Privacy Policy

Two audiences: (a) the operators — candidates, campaigns, PACs, 501(c)(3) organizations, and consulting firms who sign up for an OS1776 account ("Customers"); and (b) the constituents whose data those Customers upload or collect through OS1776 ("End Users"). If you are an End User, your relationship is primarily with the Customer whose campaign contacted you; OS1776 is the processor.

From Customers: account email, password hash, billing name, address, tax ID, Stripe customer ID, campaign name, tenant slug, uploaded logos, IP addresses of admin logins, and audit-log activity.

From End Users, on behalf of Customers: names, mailing addresses, phone numbers, email addresses, voter file IDs, party affiliation, support-level tags, donation history (amount, date, method — never full card numbers; Stripe holds those), SMS opt-in timestamps, canvasser dispositions, and event RSVPs.

Automatically: browser/device info, referring URL, UTM parameters, pages visited, and cookies for session auth and marketing attribution.

• Run the product a Customer paid for (CRM, messaging, donations, field, sites, compliance).
• Meet legal obligations — TCPA opt-in records, FEC and state donation reports, 10DLC brand/campaign registration.
• Improve OS1776 itself (aggregated, non-identifying usage metrics only).
• Bill you (via Stripe) and detect fraud/abuse.
• Communicate service updates, security alerts, and material changes to this policy.

We do not sell End User data. We do not cross-pollinate Customer data between tenants. Each tenant is logically isolated.

• Stripe — payments + subscription billing.
• Twilio or your provider of choice — SMS/MMS delivery and 10DLC registration.
• Resend / SendGrid — transactional and marketing email delivery.
• MongoDB Atlas + AWS — data storage and hosting infrastructure.
• AI providers (OpenAI, Anthropic, Google) — via routed API for AI-generated copy, images, and video. Prompt inputs are not used to train third-party models.
• Regulators — when required by law (FEC, state ethics commissions, court order, subpoena).

Customers can export or delete all tenant data at any time via the in-app data export flow. Delete is irrevocable and cascades within 30 days.

End Users — contact the Customer whose campaign has your data, or email privacy@os1776.com and we will route your request. We honor access, correction, deletion, and opt-out requests consistent with GDPR (EU), CCPA/CPRA (California), and TCPA (US SMS).

Active tenant data lives as long as the Customer's subscription remains active plus 30 days of grace period after cancellation. Financial records governed by IRS / FEC / state law are retained for the statutory period (typically 3 to 7 years) even after account deletion. Audit logs are retained for 12 months.

All data in transit is TLS-encrypted. Sensitive data at rest is encrypted at the storage layer. Passwords are hashed with bcrypt. Access to production is logged, requires MFA, and is audited quarterly. Suspected incidents get reported to affected Customers within 72 hours, consistent with GDPR breach-notification standards.

OS1776 exists to help legal political operations — federal, state, and local — organize supporters and comply with campaign-finance and communications law. We do not perform partisan targeting on our own behalf, do not build shadow profiles of individuals, and do not sell data to advertisers, data brokers, or campaigns.

Data-protection questions: privacy@os1776.com. Security reports: security@os1776.com. Legal notices to OS1776, Inc., c/o compliance, at the address on file with the Secretary of State.