similar technologies

We run an essentials-only cookie setup: one session cookie for security and your in-progress letter, one small cookie remembering your consent choice, and, only if you opt in, device display preferences. Informational pages set no cookies at all, and optional technologies are off by default. Full inventory, durations and your withdrawal controls: Cookie policy.

6 · Accuracy

You see and can edit every word of your letter, your name and your address before anything is sent. Letters are immutable after consent: campaign teams may approve or reject a queued letter, but can never alter it. The AI that helps draft your letter makes no decision about you, it only suggests wording. Separately, an automated (AI) content-safety check may flag a finished letter for human review if it appears malicious, violent or inappropriate; a flag is not a rejection, the organization you wrote for, not the AI, decides whether to accept or reject a flagged letter, and a person always makes that final decision. Nothing is sent until you have approved every word.

7 · Safeguards

Names, emails, addresses and letter bodies are encrypted at rest with keys held outside the web root. Passwords are hashed with modern algorithms and are never visible to anyone, including us. Administrative access is role-restricted, supports two-factor authentication, and is logged. The values we use to look up records are stored in a scrambled form so they can't simply be looked up, even our own database cannot be casually browsed for identities. If your personal information is ever lost, stolen or accessed without authorization, and that incident creates a real risk of serious harm to you, we will notify you and the regulators, the Privacy Commissioner of Canada and, in Québec, the Commission d'accès à l'information, when the law requires it. We keep a register of every confidentiality incident.

8 · Openness

This page is the policy, written to be read. Each organization can see, in its dashboard, the consent records tied to its own letters. Our platform security headers and retention settings are operator-level configuration applied across the whole installation, rather than something shown per organization.

9 · Individual access

Every copy-email contains a private link where you can view the letters tied to your email address. A sent letter is kept as a record of correspondence; personal details are de-identified automatically at the end of the retention window, and we will de-identify them sooner on request. You can also ask to receive the computerized personal information you gave us in a structured, commonly used technological format, or to have it sent to a person or organization authorized by law to collect it (Québec's Law 25 right to portability, we honour it for everyone). Write to privacy@polipost.ca to view or correct your information, or to withdraw consent.

10 · Challenging compliance

If you believe we have not lived up to this policy, contact privacy@polipost.ca, we respond within 30 days. If you are unsatisfied, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Québec, to the Commission d'accès à l'information (cai.gouv.qc.ca).

B · Service providers and subprocessors (the "Subprocessor list")

We rely on a small number of vetted third parties, each receiving only what its job requires. For supporter letter drafting, AI providers do not receive your name, email or address; separate organization-enabled CRM AI features can process the CRM data described in the provider rows below. The complete list shows each provider's purpose, location, and privacy-policy link when one is published. Like any business, we also use standard back-office tools to run PoliPost itself, accounting and bookkeeping software (such as Intuit QuickBooks, located in the United States), tax filing, and professional advisors bound by confidentiality. These receive only client-organization billing records (organization name, business contact, billing address, plan, amounts and sales tax), never supporters' letters or personal details.

Provider	Purpose & data shared	Location	Privacy
Augure AI (AI processing)	Canadian sovereign AI provider through which PoliPost's generative AI runs as the primary engine, letter drafting, the public demo, matching new records to watch topics, and signed-in deep research, which receives the user's research question and relevance-selected public government records to rank evidence, synthesize a cited briefing and check the result. For organizations that explicitly enable CRM AI, it may also receive the CRM dossier assembled for a requested summary (for example contact names and roles, notes, interactions, asks, and policy-file context), the forwarded email's subject and body text when Email-to-CRM suggestions are requested, and the full business-card image when the CRM is asked to read one, that image may visibly contain a contact's name, title, organization, email, phone number and mailing address. When a platform administrator explicitly requests a synthetic demo account, it receives the lead name, free-form lead brief and optional sales objective. When an authorized newsletter user requests an AI-designed draft, it receives the article text and content/design instructions that user submits, but no newsletter audience members, CRM contact records, sending-provider credentials or sending-account data. Letter drafting never receives the supporter's name, email or address.	Canada	Policy
Spur Compute (backup AI engine)	Canadian AI infrastructure provider used as the backup engine only while its key is deliberately configured and only when the primary engine is unavailable: an eligible AI request is then retried once with this provider. It receives the same task inputs as the original request, research questions and public government records, the CRM dossier, forwarded email text or business-card image an organization's CRM AI request includes, the article text of an AI-designed newsletter draft (never newsletter audience members), or images for vision tasks. Structured supporter name, email and address fields are excluded from letter-drafting requests; free-form notes are sent as entered. Sovereign accounts keep their separate Augure-only generative-AI route.	Canada	Policy
OpenRouter (semantic embeddings)	Creates numeric semantic-search embeddings, the one disclosed AI exception outside Canada. Receives public government passages and the research/search text entered by a signed-in user, plus the platform site URL and name as attribution headers. PoliPost does not add the account profile, billing details, CRM/supporter dossiers, supporter names, email addresses or street addresses to these requests.	United States	Policy
Mailgun	Default outbound email provider. Sends account notifications, the optional copy of your letter, any letter delivered by email, and, only when the campaign turns them on, the optional one-time "finish your letter" reminder and opt-in campaign updates. An organization may also connect its own Mailgun account for newsletters; identifiable open/click tracking is disabled by default and enabled only with the disclosed recipient-engagement setting. Receives the recipient email address, name and message content. When Email-to-CRM receiving is configured, Mailgun also receives, parses and forwards inbound CRM email, including sender and recipient headers, subject, body and attachments, to PoliPost's signed webhook, even if another provider handles outbound email.	United States	Policy
Stripe	Subscription billing and payments. Card numbers are entered on Stripe and are never seen or stored by us.	United States / Ireland	Policy
Didit	Optional ID verification, only on campaigns that turn it on. Didit checks a government photo ID and selfie and returns the verified first and last name. PoliPost keeps only that name; the document, selfie and ID number are never stored. As soon as the check reaches a final result, PoliPost requests deletion of the Didit session (including the ID image and selfie); if Didit is temporarily unavailable, the encrypted deletion job is retained and retried until deletion is confirmed.	European Union / United States	Policy
PostGrid	Prints and mails physical letters when print mail is enabled. Separately, its address autocomplete and verification API may be used whenever a PostGrid verification key is configured, even if PostGrid is not selected for printing. Print mail shares the recipient's and sender's name and mailing address; autocomplete/verification shares the address components entered by the user (street, unit if supplied, city, province/state, postal/ZIP code and country), but not their email or letter content.	Canada / United States	Policy
Zippopotam.us	Built-in postal-code-to-city/province autofill on supporter forms and administrative address-entry forms. Receives only the first three characters of a Canadian postal code (the FSA) or the first five digits of a US ZIP code; browser-side lookups also expose the visitor's or administrator's IP address and ordinary request metadata. It does not receive a street address, name, email or letter content.	Not published (public API; treat as outside Canada)	n/a
Cloudflare Turnstile	Bot and abuse protection on public forms when enabled. Receives the visitor's IP address and a challenge token, no letter content.	United States	Policy
Cloudflare, DNS & network protection	DNS, content delivery and DDoS/WAF protection in front of the site. Inbound web traffic is proxied through Cloudflare to filter malicious requests and absorb attacks. It sees visitor IP addresses and request metadata (such as the URL, headers and user agent) and terminates TLS; page content only passes through in transit and is not stored, and no database records or supporter content are shared.	United States	Policy
Sentry	Error monitoring and application diagnostics, when configured. Receives exception details, stack traces, file names and line numbers, request metadata such as URL and user agent, and operational context needed to debug failures. PoliPost configures Sentry to avoid request bodies and default personal data, and disables trace propagation to third parties.	European Union (Germany)	Policy
Open North, Represent API	Finds your federal and provincial representatives from a postal code. Receives only the postal code.	Canada (Montréal)	Policy
FullHost, hosting	Runs the application and stores the encrypted database. FullHost is a Canadian company; our server(s) are located in Vancouver, BC.	Canada (Vancouver, BC)	Policy

Annex A, How long we keep your information, and how it's anonymized

In plain language: exactly how long each kind of information is kept, and how it's removed. "De-identified" means the record can no longer be connected back to you, both the details that identify you and the scrambled values that could re-link them are erased.

Your letter: Kept as a record of a letter sent in your name. PoliPost's operator sets how long the personal details stay before they're removed automatically; if no limit is set, they remain as a correspondence record until you ask us to remove them, which we always honour. Current setting: personal details are removed automatically 730 days after sending. When the details are removed (automatically at the end of the retention window, or sooner at your request), a daily process erases the subject, the letter body, your name, email and mailing address, your personal note, the recipient details, and the scrambled look-up values that could re-link the record to you. Only anonymous counts and analytics remain. The letter record itself is never deleted, only stripped of anything identifying.
Petition signatures: De-identified on the same schedule: your name, email, postal code, city, province, comment and hashed IP are erased, and the link between the record and your email is permanently broken.
Form recovery drafts: For long dashboard forms, a temporary copy is kept in your browser local storage so work can resume after an interruption. This device copy is plaintext on your device, excludes passwords and files, and expires after 7 days. A second copy, encrypted at rest and restricted to your organization and account, is kept on the server for at most 7 days. Successful submission or discarding the draft removes the copy; explicit sign-out also clears copies from that device.
Newsletter engagement: Identifiable open/click measurement is off by default. When an organization enables it after disclosure, individual events, recipient snapshots, and derived CRM markers are kept for the organization’s selected 30, 60, 90, or 180 days, then removed in bounded batches. Turning the setting off immediately queues their progressive removal, including any language preference inferred from them.
Operational logs: Kept for the periods configured below (current values, shown live from the operator's settings), then deleted: security / audit log, 730 days; "known device" records behind new-device sign-in alerts, 365 days; abandoned-draft reminders, 30 days; encrypted client-form recovery drafts, 7 days; email-delivery log (encrypted recipient, subject and body), 90 days; provider (webhook) logs, 90 days; system / cron logs, 30 days; anti-abuse rate counters, about 1 day; postal-code lookup cache, 180 days.
Past press-release generations: The public tool has been retired. Previously stored entries and releases remain encrypted at rest, with only a hashed IP, never the raw address. Their configured retention period remains 30 days.
Signed-in deep research: Ad-hoc research questions and generated briefings are encrypted at rest and deleted automatically after 30 days. They are available to their author or, where a module is designed as a shared workspace, only to authorized members of the same organization. To diagnose an incident, protect the service, or provide support, an authorized platform administrator may open the exact question and report only after re-entering their password and recording a purpose; the access and every diagnostic replay are logged. A replay creates a new client-hidden record and never changes the original. Encrypted diagnostic copies are kept for no more than 30 days. Encrypted operator-audit metadata, including the recorded purpose, but never the questions, reports, API keys, or raw provider bodies, is kept for no more than 365 days. When a user creates a scheduled search, its encrypted definition and question remain until its owner or an organization administrator deletes it, or until the account or member is removed. Organization administrators can view, edit, pause and delete team scheduled searches. The shared bilingual corpus of public government records used as source material is not personal information and remains in the research index.
While we hold it: Names, emails, addresses and letter bodies are encrypted at rest, with keys kept outside the web server. The values we use to find a record (such as your email) are stored only as a one-way scrambled (hashed) index, so the database cannot be browsed for identities.
Your controls: At any time you can ask to see, correct or delete your information, or withdraw consent, email privacy@polipost.ca.

We collect only what a letter needs: the supporter's name, contact details, address and the letter itself. Names, contact details, addresses and letter bodies are encrypted at rest. Sent letters form a permanent record. Personal details are de-identified automatically at the end of the retention window.