Privacy Policy

1. Who this covers

AdvocacyLift is operated by Humble Consultancy ("we," "us," or "our"). This policy covers advocacylift.com, our hosted embeds, organizer accounts, and Civic Connect District, Civic Connect Focus, and Civic Connect Rally.

An organization that installs a widget or runs a petition (the "organizer") has its own responsibilities for its website and campaigns. Its privacy notice applies to its use of supporter information. This policy explains our handling of that information through AdvocacyLift; it does not replace the organizer's notice.

2. Information we handle

• Accounts and subscriptions. Your email address, account identifiers, subscribed website, product, payment-provider identifiers, payment status, and subscription dates. Stripe collects payment and billing details at checkout. We do not receive or store your full card number or card security code.
• Organizer content. Widget settings, campaign topics, selected officials, phone scripts, petition text, addressee names, website and privacy-policy URLs, branding, and image URLs. Published campaign content is visible to visitors and may be shared or indexed.
• District lookups. The ZIP code you submit and the widget identifier needed to return representatives. We send the ZIP code to 5 Calls using the organizer's API key. We process lookup results to display them; we do not create a supporter account or a saved personal ZIP-code profile from a lookup.
• Focus searches. The topic or bill, state, and locality used to find relevant officials, plus the public legislative and contact records returned. Organizers save their campaign selections; visitors can view the published campaign without providing a name or email address.
• Rally signatures. Your name, email address, ZIP or postal code if enabled by the organizer, whether you choose campaign updates, the petition version, submission and confirmation times, and information needed to prevent duplicate or abusive submissions. Signing may reveal support for a political, social, or other sensitive cause.
• Technical and support information. Network requests can include an IP address, browser/device information, requested URL, time, and errors. Our hosting provider processes this information for delivery and security. We use short-lived hashed rate-limit identifiers. If you contact us, we also handle the information you provide in that conversation.

3. How we use it

We use information to deliver and customize widgets, find officials, save organizer drafts, confirm signatures, provide exports, sign you in, manage payments and access, answer requests, prevent abuse, investigate problems, and meet legal obligations. We do not use petition signatures to build advertising audiences or train AI models.

Where applicable law requires a legal basis, account and billing processing supports our contract with the organizer; security and support serve our legitimate interests; required records meet legal obligations; and optional uses rely on the permissions you give. An organizer is responsible for establishing the appropriate basis, including any required explicit consent for sensitive campaign information, for its own petition.

4. What happens when you sign a petition

The public widget displays the total confirmed count, not a public list of signers or their email addresses. A standard organizer export contains names, confirmation dates, and any collected postal codes. The organizer can separately choose to include email addresses and campaign-update choices. Leaving the updates box unchecked does not prevent the organizer from accessing your signature details; it means you have not opted in to campaign updates.

Campaign updates are optional and unchecked by default. They are separate from the confirmation email and signing the petition. AdvocacyLift does not automatically send each signature to a decision-maker or send the organizer's campaign updates. The organizer controls its delivery, recipient disclosures, exported copies, and any permitted follow-up communications. Petition delivery may make your name or other exported information available to recipients or public-records processes.

We process signature data on the organizer's behalf to run Rally. Contact the organizer about its use of your information, campaign updates, or exported copies. You can also contact us for help with information held in AdvocacyLift.

5. Sharing and service providers

We do not sell personal information or share it for cross-context behavioral advertising. We disclose information needed to provide the service to:

• Cloudflare: hosting, database and file storage, network security, and transactional email delivery. Confirmation emails contain the recipient address, petition context, and confirmation link. Cloudflare privacy policy ↗
• Stripe: checkout, recurring subscriptions, invoices, and billing management. We send account email and identifiers needed to associate the payment with your website or widget. Stripe privacy policy ↗
• 5 Calls: District ZIP-code lookup requests and the organizer's API credential. 5 Calls privacy policy ↗
• Public-data sources: Focus uses RepRecord's legislative archive, Congress.gov, OpenStates, and other public official or committee sources. Relevant topic, bill, state, or locality queries may be sent to those sources. Signer lists are not sent to them.
• Organizers: confirmed signature information for their own petitions, including the export options described above.

Some pages load Google Fonts, official portraits, or organizer-provided images from external hosts. Your browser contacts those hosts, which receive technical request information such as your IP address. Opening an official website, email link, or telephone link also uses that destination's services and policies.

We may disclose necessary information to comply with law or a valid legal process, protect people or the service, or handle a business transfer with appropriate confidentiality protections. Our service providers may process information in the United States and other countries; applicable transfer safeguards and privacy requirements still apply.

6. Cookies, device storage, and tracking

Our account uses an essential secure session cookie, currently valid for up to seven days, to keep you signed in. Builders use browser local storage to remember drafts and preferences on that device. Clearing site data removes device drafts; it does not delete drafts already saved to your account. Blocking essential cookies can prevent account features from working.

We do not add advertising pixels or cross-site advertising trackers to our website or embeds. We do not currently change this processing in response to browser Do Not Track signals. Because we do not sell or share data for targeted advertising, Global Privacy Control does not need to disable such activity in our service. Stripe, external resources, and the organizer's website can have their own cookies and practices.

7. Retention and security

We keep organizer account, campaign, and signature records while needed to provide the service, including access to existing Rally exports after a paid plan expires, unless removal is requested or another retention reason applies. A closed petition or expired subscription does not automatically erase its signatures. Billing, security, and dispute records may be kept longer when reasonably needed or required by law.

Sign-in links expire after 15 minutes and petition confirmation links after 24 hours; link expiry does not itself delete the submission. Expired account sessions and rate-limit records are removed through scheduled maintenance. If a signature is removed, its private details are cleared from active signature storage and excluded from future exports. Minimal integrity records and copies previously exported by an organizer may remain. Backup or provider-held records may follow separate retention schedules.

We use access controls, encrypted connections, encrypted stored API credentials and signature details, and hashed confirmation tokens. Some operational information, including account emails and email-delivery addresses, is stored separately. No system can guarantee absolute security.

8. Your choices and privacy rights

Depending on your location and applicable law, you may have rights to access or receive a copy of information, correct it, request deletion, restrict or object to processing, withdraw consent, or appeal a privacy-request decision. These rights can have exceptions. Withdrawal does not undo processing that already lawfully occurred. You can also complain to the relevant privacy regulator.

To make a request, email remco@humbleconsultancy.com. Include the email you used and, for a petition, its link or title. Please do not send payment credentials or identity documents unless we specifically request an appropriate verification method. We may verify your identity and coordinate with the organizer before acting. We respond within the time required by applicable law and do not penalize you for exercising a privacy right.

For organizer-held or exported information, contact that organizer directly. Organizers can remove individual signatures from their dashboard. We can assist with requests concerning our stored records, but cannot retrieve copies already delivered to independent recipients.

9. Children

Our services are not directed to children under 13, and we do not knowingly collect their personal information. Organizers must not use our tools to knowingly collect information from children under 13. If you believe a child has submitted personal information, contact us and the organizer so it can be investigated and removed as appropriate. Higher local age or consent requirements may apply.

10. Policy updates

We may update this policy as the service or our practices change. We will update the effective date and provide a prominent site notice or an email to affected account holders for material changes. We will obtain additional consent where required rather than treating a policy update as permission for an unrelated use.

11. Contact us

Humble Consultancy · AdvocacyLift
remco@humbleconsultancy.com

For subscription and service rules, see our Terms of Service.