Privacy Policy
This policy explains what personal information The Civics Project collects when you use civicsproject.org, Alerts, and our emails, why we collect it, who helps us process it, and the choices you have.
Last updated October 22, 2026
We collect what we need to run the site and Alerts. We do not sell personal information or use it for advertising. Card details are handled by Stripe, not by us. Several of our service providers store data in the United States.
Who we are
The Civics Project (civicsproject.org) is operated by Laurentian Assembly, 53 Pine Crest Road, Toronto, ON M6P 3G6, Canada. In this policy, “we”, “us”, and “our” mean that operator.
We are responsible for the personal information described here. Our Privacy Officer is accountable for how we handle it and answers privacy questions and requests.
- Privacy Officer. Mikaal Naik
- Email. hi@civicsproject.org
- Mail. 53 Pine Crest Road, Toronto, ON M6P 3G6, Canada
Information we collect
Most of the site can be read without an account. We collect personal information when you create an account, use Alerts, pay for something, or contact us, and some technical information when you browse.
- Account. Your email address, password, and postal code or ZIP code, whether you opted in to Civics Project emails, and your confirmation that you are 14 or older. Your password is stored by our authentication provider in hashed form; we never see it.
- Alerts membership. Your plan, trial or complimentary access dates, subscription status, and any membership code you redeem.
- Watchlists and bill follows. The regions, topics, keywords, and bills you choose to monitor, how often you want alert emails, and a history of changes to those settings.
- Business profiles. If you set up business monitoring: your organization’s website address and the profile built from it (name, activities, products, customers, markets, concerns, regions, and sources), plus any priorities and exclusions you add.
- Briefing reports. Reports you build in Alerts, including the title, recipient, organization, author name, introduction, and any notes, implications, or next steps you write.
- Billing. Our Stripe customer and subscription identifiers, plan, status, and billing dates, and the records Stripe sends us about your checkout and subscription (which can include your name, email, and billing country). We do not receive or store full card numbers.
- Email records. Which alert and bill emails we sent you and when, delivery status from our email provider (for example delivered, bounced, or marked as spam), and unsubscribe and pause links.
- Letters to representatives. If you send a paid letter: your name, email, mailing address, the recipient, and the letter text, so we can print and mail it.
- Donations. Donations are made on Stripe’s checkout page. Stripe collects your payment details, name, and email; we do not store donation records on our own systems.
- Search. The words you search for and the keywords in your watchlists, which we process to find matching legislation. Search text is stored without any link to your account.
- Usage and device information. Pages you view, buttons and links you select, the actions you take in sign-up, checkout, and Alerts, errors that occur in your browser, and basic device, browser, and approximate location information derived from your IP address. See Cookies and analytics.
- Messages to us. Anything you send when you email us, such as support or privacy requests.
How we use information
We use personal information only for these purposes:
- To create and secure your account, verify your email, and keep you signed in.
- To provide Alerts: monitor legislation and public decisions against your watchlists and business profile, send the alerts you ask for, and build your reports.
- To show legislation and representatives relevant to your postal code.
- To take payment, manage your subscription, and keep records required for tax and accounting.
- To print and mail letters you pay for.
- To send newsletters and other Civics Project emails if you opted in.
- To answer your questions and requests.
- To understand how the site is used, fix errors, and improve features.
- To prevent abuse and fraud, protect our systems, and meet our legal obligations.
We do not sell or rent personal information, and we do not use it for targeted advertising.
Consent and legal basis
We handle personal information under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, for people in Quebec, the Act respecting the protection of personal information in the private sector as amended by Law 25.
We rely on your consent. You give express consent when you create an account, opt in to emails, set up Alerts, or start a checkout. We rely on implied consent for uses you would reasonably expect, such as sending an alert you asked for or a receipt for a payment.
You can withdraw consent at any time, subject to legal or contractual limits, by changing your settings, unsubscribing, cancelling your subscription, or contacting our Privacy Officer. Withdrawing consent may mean we can no longer provide part of the service, such as Alerts.
We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. The AI relevance checks described below only decide which items appear in your alerts.
Alerts accounts, watchlists, and reports
Alerts is our paid monitoring service. Your watchlists, business profile, and reports are linked to your account and visible only to you and to the small team that operates the service.
- When a membership ends. If your subscription is cancelled, lapses, or a complimentary period ends, we stop sending alerts but keep your watchlists, business profile, and reports so you can pick up where you left off. They stay until you delete them or ask us to delete your account.
- Deleting watchlists. When you delete a watchlist, we stop monitoring it and remove it from your workspace. We keep a record of the deleted watchlist with your account for 12 months.
- Deleting reports. You can permanently delete a briefing report from your workspace at any time.
- Unsubscribing. Using “unsubscribe from all” in an alert email turns off all your alerts and removes your bill follows.
AI processing
We use OpenAI’s API to power several features. We send OpenAI only what each feature needs, and we do not send your name, email address, password, payment details, or account identifier.
- Business research. When you add a business website, we send OpenAI the website address. OpenAI’s web search tool reads public pages on that website and elsewhere on the web; our servers do not download your website. OpenAI then writes a proposed business profile from what it finds, which you review before monitoring starts.
- Relevance checks. To decide whether a new bill, motion, or consultation matters to you, we send OpenAI your approved business profile, including any priorities and exclusions you wrote, together with the public description of that item.
- Search and keywords. Search queries and watchlist keywords are sent to OpenAI to create embeddings, numerical representations used to find related legislation. We cache these embeddings with the original text, but not with who searched.
- Public content. We also use OpenAI to summarize public bills, votes, and council decisions. This involves public records, not information about you.
OpenAI processes this data in the United States as our service provider. Under OpenAI’s API terms, data sent through the API is not used to train its models by default. AI output can be wrong; you can edit your business profile, and you should check original sources before relying on an alert.
Do not put sensitive personal information about yourself or others in a business profile, keywords, or report notes.
Payments
Payments for Alerts, letters, and donations are processed by Stripe. You enter card details on Stripe’s checkout and billing pages, and Stripe stores them; we never see or store full card numbers.
For Alerts, we create a Stripe customer with your email address and an internal account identifier so Stripe can link payments to your account. Stripe sends us records of checkouts, subscriptions, and payment events, which we keep to manage your access and for accounting.
Stripe handles payment information under its own privacy policy, as an independent business for some purposes such as fraud prevention.
We send email through Resend, and password-reset emails through our authentication provider, Supabase.
- Account emails. Email verification and password resets. These are needed to run your account.
- Alerts and bill follows. The alert digests, instant alerts, and bill updates you set up. Each one has a one-click unsubscribe link and a link to pause or manage your alerts.
- Newsletters. We send newsletters and other Civics Project emails only if you opted in. The sign-up checkbox is off by default. Every newsletter has an unsubscribe link.
Our commercial emails follow Canada’s Anti-Spam Legislation (CASL): they identify us, include our mailing address, and let you unsubscribe at no cost. We act on unsubscribe requests promptly and within 10 business days.
Our email provider tells us whether each message was delivered, bounced, or marked as spam. If an address bounces permanently or reports spam, we add it to a suppression list and stop sending alerts to it.
Service providers
We share personal information only with service providers that help us run The Civics Project, only for the purposes above, and under contracts that require them to protect it. We may also disclose information when required by law or to protect our rights or the safety of others, or as part of a sale or reorganization of the service.
- Supabase. Database and sign-in for all account, Alerts, billing, email, and letter records. United States (Ohio).
- Vercel. Website and API hosting, server logs, and cookieless analytics. United States, with a global delivery network.
- DigitalOcean. Runs background jobs, including business research. Hosted by DigitalOcean in North America.
- Stripe. Payments, subscriptions, and the billing portal. United States and other countries.
- Resend. Email delivery and delivery status. United States.
- OpenAI. Business research, relevance checks, search embeddings, and public-content summaries. United States.
- PostHog. Product analytics and error tracking. United States.
- Google. Google Analytics, and the mailbox that receives letter orders for fulfilment. United States.
- Slack. Internal notifications to our team, which can include the sender and recipient names on letter orders. United States.
Public data sources such as legislatures, councils, and LegiScan supply the legislation we monitor. We do not send them your personal information.
Transfers outside Canada
Most of our service providers, including our main database, store or process personal information in the United States. While it is there, it is subject to United States law and may be accessed by courts, law enforcement, and national security authorities in that country.
Where Quebec law applies, we assess whether information will be adequately protected before it is communicated outside Quebec, and we rely on contractual protections with our providers.
How long we keep information
We keep personal information only as long as we need it for the purposes above or as the law requires, then delete or anonymize it.
- Account, watchlists, business profiles, and reports. Until you delete them or ask us to delete your account. They are not deleted automatically when a membership ends.
- Alert emails. The content of alert digests is cleared after 30 days. Records of alert emails, their delivery status, and the related delivery events are deleted after 13 months.
- Bill-follow email records. Kept with your account until it is deleted.
- Suppression list. Addresses that bounced or reported spam are kept so we do not email them again.
- Billing records. As long as required for tax and accounting purposes, currently six years.
- Letter orders. Six years, as they are purchase records.
- Search text. Stored without a link to any account, for 12 months.
- Analytics. According to the retention settings of PostHog and Google Analytics, currently up to 14 months.
- Server logs. According to our hosting providers’ log retention, generally a few days to a few weeks.
Your rights and choices
You have the right to know what personal information we hold about you and how we use it, to get a copy, to correct it, to withdraw consent, and to ask us to delete it. People in Quebec can also ask for a copy in a commonly used technological format, and can ask about the outcome of any automated processing.
You can do some of this yourself: edit or delete watchlists and reports in Alerts, pause or unsubscribe from emails, and cancel or change your subscription in the billing portal.
For everything else, including access, correction of your email or postal code, and account deletion, email our Privacy Officer at hi@civicsproject.org from the address on your account. There is no self-serve account deletion yet. We may ask you to confirm your identity, and we respond within 30 days. Requests are free.
When we delete an account, we also delete its watchlists, business profile, reports, bill follows, and email records. We keep what the law requires us to keep, such as billing records, and the suppression entry for your email address if it bounced or reported spam. Stripe and our other providers keep their own records under their policies.
If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d’accès à l’information (cai.gouv.qc.ca).
Security
We use technical and organizational measures to protect personal information: encrypted connections, hashed passwords, HttpOnly secure sign-in cookies, hashed membership codes and email action links, and access limited to the people who run the service.
No system is perfectly secure. If a privacy incident creates a risk of serious harm, we will notify the people affected and the Office of the Privacy Commissioner of Canada and, where it applies, the Commission d’accès à l’information, as the law requires.
Children
Civics Project accounts are for people 14 and older, and you must confirm your age when you sign up. Alerts is a service for professionals and organizations. If we learn that we have collected personal information from a child under 14 without a parent’s or guardian’s consent, we will delete it.
Changes to this policy
We may update this policy as the service changes. We will post the new version on this page and update the date at the top. If we make a significant change to how we use your personal information, we will tell account holders by email before it takes effect.