Privacy Policy

This Privacy Policy explains how Disclaimers LLC collects, uses, discloses, and protects personal information through the Campaign Comply (CampaignComply.com) web application and related services (the "Site"). Disclaimers LLC also operates Make My Disclaimer (MakeMyDisclaimer.com); information may be used across both products for the limited purposes described in Section 3. Your use of the Site is subject to this Privacy Policy and our Terms of Use. Where applicable law requires consent, opt-in, or an opportunity to opt out, we will provide the required choice mechanism before engaging in the relevant practice.

Capitalized terms not defined in this Privacy Policy have the meanings given to them in our Terms of Use.

1. Information We Collect

Personal Information You Provide

To provide and improve our services, we may collect personally identifiable information that you voluntarily provide, including but not limited to:

• First Name
• Last Name
• Email Address
• Phone Number (if provided)
• Political Committee Information (committee name, ID number, treasurer information)
• Political Party Affiliation (if provided)
• Candidate or ballot measure information (if entered)
• Filing deadline preferences and notification settings
• User account credentials and preferences

Payment Information

If you purchase any products or services through the Site, our payment processor, Stripe, Inc., collects billing and payment information on our behalf. We do not store complete credit card information on our servers. The Company may access limited transaction information (such as the last four digits of your card and transaction amount) to complete transactions, provide customer support, and prevent fraud. Payment processing is subject to Stripe's Privacy Policy.

Information Collected Automatically

When you visit our Site, we may collect certain information about your device and usage, including:

• IP address
• Browser type and version
• Device type and operating system
• Pages visited and time spent on pages
• Referring website or source
• Date and time of access
• Geographic location (general)

We may collect this information through cookies, web beacons, and similar tracking technologies.

Cookies and Tracking Technologies

We may use cookies and similar technologies to:

• Maintain your session and keep you logged in
• Remember your preferences and settings
• Analyze Site usage and performance
• Improve user experience

You can control cookies through your browser settings. However, disabling cookies may limit your ability to use certain features of the Site.

Analytics Services

We use Vercel Web Analytics, provided by our hosting provider, to measure Site traffic and feature usage in aggregate. It is served from our own domain, sets no cookies, and stores no identifier in your browser. Alongside page views we record a small number of product events — for example that a jurisdiction lookup was displayed, which jurisdiction was looked up, or which page an account prompt appeared on. These events describe actions and pages, not people: they do not include your name, your email address, or any information you have entered into our tools.

We also store a randomly generated visitor identifier in your browser's local storage. It is a random value that says nothing about who you are. We use it to understand how the Site is used — for example, which pages people visit before creating an account — and, if you later create an account, to associate your earlier activity on the Site with it. We do not set this identifier if you have opted out, including through a Global Privacy Control signal (see Section 12). You can also clear it at any time by clearing your browser's site data.

We do not use analytics tools that engage in cross-context behavioral advertising. If we enable an additional third-party analytics service in the future (such as Google Analytics), we will configure it, where available, to minimize personal-information collection and to disable advertising features unless we provide any required notices and choices. If we ever turn on cross-context advertising features, we will treat the corresponding activity as "sale" or "sharing" under the CCPA/CPRA and provide the opt-out controls described in Sections 3 and 12.

You can opt out of Google Analytics generally by installing the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout.

Information You Generate Through the Site

When you use our educational tools, we may collect and store:

• Committee information you enter
• Deadline tracking preferences
• Educational content you access
• Tool usage patterns
• Political Party Affiliation (if provided)

Apart from the technical and usage information described above (such as IP address, browser type, device characteristics, and pages visited), which is collected automatically when you interact with the Site, we do not collect personal information unless you voluntarily provide it. Additional categories of personal or non-personal information may be collected in the future as new services are offered, and we will update this Privacy Policy accordingly before any such new collection begins.

Public-Record Status of Campaign Finance Filings

Many of the forms generated through the Site — including but not limited to FPPC Forms 410, 460, 461, 470, 496, 497, and 501 — become public records once filed with the FPPC, a local filing officer, or another government agency. This Privacy Policy governs information we process through the Site; it does not control how government agencies publish, disclose, retain, or otherwise process forms after you submit them. You should assume that information you place on a form intended for public filing will become public when you file it, regardless of how we handle that information internally. Information that is publicly available through government records may still be personal information while we maintain it in connection with your account or use of the Site, and we apply the protections of this Privacy Policy to it on that basis.

2. How We Use Your Information

We use the information we collect to:

• Provide Services: Operate, maintain, and deliver the services and features you request
• Account Management: Create and manage your account, process transactions, and provide customer support
• Communications: Send you service-related emails, including confirmations, technical notices, updates, security alerts, and administrative messages
• Improvements: Analyze usage patterns to improve the Site's functionality, features, and user experience
• Educational Content: Develop and deliver relevant educational resources and compliance guidance
• Marketing: With your consent, send you newsletters, promotional offers, and information about new features (you may opt out at any time)
• Security: Detect, prevent, and address fraud, security issues, and technical problems
• Legal Compliance: Comply with legal obligations and enforce our Terms of Use
• Research: Conduct internal research and analytics to better understand user needs

We seek to limit collection to information reasonably necessary and proportionate for the purposes described in this Policy, including providing the Site, maintaining security, improving functionality, communicating with users, and complying with legal obligations.

3. How We Share Your Information

Sharing Between Disclaimers LLC Products

Disclaimers LLC is a California single-member LLC that operates two compliance-guidance products today: Campaign Comply (CampaignComply.com) and Make My Disclaimer (MakeMyDisclaimer.com). Both products are owned and operated by the same individual under the same legal entity and serve the same general purpose: helping users meet political-compliance and disclosure requirements. We intend to fold Make My Disclaimer into Campaign Comply over time so that both functions live under a single product.

Because both products are operated by the same entity, the same operator may access information from either product for the limited business purposes listed below. We do not transfer your information to a separately-owned third-party affiliate (because none exists), and we do not sell or share your information across these products for cross-context behavioral advertising.

Limited business purposes for which information may be used across both products:

• Authenticating you and maintaining a consistent account identity if you use both products
• Detecting and preventing fraud, abuse, and security incidents
• Processing payments and reconciling billing
• Providing customer support when you contact us about either product
• Internal analytics, research, and product development on aggregate or de-identified data
• Enforcing our Terms of Use or other policies
• Migrating account or product data if and when we consolidate the two products onto a single platform (you will receive notice before any such migration that materially changes how your data is handled)

We do not use information from one product to send marketing about the other unless you have opted in to such communications. You can opt out of cross-product marketing at any time using the unsubscribe mechanisms described in Section 7.

Third-Party Data Sharing and Sale

Third-Party Service Providers and Contractors

We rely on third-party service providers and contractors (each as defined in Cal. Civ. Code §1798.140) to operate the Site. We have not negotiated bespoke contracts with these providers; we have accepted each provider's standard published terms of service and, where offered, their standard Data Processing Addendum (DPA). For some providers, the DPA or other data-processing terms are incorporated into the standard terms of service such that accepting the terms places the DPA into effect; for others, a separate DPA artifact (for example, Supabase's PandaDoc) or product-level configuration may be required. We list each provider below so you can review their own published policies:

• Application hosting and edge functions: Vercel Inc. (policy, DPA)
• User accounts and database: Supabase Inc., which stores data on Amazon Web Services infrastructure in the United States (policy)
• Payment processing: Stripe, Inc. (policy)
• Email delivery: EmailJS, Postmark (a product of ActiveCampaign), and Resend (EmailJS policy, Postmark policy, Resend policy)
• AI-assisted analysis of public compliance announcements: Anthropic PBC (policy)
• Source-code hosting and continuous integration: GitHub, Inc. (policy) — user data is not stored in our source repository
• Analytics (if and when enabled): Google Analytics or a privacy-respecting alternative

Where required by applicable privacy law, we rely on each provider's standard terms, data-processing addendum, or equivalent written commitments restricting the provider's use of personal information to providing services to us and prohibiting sale, sharing, or unrelated commercial use. Some providers may also process certain information as an independent business for limited purposes that they describe in their own terms (for example, fraud prevention, security, billing, or legal compliance). Service-provider status under Cal. Civ. Code §1798.140 is configuration-dependent for some providers (notably analytics); where that is the case we configure the integration to remain within service-provider terms. We review provider terms before using a new provider for personal-information processing, and we may replace or add service providers from time to time. If a provider change materially changes how personal information is processed, we will update this Privacy Policy or provide additional notice as required.

Third-Party Links

Our Site may link to third-party services and resources for your convenience. We do not currently share your personal information with any such third party unless you explicitly choose to engage with them through links on our Site. When you click through to a third-party website, that party's privacy policy applies.

Legal Obligations and Business Transfers

We may disclose your personal information if required to do so by law or in response to valid requests by public authorities, including to:

• Comply with legal obligations, court orders, or subpoenas
• Protect and defend our rights or property
• Prevent or investigate possible wrongdoing in connection with the Site
• Protect the personal safety of users of the Site or the public
• Protect against legal liability

Political and Campaign Finance Information. Some information you provide through the Site — including political party affiliation, committee membership, and campaign finance data — may be subject to disclosure under the California Political Reform Act (Cal. Gov't Code §81000 et seq.), public records laws, or other applicable requirements. If required by law, court order, or valid legal process to disclose such information — including political party affiliation or other political information — to government authorities or law enforcement, we will comply. Where permitted by law and consistent with our legal obligations, we will endeavor to notify you of any such requirement in advance.

Business Transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, your personal information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

4. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have specific rights regarding your personal information under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

Categories of Sources

Consistent with 11 CCR §7011(e)(1)(B), we collect personal information from the following categories of sources:

• Directly from you — information you provide when you create an account, enter committee or candidate data, request a deadline reminder, generate a form, contact us for support, or otherwise interact with the Site.
• Automatically from your device — technical and usage information collected through cookies, web beacons, opt-out preference signals (such as GPC), and similar tracking technologies when you interact with the Site, as described in Section 1.
• From public government records — when we look up jurisdiction-specific contribution limits, filing deadlines, ordinance text, or other compliance information that has been published by the FPPC, the California Secretary of State, county registrars, city clerks, or other public agencies. We use these public records to populate compliance guidance and do not link them to your account except where you have entered data identifying yourself or your committee.
• From service providers acting on our behalf — for example, fraud-prevention signals from our payment processor, email-delivery events from our email providers, and session, security, and operational telemetry from our application-hosting and database providers.
• Information the Site generates from your inputs — deadline calculations, filing-window classifications, reminder schedules, jurisdiction matches, contribution-limit determinations, advisory ballot-designation analysis, form-selection recommendations, and form-generation outputs (including the generated FPPC PDFs themselves, which may contain names, addresses, committee information, contribution data, expenditure data, treasurer signatures, and other data populated from your inputs as required by the underlying form). When this Site-generated information is associated with your account or committee, we treat it as personal information for purposes of this Policy.

• Identifiers: Name, email address, phone number (if provided), IP address, and securely hashed user account credentials (we do not store passwords in plaintext)
• Financial Information: Limited payment transaction data (processed by Stripe)
• Political Information: Political party affiliation; candidate or ballot-measure support; committee role and type; office sought; jurisdiction; filing behavior, deadlines, and history; and fundraising and expenditure records that you enter or that the Site computes from your inputs. We treat the field-level "political party affiliation" entry as sensitive personal information on a voluntary basis (see "Sensitive Personal Information" below); other Political Information categories listed here are treated as ordinary personal information unless the CCPA classifies them otherwise.
• Professional/Committee Information: Political Committee information, treasurer information (if entered)
• Usage Data: Platform activity, filing preferences, notification settings
• Geolocation Data: General location based on IP address

Sensitive Personal Information

We treat the following categories as sensitive or heightened-risk information. Some are sensitive personal information under the CCPA; others, such as political-engagement information, are treated by us as sensitive on a voluntary basis even if not expressly enumerated in the statutory definition.

• Account log-in credentials (an account identifier in combination with a password or other credential allowing access to the account) — sensitive personal information under Cal. Civ. Code §1798.140(ae)(1)(B). We use these credentials only for authentication, account security, and account administration. Passwords are stored only in securely hashed form.
• Personal information of consumers under 18 — as a precautionary measure, if we have actual knowledge that a consumer is under 18 (with willful disregard of age treated as actual knowledge), we treat that consumer's personal information as sensitive personal information and apply the Right to Limit Use protections described below. This is a voluntary standard that goes beyond what the CCPA requires. The Site is directed at adults engaged in California political activity, and we do not knowingly collect personal information from anyone under 18 (see Section 5).
• Political party affiliation or information revealing political views — only when you voluntarily provide it as required by campaign finance forms. The CCPA does not expressly enumerate political affiliation as a sensitive personal information category, but we apply this treatment voluntarily because political-engagement data is uniquely sensitive in practice.

Right to Limit Use. Where the statutory Right to Limit Use of Sensitive Personal Information under Cal. Civ. Code §1798.121 applies, you may exercise it by emailing us at info@campaigncomply.com with the subject line "Limit Use of Sensitive Personal Information." When you exercise this right, we will use and disclose your statutory sensitive personal information only as reasonably necessary to perform the services you have requested. In addition, even where political-engagement information is not treated as sensitive personal information under the statutory definition, we voluntarily honor requests to limit our use and disclosure of that information to what is reasonably necessary to provide the services you requested.

Personal information of minors. See Section 5. We do not knowingly sell or share the personal information of consumers under 18. This is a voluntary commitment that goes above the CCPA's statutory threshold of 16. Where the CCPA requires affirmative authorization before selling or sharing the personal information of a consumer who is 13–15 (or parental consent for a consumer under 13), we will obtain that authorization before any such sale or sharing.

Purposes of Use (CCPA Notice)

• Provide campaign compliance and disclaimer-generation services
• Share between Disclaimers LLC's two products (Campaign Comply and Make My Disclaimer) for the limited business purposes described in Section 3 (authentication, fraud prevention, billing, support, internal analytics, enforcement, and eventual product consolidation)
• Process payments and prevent fraud
• Communicate with you about our services
• Analyze and improve our platforms
• Comply with legal and regulatory obligations
• Potentially sell or share identifiers only (such as name, email, and committee name or affiliation) with third parties in the future, with advance notice and opt-out rights, and never sensitive personal information without your affirmative opt-in consent — see the narrowed reservation in Section 3

Your California Privacy Rights

1. Right to Know: Request disclosure of personal information we have collected about you, including categories collected, sources, business purposes, and third parties with whom it was shared. Effective January 1, 2023, you may request information about personal information collected beyond the prior 12 months, unless doing so would be impossible or require disproportionate effort.
2. Right to Delete: Request deletion of your personal information (subject to exceptions for legal compliance, fraud prevention, and completing transactions)
3. Right to Correct: Request correction of inaccurate personal information
4. Right to Opt-Out of Sale/Sharing: Opt out of the sale or sharing of your personal information to third parties
5. Right to Limit Use of Sensitive Personal Information: Limit our use and disclosure of your sensitive personal information (such as account log-in credentials, and, on a voluntary basis, political-affiliation information) to purposes necessary to perform the services you requested
6. Right to Non-Discrimination: We will not discriminate against you for exercising these rights, including by denying services, charging different prices, or providing different quality of services

How to Exercise Your Rights

To exercise any of these rights, contact us:

• Email: info@campaigncomply.com
• Phone: (916) 287-7675
• Mail: 1401 21st Street, STE #10365, Sacramento, CA 95811

We will verify your identity before processing requests where required and will respond within 45 days (extendable by an additional 45 days if necessary). For requests to know, delete, or correct, we may require additional information reasonably necessary to verify your identity. Consistent with 11 CCR §7060(b), we will not require identity verification before processing a request to opt out of sale or sharing or a request to limit use of sensitive personal information, although we may ask for information necessary to complete the request if the request alone does not contain enough information to act on it.

Authorized Agent. You may use an authorized agent to submit a request on your behalf. For requests to know, delete, or correct, we may require the agent to provide proof that you gave the agent signed permission to submit the request, and we may ask you to verify your identity directly with us or to confirm that you gave the agent permission. Consistent with 11 CCR §7063, we will not require a power of attorney for authorized-agent requests, but if an agent is acting under a valid Probate Code power of attorney, that may be used in lieu of the ordinary signed-permission procedure. For requests to opt out of sale or sharing or to limit use of sensitive personal information, we will accept an authorized agent's request on your behalf without requiring you to verify your identity directly.

Data Retention

We retain personal information for as long as necessary to provide services, comply with legal obligations, resolve disputes, and enforce agreements. Specific retention periods by category are as follows:

• Account information (name, email, hashed password, account preferences): retained while your account is active and for up to 30 days after account deletion to allow purge from operational backups.
• Payment and transaction records (limited transaction metadata such as last four digits of card and amount): 7 years, to satisfy federal and state tax recordkeeping requirements.
• Political committee and campaign-finance data you enter (committee information, treasurer details, candidate or ballot-measure entries, draft and generated forms): up to 4 years from last update, consistent with California campaign-finance recordkeeping requirements applicable to candidates and committee treasurers (Cal. Gov't Code §84104; 2 CCR §18401). You may request earlier deletion at any time; if you do, we delete the data unless we are legally required to retain it.
• Email and notification preferences and reminder subscription records: while the subscription is active and for 24 months after unsubscribe (to honor your opt-out and prevent re-subscription without consent), then deleted.
• Marketing and communications engagement data (open/click events, surveys): up to 24 months from last engagement, then deleted or aggregated.
• Automatically collected technical data (IP address, browser user-agent string, page-view logs): up to 14 months in raw form, then aggregated.
• Site-generated compliance information (deadline calculations, filing-window classifications, jurisdiction matches, contribution-limit determinations, ballot-designation analyses, and generated FPPC PDF outputs): retained for the same period as the underlying inputs that produced them, generally up to 4 years from last update consistent with the campaign-finance entry above. Cached or previously-downloaded copies may persist in backups consistent with the backup-retention period.
• Backups containing any of the above: rolling 30-day retention, after which backups are overwritten in the normal course.

Where a specific category does not appear above, our default rule is to retain the data only for as long as needed for the purpose for which it was collected, and to delete or de-identify it thereafter. If applicable law requires longer or shorter retention, that legal requirement controls.

Sale and Sharing of Personal Information

We do not currently sell personal information. As described in Section 3, any future sale or sharing of personal information would be limited to identifiers (such as name, email, and committee name or affiliation) and would expressly exclude sensitive personal information (including political party affiliation and other information revealing your political beliefs) absent your affirmative opt-in consent. If we begin selling or sharing personal information, California residents will be notified, will be provided with a conspicuous "Do Not Sell or Share My Personal Information" link to opt out, and we will honor Global Privacy Control signals as described in Section 12. Under California law, "sale" includes exchanging personal information for monetary or other valuable consideration, including for cross-context behavioral advertising.

Disclosure for Business Purposes

In the 12 months preceding the effective date of this Privacy Policy, we have disclosed the following categories of personal information to the service providers and contractors named in Section 3 for the business purposes described there:

• Identifiers (name, email, IP address, account identifiers) — disclosed to application-hosting and database providers (Vercel, Supabase), email-delivery providers (EmailJS, Postmark, Resend), and, when enabled, analytics providers.
• Financial information (limited transaction metadata) — disclosed to the payment processor (Stripe) for paid subscriptions, beginning with the launch of paid billing on this Policy's effective date (no card transactions occurred in the 12 months before that date).
• Professional/committee information (committee name and identifiers entered while drafting forms) — stored in our database at Supabase; processed by Vercel as part of operating the application; may appear in application logs, error traces, and operational telemetry generated by Vercel and Supabase as part of normal operation (used only for debugging, incident response, and security, and minimized in logs where reasonably practical); included in transactional or reminder emails sent through our email-delivery providers (EmailJS, Postmark, Resend) where the email content references committee details (e.g., "your Form 460 deadline"); is included in Stripe customer or invoice records to the extent reflected in billing metadata; and may be sent to AI providers only if you choose to use an AI-enabled feature (such as the planned conversational compliance assistant described in Section 13) that requires that context.
• Usage data (technical and engagement events) — disclosed to analytics providers when enabled.

We have not sold or shared personal information for cross-context behavioral advertising or for any other purpose constituting a "sale" or "sharing" under the CCPA/CPRA during this period.

California "Shine the Light" Law

Under California Civil Code Section 1798.83, California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, contact us at info@campaigncomply.com.

5. Children's Privacy and Minors

The Site is a campaign-compliance tool intended for use by adults engaged in California political activity (candidates, committee treasurers, and similar). We do not design the Site for children or teenagers, and account registration and direct use are intended for adults. We do not knowingly permit individuals under 18 to create accounts or use the Site directly.

If an adult user enters information relating to a minor into a campaign-finance form or compliance workflow (for example, in the rare circumstance of a minor candidate, volunteer, or family-member contact required by a form), we process that information only as necessary to provide the requested service, maintain security, and comply with applicable law.

Under 13 (COPPA). We do not knowingly collect personal information from children under 13. If we learn we have collected personal information from a child under 13 without verifiable parental consent, we will delete that information unless retention is legally required or reasonably necessary for safety, security, or compliance purposes.

Selling or sharing personal information of consumers under 18. We do not knowingly sell or share the personal information of any consumer under 18. This is a voluntary commitment above the CCPA's statutory threshold of 16. Where the CCPA requires affirmative authorization from the consumer (13–15) or parental consent (under 13) before any sale or sharing, we will obtain that authorization.

If our audience or product design changes such that the Site is likely to be accessed by minors, we will evaluate and implement any applicable age-appropriate-design obligations (including under the California Age-Appropriate Design Code Act, to the extent then in force and applicable) before launching those changes.

If you believe we have collected information from a minor, please contact us at info@campaigncomply.com and we will investigate and delete as appropriate.

6. Your Rights and Choices

Account Information

You may access, update, or correct your account information at any time by:

• Logging into your account and visiting your account settings page
• Contacting us at info@campaigncomply.com
• Calling us at (916) 287-7675

Account Deletion

You may request deletion of your account and personal information by contacting us. Please note that:

• We may retain certain information as required by law or for legitimate business purposes.
• Deletion may be limited or delayed where retention is reasonably necessary (a) to help preserve records that you, as a treasurer or candidate, are legally required to maintain under California campaign-finance recordkeeping rules (Cal. Gov't Code §84104; 2 CCR §18401), (b) to document services we provided to you, or (c) to comply with our own tax, accounting, security, fraud-prevention, dispute-resolution, or legal-compliance obligations. In those cases we will delete the affected categories once the retention basis no longer applies.
• Deletion may prevent you from using certain features of the Site.
• Some information may remain in backup systems for a limited time consistent with the backup-retention period described in Section 4.

Data Portability

In certain circumstances, you have the right to receive a copy of your personal information in a structured, machine-readable format. Contact us to request data portability.

Concerns About Particular Processing

You may contact us with objections or concerns about particular processing activities at info@campaigncomply.com. We will review your request in light of applicable law and our voluntary privacy commitments and respond within a reasonable time.

7. Email Communications

We may send emails regarding:

Transactional Emails:

• Account creation confirmations
• Password resets and security notifications
• Service updates and changes to our policies
• Payment confirmations and billing statements
• Customer support responses

Marketing Emails:

• Newsletters and educational content
• New feature announcements
• Promotional offers and updates
• Surveys and feedback requests
• General communications about political compliance

Opt-Out:

You may opt out of receiving marketing emails at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Sending a request to unsubscribe@campaigncomply.com
• Adjusting your email preferences in your account settings

Please note that even if you opt out of marketing emails, you will continue to receive transactional emails related to your account and use of the Site.

Third-Party Communications: We will not sign you up to receive direct marketing from third-party partners unless you take a separate affirmative action indicating that you want to receive those communications. Opt-in to a third-party partner is separate from your subscription preferences with Campaign Comply, and once you have opted in to a third party you must unsubscribe directly with that third party. We are not responsible for third-party privacy practices.

8. Data Storage and Security

Data Storage

Your personal information is stored in a PostgreSQL database hosted by Supabase Inc. on Amazon Web Services infrastructure in the United States. The Campaign Comply application is delivered through Vercel Inc.'s global edge network — this means that while primary database storage is in the United States, application delivery, request routing, edge caching, security telemetry, and operational logging may involve infrastructure outside the United States depending on the provider's configuration. Email communications are processed through EmailJS, Postmark, and Resend. Each of these providers maintains industry-standard security practices including encryption of data in transit (TLS) and at rest, access controls, and routine security monitoring.

We implement appropriate technical and organizational measures of our own on top of provider defaults to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These include authenticated session management, role-restricted database access, source-control review of changes that affect personal-information handling, and per-provider data processing addenda where available.

Security Measures

We rely on our hosting provider's security infrastructure, which includes standard protections such as secure data transmission protocols (SSL/TLS) and server-level security measures. Payment processing is handled securely through Stripe, Inc., a PCI-DSS compliant payment processor that maintains its own security protocols.

We maintain access controls for our systems and use secure authentication for account access.

Limitations

Your Responsibility:

You are responsible for:

• Maintaining the confidentiality of your account credentials
• Notifying us immediately of any unauthorized use of your account
• Using a strong, unique password for your account
• Logging out of your account when using shared or public computers

If you believe your account has been compromised, please contact us immediately at info@campaigncomply.com.

Data Breach Notification

In the event of a data breach that affects your personal information, we will notify affected individuals and any regulators where required in the most expedient time possible and without unreasonable delay, consistent with Cal. Civ. Code §1798.82 and other applicable law. We aim to provide notification within 72 hours of confirming a reportable breach where reasonably possible, but a longer period may be necessary to determine the nature and scope of the breach, identify affected individuals, or restore reasonable system integrity, or where law-enforcement requests a delay. Notification may be provided via email to the address on file, in-application notification, or a prominent notice on the Site.

9. Third-Party Links and Services

The Site may contain links to third-party websites, services, or resources that are not owned or controlled by us, including:

• Government and agency resources (e.g., FPPC, IRS)
• Social media platforms
• Other educational or reference resources

We are not responsible for the privacy practices, content, or security of third-party websites. We encourage you to review the privacy policies of any third-party sites you visit.

MakeMyDisclaimer.com: Make My Disclaimer is also operated by Disclaimers LLC. Information collected through Make My Disclaimer is primarily governed by that service's own privacy policy and terms of use, except that information may be used across Disclaimers LLC products for the limited business purposes described in Section 3 of this Policy where permitted by the applicable product's policy and by law.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by:

• Posting the updated Privacy Policy on the Site with a new "Effective Date"
• Sending an email notification to registered users at the email address on file
• Displaying a prominent notice on the Site

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

Effective Date of Updates. The updated Privacy Policy will apply to information collected or processed after the stated effective date. Where applicable law requires consent, opt-in, opt-out, or another affirmative choice before a new practice applies, we will provide that choice before engaging in the practice. Continued use of the Site after an update is not a substitute for any legally required consent.

Material Changes: For material changes that significantly affect your rights, we may require you to affirmatively accept the new Privacy Policy before continuing to use the Site.

11. International Users

The Site is operated from the United States and is intended for users located in the United States, primarily in California. If you access the Site from outside the United States, please be aware that:

• Your information will be transferred to, stored, and processed in the United States
• U.S. data protection laws may differ from those in your country
• You are responsible for compliance with local laws regarding personal data collection, use, and disclosure

By using the Site, you consent to the transfer of your information to the United States and the processing of your information in accordance with this Privacy Policy and U.S. law.

If you are located outside the United States and have questions about your privacy rights, please contact us at info@campaigncomply.com.

12. Do Not Track and Global Privacy Control Signals

Do Not Track (DNT): Some web browsers have a "Do Not Track" feature that signals to websites that you do not want to have your online activity tracked. Because there is no industry-standard interpretation of DNT signals, our Site does not currently respond to them. We will reconsider if a recognized standard emerges.

Global Privacy Control (GPC): When we receive a valid opt-out preference signal — such as Global Privacy Control (typically the Sec-GPC: 1 request header or navigator.globalPrivacyControl = true) — we treat it as a request to opt out of the "sale" or "sharing" of personal information, as those terms are defined under the CCPA/CPRA, for the browser or device that sends the signal and for any consumer profile or account we can reasonably associate with that browser or device. If you are logged in, we apply the opt-out to your account as well. We will not treat the absence of a later GPC signal as consent to opt back in. Where required by the CCPA regulations effective January 1, 2026, we will display or otherwise make available a confirmation that your opt-out preference signal has been processed.

You can enable GPC through a browser or browser extension that supports the signal (for example, Brave, DuckDuckGo, Firefox with a GPC extension, and others). Because we do not currently sell or share personal information, GPC does not change our day-to-day data-sharing practices today; if we begin selling or sharing personal information, we will honor your GPC signal as described above without any additional action from you.

Separately, and beyond what the CCPA/CPRA requires of an opt-out preference signal, we treat a GPC signal or a manual opt-out as an instruction not to set the random visitor identifier described under “Analytics Services” in Section 1. If you have opted out, that identifier is not created and no visitor-level activity is recorded for your browser.

Third-party tracking across sites. Consistent with Cal. Bus. & Prof. Code §22575(b)(6), we do not currently permit third parties to collect personal information about your online activities over time and across different websites or online services through the Site. If we enable any analytics or advertising feature in the future that would allow such collection, we will update this Privacy Policy, provide any required notices and choices at or before that collection begins, and honor opt-out preference signals as described above.

13. Automated Processing and Algorithms

Campaign Comply uses rule-based automation to provide educational compliance guidance, deadline calculations, form-generation assistance, and similar product features. Because compliance is rules-driven, much of what the Site does is, by design, deterministic and algorithmic. In limited cases described below, we also use AI to summarize public materials or (in the future) to power an opt-in chatbot.

The principal automated processing we perform is as follows:

• Deadline calculations and filing-window reminders. We compute filing dates from election dates, committee type, and jurisdiction rules using deterministic logic. Output is informational and educational; it is not a substitute for verifying deadlines with the relevant filing officer or the FPPC.
• Contribution-limit lookup and analysis. We match jurisdiction, office type, and donor type against published state and local contribution-limit databases that we maintain.
• Ballot-designation validation. We apply California Elections Code §13107 rules to text you enter and surface likely issues. The validator's output is advisory; the county registrar makes the final determination.
• PDF form generation. We render FPPC forms from data you enter using a client-side PDF library. No decision about you is made by this process. The underlying form data may still be stored in or processed through our application and database infrastructure as described elsewhere in this Policy — "client-side rendering" describes where the PDF is composed, not whether the source data is ever transmitted to or stored by our systems.
• AI-assisted analysis of public compliance announcements. When a city ethics commission or the FPPC publishes a press release or rule-change notice, we may use the Anthropic Claude API to summarize that announcement and route it for human review. This processing operates on public materials, not on your personal information.

Planned future feature — conversational compliance assistant. We plan to offer an opt-in in-app chatbot to help users ask compliance questions. When launched, this feature may route your typed questions and limited context (such as your committee type and jurisdiction) to one or more third-party AI providers from among Anthropic (Claude), OpenAI, and Google (Gemini paid-tier only). The provider used will be disclosed in the chatbot interface itself before you submit any question. Before launching the chatbot, we will configure the feature so that, to the extent available for the applicable provider product tier, user inputs are not used to train the provider's general-purpose models. Where required or appropriate, we will also rely on the provider's data-processing addendum, service-provider terms, or equivalent written commitments restricting the provider's use of personal information for the chatbot feature. You should avoid pasting Social Security numbers, full bank-account numbers, government identification numbers, or other highly sensitive information into the chatbot. The chatbot is opt-in — the Site's other features will continue to work without it, and your chat history is associated with your session only when you initiate a chat. The chatbot's output is educational compliance guidance and is not legal advice; see our Terms of Use for the full disclaimer.

Based on the features described above, we do not use automated decisionmaking technology (ADMT) to make decisions that result in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services — the categories of "significant decisions" governed by 11 CCR §7001 and Article 11 of the CCPA regulations. Because of this, the specific pre-use notice, opt-out, and access requirements of those regulations are generally not triggered by our use of the Site today. If we introduce ADMT for any such significant decision, we will provide the required pre-use notice, opt-out or appeal rights where applicable, and access rights before or when required by law.

Human review on request. If you would like a human to review any output the Site has produced about you or your filings, or if you want to dispute an algorithmic result (for example, a flagged ballot designation), contact us at info@campaigncomply.com. We will respond within 30 days, longer if more time is reasonably necessary.

If we ever introduce automated processing that does make significant decisions about you within the meaning of the CCPA ADMT regulations, we will update this Privacy Policy with the required pre-use notice and opt-out information before doing so.

14. Testimonials and User Content

With your consent, we may display testimonials, reviews, or other user-generated content on our Site or in marketing materials. If you provide a testimonial:

• We will ask for your explicit permission before publishing
• You may request removal or modification at any time
• We will only display the information you authorize (e.g., first name and title)

If you post content in public areas of the Site (if applicable), that content may be viewed, collected, and used by others. Please do not post personal information you wish to keep private.

15. Your Use of the Site

Your use of the Site is subject to this Privacy Policy. This Privacy Policy is not intended to override any privacy choices or rights available to you under applicable law. Where we rely on your consent for a particular data practice (for example, marketing communications or any future sale or sharing of personal information), we will request that consent through a separate, affirmative choice mechanism.

If you do not agree with this Privacy Policy, please do not use the Site or provide any personal information to us.

16. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: info@campaigncomply.com (preferred method)
• Telephone: (916) 287-7675
• Business Address: 1401 21st Street, STE #10365, Sacramento, CA 95811

Registered Agent Information:

• Registered Agent: Registered Agents Inc
• Registered Agent Address: 1401 21st Street, STE R, Sacramento, CA 95811
• Registered Agent Phone: 530-232-5985
• Registered Agent Email: agent@californiaregisteredagents.net

17. Effective Date

This Privacy Policy is effective as of July 29, 2026 and applies to all information collected by CampaignComply.com on or after that date.