Privacy Policy

Last updated: March 19, 2026

Groundswell Campaigns Inc. ("we", "us", "our") is committed to protecting the privacy of individuals who use our Platform. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information in compliance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL).

1. Information We Collect

We collect different types of personal information depending on how you interact with the Platform:

From organization users (account holders):

• Email address
• Password (stored in hashed form)
• Organization name and details
• Account preferences and settings

From action supporters (via embedded widgets):

• Full name
• Email address
• Postal code
• Street address (when required for representative matching)
• Phone number (when optionally provided)

2. How We Use Your Information

We use personal information for the following purposes:

• Providing and operating the Platform, including action delivery to government representatives.
• Authenticating users and maintaining account security.
• Matching supporters with their elected representatives based on postal code or address.
• Generating action analytics and reporting for organizations.
• Communicating with users about their accounts and the service.
• Improving the Platform and developing new features.

3. Consent

We obtain consent for the collection and use of personal information as follows:

• Organization users: By creating an account and accepting these terms, you consent to the collection and use of your information as described in this policy.
• Campaign supporters: Supporters provide express consent through an opt-in checkbox on action widgets before submitting their information. Organizations using the Platform are responsible for ensuring that appropriate consent mechanisms are in place for their campaigns.

You may withdraw your consent at any time by contacting us, subject to legal or contractual restrictions. We will inform you of the implications of withdrawing consent.

4. Third-Party Services

We use the following third-party services to operate the Platform:

• Supabase: Database hosting, authentication, and data storage.
• Resend: Transactional email delivery (confirmation emails, action notifications).
• Google Places API: Address lookup and validation for representative matching.

These third-party services have their own privacy policies and we encourage you to review them. We ensure that our agreements with these providers include appropriate data protection provisions.

5. Data Retention

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, or as required by law. Organization account data is retained for the duration of the account and for a reasonable period thereafter. Campaign supporter data is retained in accordance with the data retention preferences set by the organization that collected it. When data is no longer required, it is securely deleted or anonymized.

6. Your Rights

Under PIPEDA, you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your personal information, subject to legal requirements.
• Withdraw consent for the collection, use, or disclosure of your information.
• File a complaint with the Office of the Privacy Commissioner of Canada if you believe your rights have been violated.

To exercise any of these rights, please contact us at the address below. We will respond to your request within 30 days.

7. Cookies

The Platform uses the following cookies:

• Session cookies: Essential cookies used to maintain your authenticated session. These are required for the Platform to function.
• Active organization preference: A cookie that stores your currently selected organization for a seamless multi-organization experience.

We do not use advertising or tracking cookies. We do not engage in cross-site tracking.

8. Children's Privacy

The Platform is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information promptly.

9. Data Storage Location

Data collected through the Platform is stored on servers operated by our third-party hosting providers. While we endeavour to store data within Canada where possible, some data may be processed or stored in jurisdictions outside of Canada. In such cases, the data may be subject to the laws of those jurisdictions. We take appropriate measures to ensure that your personal information receives an adequate level of protection regardless of where it is stored.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Platform and updating the "Last updated" date. We encourage you to review this policy periodically.

11. Contact

If you have any questions or concerns about this Privacy Policy or our handling of your personal information, please contact our Privacy Officer at privacy@groundswellcampaigns.com.

If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada.