Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the Terms of Service between PoliPost Canada Inc. ("PoliPost", "we", operating from British Columbia) and the organization that opens an account ("you"). It explains, in plain language, how we handle the personal information you and your supporters put into the service, and our respective privacy responsibilities under Canadian law, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA), plus other applicable provincial privacy laws. If anything here conflicts with the Terms on a privacy matter, this DPA governs.

You are the organization that decides what supporter and contact information to collect and why, in privacy law, you are the one in control of that personal information. PoliPost is your service provider: we store and process that information only to run the features you use, and only on your instructions. We never sell it, rent it, or use it to build our own products. Our letter-drafting AI never receives your supporters' identities, but the CRM's AI features do work on the contact records you enter there (see sections 4 and 14).

"Personal Information": information about an identifiable individual (e.g., a supporter's name, email, address or postal code, the letter they wrote, a petition signature, a CRM contact record).

"Supporter Data": personal information about the people your organization engages (constituents, members, contacts, decision-makers).

"Service": the PoliPost platform.

"Subprocessor": a third party we use to help deliver the service.

"Privacy Laws": PIPEDA, BC PIPA, Québec's Act respecting the protection of personal information in the private sector (as updated by Law 25), and other Canadian privacy laws that apply to you or us.

"Security Incident": a breach of security safeguards affecting personal information.

We process: (a) account data (your team's names, emails, roles and login/security data); (b) Supporter Data your organization collects through letters, petitions, polls, the CRM, imports and integrations; and (c) usage and audit records. We process it only to: deliver the features you turn on, keep the service secure, provide support, meet legal obligations, and bill you. The categories and purposes track what the service visibly does, nothing more.

Important, the CRM and AI: the CRM includes AI features (such as the AI copilot and insights). Anything you enter in the CRM, including detailed contact information, notes and interaction history, is processed by those AI features to provide them. That processing is routed through Spur Compute (spuric.com), a Canadian AI infrastructure provider, as our AI subprocessor. One disclosed exception applies: numeric semantic-search embeddings are created via OpenRouter (United States) from public-government passages or user-entered search text only, no account profile or CRM/supporter dossier is added (see section 9). You decide what goes into the CRM (see section 14).

We act on your documented instructions, which are: your use of the service, your settings, and this DPA. If we believe an instruction would break a Privacy Law, we'll tell you. You confirm you have the authority and a lawful basis (including any required consent) to collect and put into the service the personal information you upload, and to instruct us to process it.

Everyone at PoliPost who can touch personal information is bound by confidentiality and works on a least-privilege, need-to-know basis. Administrative access is logged.

We use safeguards appropriate to the sensitivity of the information, including: encryption in transit (HTTPS/TLS, HSTS); encryption at rest of personal-information fields (names, emails and similar are stored encrypted, never in clear text); passwords stored only as salted bcrypt hashes and screened against known-breached passwords; optional two-factor authentication and passkeys; blind-index hashes so we can look a record up without exposing the underlying value; role-based access controls; audit logging; and new-device sign-in alerts. Canadian hosting (see "Where your data lives"). No system is perfectly secure, but we work to keep these measures current.

We use a small, vetted set of subprocessors, each receiving only what it needs for its task; our letter-drafting AI never receives a supporter's identity (the CRM's AI features, which you control, do process the CRM records you enter, see sections 4 and 14). The current list, each provider's role, the data it sees, its location, and a link to its privacy policy, is published in our Subprocessor list and forms part of this DPA. We remain responsible to you for our subprocessors. We'll give you advance notice (by email or in-app) before a new or replacement subprocessor starts handling your personal information; if you reasonably object on privacy grounds within 30 days of that notice, you may terminate the affected service and export your data, that is your only remedy for that change. If we add or change a subprocessor in a way that materially affects this DPA, including a material change to the published Subprocessor list incorporated above, we follow the "Changes" process below and notify you of it.

Your account and Supporter Data are hosted in Canada, on servers operated by FullHost in Vancouver, British Columbia. AI processing is routed through Canadian AI providers, Augure AI and Spur Compute, both operating in Canada, one as the primary engine and the other as the backup engine, used only when the primary is unavailable; the Subprocessor list identifies their current roles. Some disclosed subprocessors operate outside Canada, for example billing (Stripe), bot and network protection (Cloudflare), outbound email (Mailgun) and optional Didit identity verification. Disclosed exception for search: OpenRouter (United States) receives only public-government passages or user-entered search text to create numeric semantic-search embeddings; no account profile or CRM/supporter dossier is added. Personal information handled outside Canada is subject to that jurisdiction's laws; we handle cross-border transfers in line with PIPEDA. Each subprocessor is disclosed in the Subprocessor list.

Individuals have rights under Privacy Laws to access and correct their personal information, and to withdraw consent. You can view, export, correct, and delete your CRM records directly in the service; supporter letters and petition signatures are de-identified on the retention schedule (see section 12) rather than individually deleted. If an individual contacts us directly about data we hold for you, we'll refer them to you and help you respond as the organization in control of that information.

If we become aware of a Security Incident affecting your personal information, we'll notify you without undue delay (and in any event within 72 hours of confirming it) and give you the information you reasonably need to assess it and meet your obligations under PIPEDA's breach-reporting rules (which can require reporting to the Office of the Privacy Commissioner of Canada and notifying affected individuals where there is a real risk of significant harm). You are responsible for deciding on, and making, any notifications you are legally required to give. If Québec's Law 25 applies to you, we will also tell your privacy officer (through your account contacts), without delay, about any violation, or attempted violation, of the confidentiality obligations in this DPA that we become aware of.

We keep your data while your account is active. You can delete your own CRM records, contacts, interactions, notes, asks, gifts, and your team and geo assets, yourself at any time in the service. Supporter letters and petition signatures are kept as the campaign's own record: rather than being individually deleted by you, they are de-identified on a retention window the operator configures, when that window is set, supporter details are de-identified automatically after it (or sooner on request). If you cancel, we record the cancellation and your exported data remains available; supporter personal information is then de-identified on that retention schedule (and removed on request), and routine backups age out on our normal cycle. One backstop applies whatever the settings say: once your account ends, you can ask us in writing to delete or de-identify the personal information we still hold for you, and we will do it within 60 days, deleting what can be deleted, and de-identifying the letters and petition signatures kept as campaign records. Only the limited records described below, the acceptance records under section 17, and copies in routine backups (which age out on our normal cycle) fall outside this promise. We may keep limited records where the law requires (e.g. billing/tax, and the lobbying-compliance records you've generated) and de-identified or aggregate data that can't identify anyone. When we de-identify, we remove direct identifiers and the deterministic indexes that could re-link a person, in line with the federal and provincial Privacy Commissioners' de-identification guidance, recognizing that no de-identification is perfectly irreversible, especially against AI-assisted re-identification.

On reasonable written request (normally no more than once a year, and treated as confidential), we'll provide information to help you confirm we're meeting this DPA, such as a summary of our security measures, our subprocessor list, and this agreement. If a Privacy Law that applies to you, like Québec's Law 25, requires that you be able to verify how we keep your information confidential, we'll let you (or your privacy officer) carry out that verification: at your cost, on reasonable written notice, no more than once a year (unless a Security Incident affecting your information gives you good reason for more), and in a way that protects other customers' data and doesn't disrupt the service. And if a Privacy Law requires you to do a privacy impact assessment that involves the service, for example, Law 25 before personal information leaves Québec, we'll give you, on written request, the relevant information we already have: this DPA, Schedule A, our Subprocessor list and a summary of our security measures. The assessment itself is yours to carry out, we don't act as your consultant, and this isn't legal advice.

You're responsible for: collecting personal information lawfully and with any required consent; the accuracy of what you upload; managing your team's access; honouring individuals' choices (e.g., unsubscribes); and not putting categories of sensitive information into the service that it isn't designed to handle. Because the CRM's AI features process whatever you enter in the CRM, including detailed contact information, you are responsible for ensuring you do not enter into the CRM any personal information you are not permitted to collect, use, disclose to our subprocessors, or have analyzed by AI under applicable Privacy Laws and the consents you hold. AI processing is routed through the AI subprocessors disclosed in this DPA and the Subprocessor list (see sections 4 and 9); you agree to give the notices and obtain the consents that applicable Privacy Laws require for that processing before you put an individual's personal information into the service. You'll use the service in line with the Terms and applicable law.

This DPA is part of, and governed by, the Terms, including their limits of liability, disclaimers, dispute-resolution and governing-law provisions. For privacy and data-protection matters specifically, this DPA controls if it conflicts with the rest of the Terms. One thing that rule never changes: the Terms' limits of liability, disclaimers, dispute-resolution and governing-law provisions always apply to every claim under or connected with this DPA.

This DPA applies for as long as we process personal information for you, and the parts about returning/deleting data and confidentiality continue to apply after your account ends.

If we make a material change to this DPA, we'll give you at least 15 days' notice (matching the Terms) and post the updated version with a new version number and date. During that window a notice appears in your account asking you to review and accept. If you don't accept within 15 days, access to the service may be limited until you do, you'll still be able to sign in to review and accept the updated agreement. We keep a record of which version you accepted, when, and by whom.

This DPA is governed by the laws of British Columbia and the federal laws of Canada that apply there, consistent with the Terms. Privacy questions: privacy@polipost.ca.

Roles: you are the controller; PoliPost is the service provider/processor.

Individuals: your team; your supporters/constituents; your CRM contacts (including decision-makers and designated public office holders, or DPOHs).

Data categories: account + login/security data; supporter name, email, postal address, the letter and any optional note; petition signatures; CRM contact records, notes and interactions; usage + audit logs.

Purposes: deliver the features you enable (letters, petitions, polls, CRM, monitoring), security, support, billing, legal compliance.

Operations: storage, transmission, AI drafting/insights, delivery (email/print/pen), analytics, de-identification.

Retention: while your account is active; after cancellation, exported data remains available and supporter personal information is de-identified on the retention window the operator configures (or removed on request); supporter letters and petition signatures de-identified when that window elapses; operational logs pruned on configurable schedules.

Security: see section 7 (encryption in transit + at rest, bcrypt, MFA/passkeys, blind indexes, role-based access, audit logging).

Location: Canada (FullHost, Vancouver); some subprocessors abroad; AI processing routed through Spur Compute (Canada), subject to section 9's OpenRouter exception for search embeddings only.

Subprocessors: the current list (role, data seen, location, policy link) is published and incorporated by reference (section 8).